How HIPAA-GINA Work to Protect/Regulate all of us in Workers' Comp Claims

Tuesday, December 16, 2014 | 0

We get asked all the time and we want our readers to best understand HIPAA-GINA in their day-to-day workers' compensation claims handling.

If you aren’t sure, the Health Insurance Portability and Accountability Act is about medical records privacy. The Genetic Information Privacy Act is about genetic privacy in medical records and any other records you might keep about your workers. These two concepts are federal law to which we are all subject. As defense lawyers, we assure everyone you can’t skip the requirements of federal law if you handle U.S. workers’ comp claims.
 
What is initially confusing about HIPAA-GINA is the U.S. Department of Labor has an “exception” to the laws for workers’ comp claims. Every reader and anyone attending one of our many presentations/webinars always asks what in tarnation that might mean. No one initially understands what an “exception” to a federal law could be. They don’t have “exceptions” to traffic laws, do they?
 
For clarity, the “exception” to HIPAA-GINA is on the web at 45 CFR 164.512(l) (Download a copy in PDF).

It starts by saying:
 
The HIPAA Privacy Rule does not apply to entities that are either workers’ compensation insurers, workers’ compensation administrative agencies, or employers, except to the extent they may otherwise be covered entities. However, these entities need access to the health information of individuals who are injured on the job or who have a work-related illness to process or adjudicate claims, or to coordinate care under workers’ compensation systems. Generally, this health information is obtained from health care providers who treat these individuals and who may be covered by the Privacy Rule. The Privacy Rule recognizes the legitimate need of insurers and other entities involved in the workers’ compensation systems to have access to individuals’ health information as authorized by state or other law. Due to the significant variability among such laws, the privacy rule permits disclosures of health information for workers’ compensation purposes in a number of different ways.
 
In short, if you have a workers’ comp claim, you may not have to worry about HIPAA-GINA if the stars align and everyone knows the rule above and follows it. The problem is medical caregivers, doctors and hospitals may or may not know the “exception” and typically don’t care – they still want a signed HIPAA-GINA release to be sure they are routinely following the law.
 
Why is that a good idea for doctors/hospitals and other folks in that industry? Well, we ask all of our readers – when is a claim for accident or exposure truly a workers’ compensation claim? The simple answer to this question is – no one knows! By that we mean, if you slam your foot into a wall at work, it is up to you to decide whether you want the necessary medical care to be workers’ compensation or group health. If you are embarrassed about a safety mistake and/or don’t want your employer to deal with your foot injury as a work comp matter for whatever reason, it isn’t a work comp claim! You can actually later decide you want work comp coverage which would make access to medical records fall under the “exception” above. You might then withdraw the claim which would put access to your records outside the exception. It is also possible either the injured/ill worker or their selected attorney might withdraw their HIPAA-GINA release and demand all medical records be kept completely secret. They might sue you under HIPAA-GINA if you won’t follow their wishes. In short, the applicability of the HIPAA-GINA exception for WC claims may be contingent on numerous ever-changing factors. For that reason, we consider reliance on the exception to be a claims mistake.
 
Our advice to everyone in the industry is to routinely have your injured/ill workers who are claiming the injury/illness is related to work complete an accident/work-related illness investigation form and a HIPAA-GINA-compliant release. We suggest such documents be combined into one longer form.
 
If you have a signed HIPAA-GINA-compliant form, you have full and complete access to printed and electronic copies of medical records and bills. You won’t then care if the claim is workers’ comp or not workers’ comp – you still have the ability to obtain and safely store the records. You won’t need to rely on the “exception” above in any way.
 
Don’t I Have to Keep the Medical Records/Bills Safe and Private?
 
You betcha! All medical records and bills should come with an implied privacy stamp on them. We don’t mean you have to print the word “private” on them but you have to be sure they are all kept private and away from prying eyes. If you don’t, you may get sued. One question we ask corporate safety/risk managers in our readership – do you have a fax machine or computer in your office used for transmission of medical records/bills open to viewing or use by workers that aren’t in safety/risk management? If you have such a fax machine or computer, we assure you that you are breaking U.S. law. Any fax machine or computer that is used to receive medical records and bills has to be in a locked office that is only accessed by your HIPAA-GINA “privacy circle” managers. If you need assistance with this concept, send a reply.

How Does This Apply to WC Nurse Case Managers?
 
It applies the same way it applies to adjusters.
 
If you have our signed HIPAA-GINA release, you have full authority from the patient to get medical records and bills and forward them to the insurance carrier/TPA.

If you don’t have a signed HIPAA-GINA release, you are taking a chance to get medical records and bills but should be protected under the “exception” above.

If you have a signed HIPAA-GINA release and the release is withdrawn by claimant or counsel as they are entitled to do under federal law, it is problematic to rely on the “exception” and we recommend not doing so.
 
If the release is withdrawn, our vote is to work out a deal on “transparency” with the claimant and/or his counsel to insure the attorneys are getting the same reports as the insurance company or the third-party administrator. Happy to explain.
 
Wassup with this GINA Thing?
 
If you are routinely asking your workers about family history of heart attack, stroke or other medical conditions at any time, you have to have a signed GINA-compliant release or you may be violating U.S. law. Our vote is to get such questions out of any document you are using. The feds went after an employer that didn’t know the new and hard-to-understand rule and got a $100,000 settlement from them to demonstrate the seriousness of genetic privacy.

Eugene Keefe is a founding partner of Keefe, Campbell, Biery and Associates, a workers' compensation defense firm in Chicago. This column was reprinted with his permission from the firm's KCBA blog.