Does the HIPAA Privacy Rule allow us to disclose an injured or ill
worker's protected health information (PHI) without his or her
authorization when requested for purposes of adjudicating the
individual's workers' compensation claim?
Yes, UCMC may disclose a patient's protected health information (PHI)
without first obtaining the patient's written authorization for workers
compensation purposes as authorized by, and to the extent necessary to
comply with workers compensation laws. Specifically, UCMC can
- When it is necessary to comply with workers' compensation or
similar programs established by law that provide benefits for
work-related injuries or illness without regard to fault.
- To the extent the disclosure is required by State or other
law. The disclosure must comply with and be limited to what the
- For purposes of obtaining payment for any health care provided to
the injured or ill worker.
However, UCMC shall limit the amount of PHI disclosed for workers'
compensation purposes to the minimum necessary to accomplish the workers' compensation purpose
means UCMC should only disclose only PHI related to the care and
services associated with the workers compensation matter.
Likewise, UCMC shall limit the amount of PHI disclosed for payment
purposes related to a workers' compensation claim to the minimum
necessary. UCMC will disclose the amount and types of PHI that
necessary to obtain payment for health care provided to an injured or
Upon receiving a request for PHI involving a workers' compensation
claim (e.g. subpoena, attorney letter), the request should be forwarded
to the Site Manager in Health Information Management (HIM) for review
and processing. Only the Site Manager in HIM will process
requests related to workers' compensation.
Back to Guidances