Workers’ Comp Cases Raise Complex Privacy Issues

Regardless of whether psychiatrists are required to comply with the federal privacy rule under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), they should understand the minimum floor of confidentiality protections contained in the rule, because these protections may be viewed as a national standard by which all psychiatrists could be judged if facing a breach of confidentiality lawsuit under state law or a licensing-board complaint.

The focus of this article is the disclosure of information about patients with whom there is or has been a psychiatrist-patient treatment relationship and who are seeking workers’ compensation benefits.

Under HIPAA, entities that provide benefits for workers’ compensation are excluded from the definition of “covered entities” and therefore are not required to comply with any of HIPAA’s regulations, such as the privacy rule. These entities, however, may request the release of patient information for workers’ compensation purposes from psychiatrists who are covered providers. The purpose for which protected health information is created or released is not relevant in determining the applicability of the privacy rule—it is the psychiatrist’s status as a covered provider that is the determinative factor. Once a psychiatrist is a covered provider under HIPAA, the privacy rule applies to all disclosures, regardless of the HIPAA status of the entity requesting protected health information.

This article, when using the term “psychiatrist,” assumes that the psychiatrist meets the regulatory definition of a “covered provider” so is “covered by” (must comply with) the HIPAA regulations.

Unfortunately, the privacy rule is complex and confusing not only to psychiatrists but also to attorneys. Psychiatrists should anticipate encountering the false proposition that “HIPAA does not apply to workers’ compensation” when records are requested or subpoenaed. However, the responsibility for protecting the confidentiality of all patient information remains with the psychiatrist.

More Than HIPAA at Stake

When deciding whether to disclose a patient’s protected health information for workers’ compensation purposes, federal confidentiality laws, as well as state confidentiality laws and state workers’ compensation laws, must be considered. The privacy rule explicitly permits psychiatrists to disclose protected health information “as authorized by and to the extent necessary to comply with [state and other] laws relating to workers’ compensation.” However, just because a disclosure is “permitted” does not mean that records must be released. Determining state-law requirements is the starting point when determining whether to disclose protected health information; then psychiatrists must additionally ensure that applicable privacy rule requirements are met.

For example, under some state laws, a subpoena alone may be sufficient to compel the release of records for workers’ compensation purposes. Before a psychiatrist in one of those states may disclose records, however, he or she must assure that the specific subpoena requirements of the privacy rule are also met—or risk violation of the privacy rule. As discussed below, a subpoena alone is insufficient to compel the release of records, even if the release is allowed under state law.

Patients whose protected health information is at issue for workers’ compensation purposes are generally entitled to the same rights under the privacy rule as any other patient. There is an exception, however: Patients do not have the right to request that a psychiatrist restrict a disclosure of protected health information for workers’ compensation purposes when that disclosure is required by law or authorized by, and necessary to comply with, a workers’ compensation or similar law.

Basis For Disclosure: The Issues

• Patient authorization: Protected health information may be disclosed with the patient’s authorization. Psychiatrists must ensure that the release signed by the patient complies with the requirements for authorizations under the privacy rule, as well as any requirements under state law.

• No patient authorization: If a state law requires workers’ compensation disclosures without patient authorization, such disclosures are permitted under the privacy rule.

Psychiatrists need to pay attention to the scope of the information that is to be released, as providers are limited to releasing only what the law specifically requires. For example, if a state law requires all medical information to be released, does that include psychiatric information? Some state laws specify that psychiatric records are to be disclosed. Also, which records are to be released? States often require the release only of records related to the workers’ compensation injury.

In addition to state mental health laws, other laws may govern the release of information in the psychiatrist’s chart, such as the federal regulations about substance abuse treatment information and state laws related to disclosure of HIV information.

• Valid judicial or administrative orders: Protected health information may be disclosed pursuant to a valid order. Psychiatrists are encouraged to notify the patient of the order so that the patient can discuss any questions or concerns about the release with an attorney.

• Subpoenas for records: Patient records may be disclosed for workers’ compensation purposes in response to a valid subpoena or other lawful process that complies with the privacy rule’s requirements.

Specifically, psychiatrists are permitted to release workers’ compensation protected health information in response to a subpoena, discovery request, or other lawful purpose if

(1) the psychiatrist receives satisfactory assurances (consisting of specific written statements with accompanying documentation) from the entity seeking the information that it has made reasonable efforts to ensure that the individual whose protected health information is being requested has been given notice of the request, or it has made reasonable efforts to secure a “qualified protective order” (where a court, after hearing argument, issues an order protecting the confidential information from disclosure) that is HIPAA-compliant or

(2) the psychiatrist makes reasonable efforts to provide notice to the individual or seek a qualified protective order (with the same requirements for written statements with accompanying documentation).

So, subpoenas that are not accompanied by such “reasonable assurances” (or authorization or court order) are not HIPAA compliant and are insufficient to compel the disclosure of protected health information. Moreover, if state law or other federal confidentiality law has additional requirements for disclosure of protected health information in response to a subpoena that are more protective of confidentiality, then that law or those laws must be complied with.

Limitations on Disclosure: ‘Minimum Necessary Standard’

The minimum necessary provisions do not apply to disclosures made pursuant to patient authorization, required by law, made to the patient, made to a provider for treatment, or made to the Department of Health and Human Services. Unless one of these exceptions applies, the privacy rule requires covered providers to limit the amount of protected health information disclosed to the minimum necessary to accomplish the workers’ compensation purposes.

The minimum necessary standard does not apply to workers’ compensation disclosures required by law. However, psychiatrists must still limit the scope of disclosure to that which is required by law, for example, only those records related to the workers’ compensation injury.

The minimum necessary standard applies to workers’ compensation disclosures not required by law. If state law does not require a disclosure that is requested for a workers’ compensation purpose, psychiatrists must determine what is the minimum necessary for that workers’ compensation purpose. Psychiatrists are permitted to rely on representations by a public official, such as a state workers’ compensation official, that the information requested is the minimum necessary for the intended purpose.

To further complicate matters, if the minimum necessary standard applies, the privacy rule requires justification for release of the entire record.

As has historically been true, all psychiatrists are encouraged to notify patients of all requests for release of their psychiatric information. This is especially important in workers’ compensation cases in which a psychiatrist’s unjustified refusal to release patient information for workers’ compensation purposes could result in the denial of benefits for the patient. The best way to minimize the risks associated with the release of psychiatric information is to obtain the patient’s informed permission for the release and have that permission documented on an authorization form. When this is not possible, psychiatrists may want to consult with their professional liability insurance carrier or their personal attorney. ▪

Ms. Vanderpool is a senior risk manager at Professional Risk Management Services Inc., manager of the Psychiatrists’ Program, the APA-endorsed Psychiatrists’ Professional Liability Insurance Program.