Workers' Compensation & HIPAA Privacy Rule
fact sheet

The Health Insurance Portability and Accountability Act (HIPAA) was signed into Federal Law in 1996. It calls for the simplification of health care transactions and regulations to ensure the privacy and security of health information. The HIPAA Privacy Rule is effective April 14, 2003.

The American Recovery and Reinvestment Act (ARRA) signed into federal law in February 2009, modifies the HIPAA Privacy and Security Rules, and requires full compliance in February 2010. These changes impact not only "covered entities," but have a significant impact on "business associates" of covered entities. ARRA also adds increased enforcement provisions including increased penalties, and allowing state Attorney's General to file civil suits on behalf of injured parties.

For more information regarding recent federal rule changes, related to ARRA modification of HIPAA, you may access the related Federal Register sections through the following links:

Privacy rule facts

• Applies to a health plan, a health care clearinghouse, and a health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter. - 45 CFR 160.1 02 (a)
  
  
• Specifically excludes workers' compensation insurance from the definition of a "health plan." - 45 CFR 160.103
  
  
• Does not apply to the workers' compensation insurers, workers' compensation administrative agencies, or most employers.
  
  
• Permits health care providers to disclose protected health information (PHI) to workers' compensation insurers, State administrators, employers, and other persons or entities involved in workers' compensation systems. - 45 CFR 164.512 (l)
  
  
• Limits the amount of protected health information health care provider is allowed to disclose to the minimum necessary to accomplish the workers' compensation purpose and to the full extent authorized by State or other law. - OAR 436-010-240(1)
  
  
• Permits health care provider to reasonably rely on State workers' compensation agency or other public official representations that the information requested is the minimum necessary for the intended purpose. - 45 CFR 164.514(d)(3)(iii)(A) Is not intended to impede the flow of health information to those who need it to process or adjudicate claims, or coordinate care, for injured or ill workers under workers' compensation systems. - 45 CFR 164.512(l)
  
  
• Permits health care provider to disclose the type and amount of information necessary to receive payment for any health care provided to an injured or ill worker. - 45 CFR 1 64.501 & 164.502(a)(1)(ii)
  
  
• Permits health care provider to disclose protected health information in the course of any judicial or administrative proceeding in response to a court order, subpoena, or other lawful process. 45 CFR 1 64.512(e)