Disclosing protected health information (PHI) regarding worker's compensation cases and patients that have passed away can both be very complex topics - with many regulations to follow. A recent MediCopy University training session pointed out some very important points involving releasing these records.
Disclosure of Medical Information for Deceased Individuals
The HIPAA Privacy Rule protects the identifiable health information of a decedent for 50 years following the date of death of the individual. During the 50 year period of protection, the personal representative of the decedent has the ability to exercise the right under the Privacy Rule with regard to the decedent's health information, such as authorizing certain uses and disclosures of or gaining access to the information.
A personal representative or legal estate executor of a person is typically determined in a will before the patient's passing. If the patient passes without naming a personal representative or executor, state law will determine who, by default, possesses the right. States often establish a hierarchy of persons based on their relationship to the deceased person. Typically, this begins with an adult member of the deceased person's family: spouse, child or sibling. The person named as agent, or attorney, has the right to examine the patient's medical records and to consent to their disclosure unless the patient limits this right.
With respect to family members or other persons involved in the individual's health care or payment for care prior to the individual's death (but who are not personal representatives), the Privacy Rule permits a covered entity to disclose the relevant protected health information of the decedent to such persons.
Disclosure for Worker's Compensation Purposes
If a patient is injured on the job, they will most likely file a worker's compensation claim with their insurance company. The insurance company will then request medical information from the healthcare facility in which the patient (worker) was treated for the injuries. While there are many different rules regarding workers' compensation claim in each state, the majority agree on one provision: they do not require a signed authorization form as long as the medical information being requested is limited to the treatment date for the work injury only.
A patient is required to sign a medical waiver and consent form (called a C-31 form in Tennessee) when they first file a workers' compensation claim. If the carrier/employer is needing records prior to the injury or records not pertaining to the injury, a signed authorization is required with the request. Furthermore, covered entities are required reasonably to limit the amount of protected health information disclosed to the minimum necessary to accomplish the workers' compensation purpose.