Frequently asked questions --
Health Insurance Portability and Accountability Act (HIPAA)

The following questions and answers address regulations called Standards For Privacy of Individually Identifiable Health Information (the privacy rule), issued by the federal Department of Health and Human Services to implement the Health Insurance Portability and Accountability Act (HIPAA). The effective date for the privacy rule is April 14, 2003. There are links at the end of this page to additional resources, including the actual regulations and guidance materials developed by the Department of Health and Human Services, Office of Civil Rights.

Disclaimer: This series of questions and answers relates only to the impact of the Health Insurance Portability and Accountability Act (HIPAA) regulations on the Minnesota workers' compensation system. This document is a reference tool only and should not be construed as offering or providing legal advice. While the Department of Labor and Industry has made a good-faith effort to provide accurate and useful information, it makes no representation and accepts no liability for any reliance on the completeness or accuracy of this information. This information is not intended to take the place of either the written law or regulations. Readers are encouraged to read the referenced HIPAA rules and the Minnesota workers' compensation statutes and rules because this document contains only a summary of the relevant provisions. A link to the HIPAA Privacy Rule and other resources is provided at the end of this document.

Frequently asked questions -- Health Insurance Portability and Accountability Act (HIPAA)

1. What is HIPAA and why is it relevant to workers' compensation?

2. Who must comply with the HIPAA privacy standards?

3. What is "protected health information" under HIPAA?

4. What limits does HIPAA place on disclosure of PHI by covered entities?

5. Under the HIPAA exceptions, what disclosures are permitted or required by Minnesota law without an injured workers' authorization?
A health care provider may disclose PHI without employee authorization to the employee, the employer or the workers' compensation payer who are parties to a Minnesota workers' compensation claim under M.S. Ch. 176, or to the Department of Labor and Industry, in the following circumstances:

Health care providers must provide existing written medical data related to a current claim for workers' compensation, under the Minnesota workers' compensation law, within seven days of a request from the employer, insurer, employee or DLI. [M.S. 176.138(a)]

Health care providers must provide reports of injuries and supplementary reports to DLI as required under M.S. 176.231.

Health care providers are permitted to release in writing, by telephone discussion or otherwise, medical data related to a current claim for Minnesota workers' compensation to the employee, employer or insurer who are parties to the claim, or to the Department of Labor and Industry, without prior approval of any party to the claim.[4] [M.S. 176.138 (a)]

Health care providers must complete and submit the information on a Health Care Provider Report form and a Report of Work Ability form within 10 days of a request from the employer, insurer, employee or DLI. [M.S. 176.231 and Minn. Rules part 5221.0410]

Health care providers must respond within 10 calendar-days to a request by the employee, employer or insurer regarding whether the physical requirements of a proposed job are within the employee’s restrictions. [M.S. 176.231 and Minn. Rules, part 5221.0420][5]

Health care providers, except hospitals, must supply payers, along with the bill, an "appropriate record that adequately documents the service and substantiates the nature and necessity of the service or charge. Hospitals must submit an appropriate record upon request by the payer." [M.S. 176.135 and Minn. Rules, part 5221.0700]

Note: The above provisions apply only to claims governed by the Minnesota workers' compensation law. They do not apply to or authorize release of medical records for claims under any other state or federal workers' compensation laws. Read Release of workers' compensation medical records under Minnesota and federal workers' compensation programs (PDF) for more information about release of records under other laws.

6. When is an authorization required to disclose PHI for workers' compensation purposes?

7. When an authorization is required, what must it include?

8. What other HIPAA or Minnesota requirements might affect the workers' compensation system?

Frequently asked questions -- Health Insurance Portability and Accountability Act (HIPAA)
1.	What is HIPAA and why is it relevant to workers' compensation?
2.	Who must comply with the HIPAA privacy standards?
3.	What is "protected health information" under HIPAA?
4.	What limits does HIPAA place on disclosure of PHI by covered entities?
5.	Under the HIPAA exceptions, what disclosures are permitted or required by Minnesota law without an injured workers' authorization? A health care provider may disclose PHI without employee authorization to the employee, the employer or the workers' compensation payer who are parties to a Minnesota workers' compensation claim under M.S. Ch. 176, or to the Department of Labor and Industry, in the following circumstances: Health care providers must provide existing written medical data related to a current claim for workers' compensation, under the Minnesota workers' compensation law, within seven days of a request from the employer, insurer, employee or DLI. [M.S. 176.138(a)] Health care providers must provide reports of injuries and supplementary reports to DLI as required under M.S. 176.231. Health care providers are permitted to release in writing, by telephone discussion or otherwise, medical data related to a current claim for Minnesota workers' compensation to the employee, employer or insurer who are parties to the claim, or to the Department of Labor and Industry, without prior approval of any party to the claim.[4] [M.S. 176.138 (a)] Health care providers must complete and submit the information on a Health Care Provider Report form and a Report of Work Ability form within 10 days of a request from the employer, insurer, employee or DLI. [M.S. 176.231 and Minn. Rules part 5221.0410] Health care providers must respond within 10 calendar-days to a request by the employee, employer or insurer regarding whether the physical requirements of a proposed job are within the employee’s restrictions. [M.S. 176.231 and Minn. Rules, part 5221.0420][5] Health care providers, except hospitals, must supply payers, along with the bill, an "appropriate record that adequately documents the service and substantiates the nature and necessity of the service or charge. Hospitals must submit an appropriate record upon request by the payer." [M.S. 176.135 and Minn. Rules, part 5221.0700] Note: The above provisions apply only to claims governed by the Minnesota workers' compensation law. They do not apply to or authorize release of medical records for claims under any other state or federal workers' compensation laws. Read Release of workers' compensation medical records under Minnesota and federal workers' compensation programs (PDF) for more information about release of records under other laws.
6.	When is an authorization required to disclose PHI for workers' compensation purposes?
7.	When an authorization is required, what must it include?
8.	What other HIPAA or Minnesota requirements might affect the workers' compensation system?