HIPAA and Work Comp, Physicians Beware

Sunday, September 14, 2003 | 0

Specifically excluded from the provisions of the Health Insurance Portability and Accountability Act (HIPAA) is information required for the processing of workers' compensation claims, so long as the state in question has laws in place permitting the disclosure of such information.

Many states at the time HIPAA was made law in fact did not have any such provisions, though most states have since put into place the appropriate laws and regulations to ensure the continued flow of workers' compensation business. However, most states are also recommending the use of HIPAA exclusion/release forms to ensure that there are no legal complications arising out of the disclosure of medical information in the work comp setting.

HIPAA specifically authorizes health care providers to release workers' health information "to the extent necessary to comply with [state] laws relating to [workers' comp programs]." Therefore, physicians can disclose workers￢ﾀﾘ comp patients' information for treatment, payment, or health care operations purposes without patient authorization. HIPAA also allows physicians to disclose the information to their patients' employers, as required by state law.

The California Medical Association warns its members:

"Disclosures that are not made for payment purposes must still be logged as required by HIPAA. This includes disclosures made for subpoenas, court orders, fee reviews, independent medical reviews, impairment evaluations, and similar testing. HIPAA also requires physicians to keep a log of all such disclosures, including those related to workers' comp claims, and provide the log to patients or their personal representatives who request it." (Emphasis added.)

The CMA has developed a form for the purpose of logging disclosures, and has also published instructional material for this purpose (see CMA ON-CALL document #1122, "Accounting of Disclosures").

HIPAA's electronic transactions rule goes into effect October 16. This rule standardizes claims submission, processing, and payment that are preformed electronically. Systems require significant upgrades. CMA is advising physicians who perform electronic transactions, or use a billing service or clearinghouse to do so, to contact their practice-management-system vendors and billing services, and offers sample letters for doing so (go to the HIPAA Resource Center at the CMA website (members only).

Finally, CMA warns that there is no "country physician" exemption to HIPAA, as apparently some physicians are being told. CMA offers a 10 question test to determine if your practice is a "covered entity" required to comply with HIPAA. Answer yes to any of the questions and you are a "covered entity". The questions can be found at http://www.calphys.org/html/bb363.asp.