HIPAA and L&I

	Contact Us

This information is to help you protect the privacy of your patients' personal health information and your own liability risk.

The Privacy Rule contains important exceptions for providers treating patients covered by:

• the workers compensation program,
• the Crime Victims' Compensation (CVC) program, and
• for providers conducting an examination required by the Washington Industrial Safety and Health Act (WISHA).

HIPAA information

• About HIPAA.
• How HIPAA's privacy rule affects you at L&I.
• Authorizations are not needed when patients are covered by workers' compensation.
• Washington State law requires you to submit personal health information even if you are a covered entity.
• Releasing personal health information to vocational counselors, nurses and others assisting L&I or self-insurer.
• HIPAA should not interfere with delivery of vocational rehabilitation services.
• HIPAA's "minimum necessary" standard does not apply to workers' compensation or crime victims' compensation claims.
• WISHA examinations do not require a patient authorization.
• Your privacy notice should address disclosure to Labor and Industries.
• External HIPAA links.

About HIPAA

Congress passed the Health Insurance Portability & Accountability Act (HIPAA) in 1996. One goal was to simplify the process by standardizing electronic transactions in the health care industry. Also to protect the security of health records stored or transmitted electronically and disclosed by health care providers, health care clearinghouses or health plans.

Since 1996, the federal Department of Health and Human Services has passed rules that describe what changes are required, deadlines for their implementation, and what penalties will be imposed for non-compliance. Links to further information about these rules is provided at the end of this page.

How HIPAA's privacy rule affects you at L&I

All of the programs administered through L&I are exempt from the HIPAA Privacy Rule. However, we recognize that as a health care provider, you may be subject to the provisions of HIPAA's Privacy Rule. The information on this web site explains how you can cooperate with L&I and protect the privacy of your patients' personal health information, while minimizing your own liability risk.

The Privacy Rule contains important exceptions for providers treating patients covered by the workers' compensation program, the Crime Victims' Compensation (CVC) program, and for providers conducting an examination required by the Washington Industrial Safety and Health Act (WISHA).

Authorizations are not needed when patients are covered by workers' compensation

The HIPAA Privacy Rule exempts workers' compensation from its authorization requirement (45 CFR § 164.512(l)). This means you can disclose personal health information to L&I or self-insurer without an authorization from your patient, and without violating HIPAA.

HIPAA also allows you to disclose personal health information without an authorization directly to employers regarding work-related illnesses or injuries (45 CFR § 164512(b)(v)(B)). This means, for example, that you can release information about your patient's physical restrictions to an employer who may have light duty work available.

Washington State law requires you to submit personal health information even if you are a covered entity

HIPAA (45 CFR § 164.512(a)) does not overrule any state law that requires the disclosure of personal health information. Washington State has specific laws that require medical providers to disclose personal health information to L&I or self-insurer, as well as the claimant's representative and employer for workers' compensation and crime victims' claims:

For workers' compensation:
RCW 51.36.060 Duties of attending physician - medical information.

For crime victims' compensation:
RCW 7.68.145 Release of information in performance of official duties.

Releasing personal health information to vocational counselors, nurses and others assisting L&I or self-insurer

When a worker signs a "Report of Industrial Injury or Occupational Disease" form* or files an application to reopen a claim with L&I, he or she authorizes treating providers to release the worker's personal health information (PHI) as needed for them to receive benefits. These benefits may include vocational rehabilitation, nurse case management, utilization review, independent medical exams, foreign language translation, and pre-authorized services such as pain clinics. Professionals who are not employed by the L&I usually provide these services.

If these professionals have an active provider number with L&I, and they perform services for a worker with an industrial insurance claim, providers must release the worker's PHI to them, and may do so without another authorization from the worker and without violating HIPAA.

*For self-insurers, the "Physician's Initial Report" form or the "Self-insurer Accident Report" (SIF-2) form.

HIPAA should not interfere with delivery of vocational rehabilitation services

In order to receive workers' compensation benefits and/or vocational rehabilitaion services a worker must provide their personal health information. Treating providers must release the worker's personal health information to Vocational Rehabilitation Counselors without further authorization from the worker. Releasing this information does not violate HIPAA regulations because the injured worker has authorized its release by signing the 'Report of Industrial Injury or Occupational Disease' form.

Vocational Rehabilitation Counselors are allowed to disclose a worker's personal health information to L&I and/or the worker's employer in order to get reimbursed for their services. Examples include releasing the personal health information as part of medical reports, physical capacity evaluations, independent medical exams, vocational assessments, identifying light duty or tansitional return to work opportunities, and/or job analyses as required by WAC 296-19A-030.

Vocational Rehabiliation Counselors are bound by RCW 51.28.070 to keep personal health information of workers compensation clients confidential. WAC 296-19A-270 states that corrective action can be taken against a Vocational Rehabilitation Counselor for "Unauthorized disclosure of confidential claim information, including, but not limited to, private (personal) health information."

HIPAA's "minimum necessary" standard does not apply to workers' compensation or crime victims' compensation claims

HIPAA's minimum necessary standard does not apply to any disclosure you are required to make by law (45 CFR § 164.502(b)(2)(v)). This means when L&I or self-insurer requests you send the personal health information of a patient being treated under a workers' compensation or crime victims' compensation claim, you must send everything that is requested.

This includes requests made by the L&I or self-insurer for personal health information that may not appear related to your patient's claim.

In some circumstances, L&I or self-insurer may temporarily cover treatment for a condition that is unrelated to an injury when it is retarding your patient's recovery from that injury. L&I or self-insurer may also request what appears to be unrelated medical information in order to evaluate medical history if your patient contends a new condition is related to or has been aggravated by the industrial injury.

RCWs 51.36.060 and 7.68.145 both permit and require L&I or self-insurer to determine what personal health information may be relevant to a claim. If we request records from you that appear unrelated to your patient's claim, it is because we need those records to determine your patient's right to benefits.

WISHA examinations do not require a patient authorization

HIPAA allows you to disclose personal health information to an employer without an authorization from your patient if the personal health information disclosed deals with a work-related injury or illness, workplace-related medical surveillance, or a return-to-work examination (45 CFR § 164.512 (b)(v)(A)(B)). Employers are required to maintain these medical records to satisfy their obligations for workplace safety under WISHA and OSHA.

Your privacy notice should address disclosure to Labor and Industries

If you are subject to HIPAA, HIPAA requires that you develop a privacy notice for your patients (CFR 45 § 164.520). The notice must advise your patients of your legal duties under HIPAA, as well as how you may use and disclose their personal health information. We recommend that you include in your privacy notice these specific exemptions:

• You are required by Washington State Law to disclose personal health information to the L&I or a self-insured employer when they are treated under a workers' compensation claim.
• You can disclose personal health information to an employer without an authorization from your patient if that information is about a workplace injury or illness, light duty work, workplace medical surveillance, or a return-to-work examination.
• You are required by Washington State Law to disclose personal health information to the L&I if they are treated under a crime victims' compensation claim.
• Your patients cannot object to or request that you restrict disclosures of their personal health information to L&I or self-insurer because it is required by law (45 CFR § 164.512,164.522(a)(1)(v)).

Read L&I's privacy notice (190 KB PDF).

External HIPAA links

• Centers for Medicare and Medicaid Services - Directory of CMS's HIPAA-related business activities.
• Office of Civil Rights - Resources for understanding and asking questions about HIPAA.
• Workgroup for Electronic Data Interchange (WEDI) - WEDI focuses on electronic commerce within healthcare.
• The American Medical Association (AMA) - The AMA's HIPAA page.
• New Hampshire and Vermont Strategic HIPAA Implementation Plan (NVSHIP) - A regional affiliate of WEDI. Find examples of privacy policies and notices with other compliance tools.
• Phoenix Health Systems - Articles, white papers and products relating to HIPAA compliance.
• Collection of links to other HIPAA resources.

Back to Top