An adjuster from a workers compensation carrier calls about a patient who hurt his shoulder lifting stock. The carrier is paying for the visits, the claim number is on the file, and the adjuster wants "the complete medical record." The next day the patient's employer calls, wanting to know how long he will be out and whether the injury is really work related. Both callers sound entitled to an answer. Only one of them is, and even that one is not entitled to everything.
HIPAA addresses workers compensation in a single sentence, 45 CFR 164.512(l), and the sentence is more careful than most practices remember. This post quotes it, connects it to the payment rule, the minimum necessary rule, and the accounting rule that all still apply, sorts out the three parties who typically ask, and ends with the procedure and policy language a front desk can actually follow.
HIPAA Workers Compensation Rules: 164.512(l) and Its Limits
1. The Permission
164.512(l) reads: "A covered entity may disclose protected health information as authorized by and to the extent necessary to comply with laws relating to workers' compensation or other similar programs, established by law, that provide benefits for work-related injuries or illness without regard to fault." No patient authorization is required for a disclosure that fits inside that sentence. But every clause is a limit. The disclosure must be "authorized by" the workers compensation law of your state, and only "to the extent necessary to comply" with it. The federal rule gives permission; the state statute defines its size.
A second permission overlaps. 164.512(a)(1) allows disclosures "required by law," "limited to the relevant requirements of such law." Where a state workers compensation statute or a state board order compels a provider to furnish records, that is a required-by-law disclosure, and 164.502(b)(2)(v) says minimum necessary "does not apply" to it. Where the statute merely permits the carrier to obtain records, 164.512(l) governs and minimum necessary applies in full.
2. The Carrier Is Also Just a Payer
The workers compensation carrier is generally not a HIPAA covered entity. 45 CFR 160.103 excludes from the definition of health plan "any policy, plan, or program to the extent that it provides, or pays for the cost of, excepted benefits that are listed in section 2791(c)(1) of the PHS Act," and workers compensation coverage is among those excepted benefits. That does not stop the practice from talking to it. Under 164.506(c)(1), "a covered entity may use or disclose protected health information for its own treatment, payment, or health care operations," and 164.501 defines payment to include activities by "a health care provider or health plan to obtain or provide reimbursement for the provision of health care," including "billing, claims management, collection activities." Sending the carrier what it needs to pay the claim is the practice's own payment activity. Sending it the patient's unrelated history from 2014 is not.
3. Minimum Necessary Draws the Line
164.502(b)(1) requires "reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request." For workers compensation that purpose is the work injury: the mechanism, the diagnosis, the treatment, the work restrictions, the prognosis, and the billing for it. A prior unrelated diagnosis, mental health history, or the visit for something else three months earlier is outside the purpose unless the state law or a specific order reaches it.
Two implementation specifications make this manageable. For "any type of disclosure that it makes on a routine and recurring basis," 164.514(d)(3)(i) requires "policies and procedures (which may be standard protocols) that limit the protected health information disclosed to the amount reasonably necessary." Workers compensation is exactly that: write the standard packet once. And 164.514(d)(3)(iii)(A) lets the practice rely, "if such reliance is reasonable under the circumstances," on a public official's representation that a request is the minimum necessary, which covers state board requests on letterhead. The everyday version of the rule is in the minimum necessary post.
| Who is asking | Basis | What to send | What not to send |
|---|---|---|---|
| Workers compensation carrier or its adjuster | 164.512(l) within state law; 164.506(c)(1) payment | The work-injury record: intake, diagnosis, treatment, restrictions, work status, bills, as the state statute allows | Unrelated history, other conditions, psychotherapy notes; nothing beyond the claim's scope without an authorization |
| State workers compensation board or commission | 164.512(l); 164.512(a) if the request is compelled | What the order or statute specifies; rely on the official's minimum-necessary representation under 164.514(d)(3)(iii)(A) | Anything outside the order |
| The employer | Only what state workers compensation law authorizes the employer to receive; otherwise an authorization under 164.508 | Work status and restrictions if state law provides for it; otherwise nothing without the patient's signed authorization | Diagnosis, treatment detail, or opinions on whether the injury is work related, absent state authority or an authorization |
| The employer's attorney, an independent examiner, a case manager | Check whether they act for the carrier under state law; otherwise authorization | Per the carrier's scope if they are its agent under state law | Treat as a third party until their authority is shown (164.514(h)) |
| The patient | 164.524 right of access | Everything in the designated record set, on request, within 30 days | Nothing withheld because "the carrier has it" |
4. The Employer Is the Hard Case
Employers ask because they are paying premiums and managing schedules, and in many states the statute gives them some right to claim information. The practice's job is to know what that right is, in writing, and to release only that. Where the statute does not reach the employer, the path is a signed authorization under 164.508, with the core elements and the redisclosure warning in 164.508(c). The patient is free to sign it or not, and under 164.508(b)(4) the practice may not condition treatment on the signature. The elements of a valid form are in the authorization requirements guide, and a working template is in the release form post. One nuance for HR departments: 160.103 excludes from P.H.I. (Protected Health Information) records "in employment records held by a covered entity in its role as employer," which protects nothing in the treating practice's chart. The exclusion is about the employer's own files, not yours.
5. Verify, Log, and Account
Before any disclosure under 164.512, 164.514(h)(1) requires the practice to "verify the identity of a person requesting protected health information and the authority of any such person," if not already known. A phone call saying "this is the adjuster" is not verification; a claim number that matches the file, a written request on the carrier's letterhead, or a portal the practice already uses is. For public officials, 164.514(h)(2)(ii) accepts a badge in person or a request "on the appropriate government letterhead."
Then record it. Disclosures under 164.512 are not among the exceptions to the accounting right in 164.528(a)(1), so every workers compensation disclosure made under 164.512(l) goes in the disclosure log with the date, the recipient, a description of what was sent, and the purpose, as 164.528(b)(2) requires. A patient can ask for that accounting for six years back and must receive it within 60 days. Payment disclosures under 164.506 are excepted from the accounting, which is one reason it matters to decide, per disclosure, which permission the practice is using, and to write it on the log. The state-law overlay, including the fact that a more protective state privacy rule wins under 160.203(b), is covered in state privacy laws vs HIPAA.
6. What to Write Into Policy
- The state workers compensation provisions the practice relies on, cited by section, with the date last checked and the specific rights they give to carriers, boards, and employers.
- The standard workers compensation disclosure packet under 164.514(d)(3)(i): the record categories included, the categories excluded by default, and who may approve anything beyond the packet.
- The verification steps for adjusters, board staff, employer representatives, and attorneys (164.514(h)).
- The employer rule: release only what state law names; otherwise a signed 164.508 authorization, never a phone summary.
- Which permission is used for each disclosure type (164.512(l), 164.512(a), 164.506) and how each is logged for 164.528.
- The patient's own access under 164.524, unaffected by the claim.
- Training for the front desk and billing staff, and the escalation to the privacy officer for anything outside the packet.
The whole rule fits in one sentence of the regulation and one page of policy. The practices that get into trouble are the ones that treat "workers comp" as a magic phrase that unlocks the chart. It unlocks the part of the chart the state statute says it does, and the rest stays where it was. The broader Privacy Rule framework is in the Privacy Rule overview.
---
FAQ
Do we need the patient's authorization to send records to the workers compensation carrier?
Not for information the state workers compensation law authorizes the carrier to receive; 45 CFR 164.512(l) permits that disclosure. Anything outside that scope needs a 164.508 authorization.
Can the workers compensation carrier demand the complete medical record?
It can ask. The practice may release only what is necessary to comply with the state law and, under 164.502(b), the minimum necessary for the claim, unless a law or an order compels more.
Can we tell the employer the diagnosis?
Only if state workers compensation law authorizes that disclosure to the employer. Otherwise the employer needs the patient's signed 164.508 authorization, and treatment may not be conditioned on signing it.
Do workers compensation disclosures go in the accounting of disclosures?
Yes. Disclosures under 164.512 are not excepted under 164.528(a)(1). Log the date, the recipient, a description of the information, and the purpose for each one.
Can the patient still get his own records during a workers compensation claim?
Yes. The right of access under 164.524 applies regardless of the claim, within 30 days of the request.
Conclusion
A workers compensation disclosure packet is one standard protocol under 164.514(d)(3)(i), written once and used every time. One Guy Consulting's Full-Scope plan includes the uses and disclosures policy, the verification procedure, and consulting time to build the packet around your state's statute. Start with a free 30-minute compliance review. No obligation, no pressure.
Sources
- 45 CFR 164.512 (disclosures for workers' compensation, paragraph (l); required by law, paragraph (a))
- 45 CFR 164.502 (minimum necessary standard)
- 45 CFR 164.506 (treatment, payment, and health care operations)
- 45 CFR 164.514 (minimum necessary implementation; verification requirements)
- 45 CFR 164.528 (accounting of disclosures)
- 45 CFR 164.508 (authorizations)
- 45 CFR 160.103 (definitions: health plan, protected health information)
- 45 CFR 160.203 (preemption of state law)
Related Reading