Although the preamble to the federal Health Insurance Portability and Accountability Act (HIPAA) excludes workers’ compensation, many physicians erroneously believe that HIPAA restrictions apply to workers’ compensation cases. For more information, see Medical Information - HIPAA.

California employers have a right to know an injured employee’s diagnosis and treatment plan, as well as medical information necessary to provide modified work duties (i.e., work restrictions from the treating physician).1 The information you can obtain depends largely on the disclosure policy established by the physician, insurer, a self-insured’s risk management department or third-party administrators.

You are obligated to provide the best quality medical care available under the workers’ compensation plan. You are also obligated to return the employee to gainful employment as soon as possible.

Medical information that is related to the injury can be disclosed only if necessary to modify an employee’s workplace.2 To declare an employee temporarily totally disabled, the diagnosis must be disclosed. In addition, you are entitled to know any pending or expected disability restrictions in order to make workplace modifications and/or alternative work decisions. Some health care practitioners may be reluctant to disclose sufficient information for you to make an informed decision.

• To receive medical information that is required to manage claims, ask the injured employee to sign a release form authorizing the treating physician to send the information to your workers’ compensation coordinator. Labor Code section 3762 specifically prohibits claims administrators from disclosing medical information that does not affect an employer’s premium. However, the law doesn’t apply to physicians.

In fact, HIPAA’s workers’ compensation provisions allow protected health information (PHI) to be disclosed if the protected individual specifically authorizes it. The individual’s authorization must contain specific information, including:

• Notice of the individual’s right to revoke the authorization in writing;
• Notice that providers may require authorization before treatment, payment, enrollment or eligibility for benefits; and
• Authorization in plain, ordinary language.3

HIPAA was intentionally designed to ensure that workers’ compensation systems would not be adversely affected by a restriction on PHI. HIPAA’s Privacy Rule allows PHI to be disclosed to workers’ compensation insurers, state administrators and employers to the extent necessary to comply with workers’ compensation laws or similar programs.

Some physicians, particularly those who are not experienced in workers’ compensation matters, can refuse to release records despite a written release from the employee and will insist on a subpoena. If an employee predesignates a physician, you may want to send the physician a letter advising that the physician is required to disclose medical information that is related to workers’ compensation to the claims administrator.

Effective January 1, 2023, personal information about employees and applicants are subject to all California Privacy Rights Act (CPRA) requirements. The law specified that the California Privacy Protection Agency (CPPA) was to have published final regulations by July 1, 2022, with an enforcement date one year later on July 1, 2023. The agency, however, didn't finalize their regulations until March 29, 2023. As such, per a California state court ruling, the agency cannot begin enforcement until March 29, 2024. For more information, see California Privacy Rights Act.

1. Lab. Code sec. 3762(c)(1) and (2)