Frequently asked questions --
Health Insurance Portability and Accountability Act (HIPAA)

The following questions and answers address regulations called Standards For Privacy of Individually Identifiable Health Information (the privacy rule), issued by the federal Department of Health and Human Services to implement the Health Insurance Portability and Accountability Act (HIPAA). The effective date for the privacy rule is April 14, 2003. There are links at the end of this page to additional resources, including the actual regulations and guidance materials developed by the Department of Health and Human Services, Office of Civil Rights.

Disclaimer: This series of questions and answers relates only to the impact of the Health Insurance Portability and Accountability Act (HIPAA) regulations on the Minnesota workers' compensation system. This document is a reference tool only and should not be construed as offering or providing legal advice. While the Department of Labor and Industry has made a good-faith effort to provide accurate and useful information, it makes no representation and accepts no liability for any reliance on the completeness or accuracy of this information. This information is not intended to take the place of either the written law or regulations. Readers are encouraged to read the referenced HIPAA rules and the Minnesota workers' compensation statutes and rules because this document contains only a summary of the relevant provisions. A link to the HIPAA Privacy Rule and other resources is provided at the end of this document.

Frequently asked questions -- Health Insurance Portability and Accountability Act (HIPAA)

1. What is HIPAA and why is it relevant to workers' compensation?

2. Who must comply with the HIPAA privacy standards?

3. What is "protected health information" under HIPAA?

4. What limits does HIPAA place on disclosure of PHI by covered entities?

5. Under the HIPAA exceptions, what disclosures are permitted or required by Minnesota law without an injured workers' authorization?

6. When is an authorization required to disclose PHI for workers' compensation purposes?
An authorization to disclose PHI is required in the following circumstances.

Medical data that is not directly related to a current injury or disability under the Minnesota workers' compensation law shall not be released without prior authorization of the employee. [M.S. 176.138 (b)][6]

Workers' compensation medical data may not be released without employee authorization to anyone other than the Department of Labor and Industry or a party to a current claim for compensation under the Minnesota workers' compensation law (the employee, employer or insurer). [M.S. 176.138 (a)]

A qualified rehabilitation consultant (QRC) must obtain written authorization from an employee before communicating with a health care provider about the employee. [Minn. Rules, part 5220.1802, subd. 5] Notwithstanding the workers' compensation exception to the HIPAA requirements, psychotherapy notes[7] may not be disclosed without authorization unless required by law or otherwise authorized by the HIPAA rules. [45 CFR 164.508]

7. When an authorization is required, what must it include?

8. What other HIPAA or Minnesota requirements might affect the workers' compensation system?

Frequently asked questions -- Health Insurance Portability and Accountability Act (HIPAA)
1.	What is HIPAA and why is it relevant to workers' compensation?
2.	Who must comply with the HIPAA privacy standards?
3.	What is "protected health information" under HIPAA?
4.	What limits does HIPAA place on disclosure of PHI by covered entities?
5.	Under the HIPAA exceptions, what disclosures are permitted or required by Minnesota law without an injured workers' authorization?
6.	When is an authorization required to disclose PHI for workers' compensation purposes? An authorization to disclose PHI is required in the following circumstances. Medical data that is not directly related to a current injury or disability under the Minnesota workers' compensation law shall not be released without prior authorization of the employee. [M.S. 176.138 (b)][6] Workers' compensation medical data may not be released without employee authorization to anyone other than the Department of Labor and Industry or a party to a current claim for compensation under the Minnesota workers' compensation law (the employee, employer or insurer). [M.S. 176.138 (a)] A qualified rehabilitation consultant (QRC) must obtain written authorization from an employee before communicating with a health care provider about the employee. [Minn. Rules, part 5220.1802, subd. 5] Notwithstanding the workers' compensation exception to the HIPAA requirements, psychotherapy notes[7] may not be disclosed without authorization unless required by law or otherwise authorized by the HIPAA rules. [45 CFR 164.508]
7.	When an authorization is required, what must it include?
8.	What other HIPAA or Minnesota requirements might affect the workers' compensation system?