What is the simplest procedure to use when you need to get somebody's
Use an Authorization (release) signed by the patient.
Does HIPPA apply to proceedings in Workers Compensation in California?
HIPAA does not apply to Workers' Compensation. Disclosure of Health
California, HIPAA and California Regulations page 17, which cites
HIPAA 45 CFR §164.512(l).
[That section little “L” on page 29 of the statute.]
Does the ordering attorney's name, address and telephone number
need to appear on the Subpoena or Authorization?
Only the Attorney's name need appear, NOT the address or telephone
45 CFR 164.508(c)(1)(iii)
How do I know if the signed Authorization to release records is
Use DefensePro's checklist by clicking here.
How do I know if a Subpoena used to get records is HIPAA compliant?
Use DefensePro's Subpoena checklist by clicking here.
HIPAA requires a "Notice" be served on the individual
whenever a Subpoena is used and
signed by an attorney rather than a Judge. Does the Notice To Consumer,
as described in
CCP 1985.3 satisfy this requirement?
Yes. All of the requirements of the HIPAA Notice overlap the same
requirements of a
Notice To Consumer. DefensePro recommends that a Notice to Consumer
be attached to ALL
Subpoenas now, regardless of whether a Judge signed them or not.
Can the 'Notice' be served upon the patient's attorney in a WC or
Civil case as opposed
to the patient personally?
Yes, the Notice To Consumer (which equates to the HIPAA Notice when
used) can be served to the individual’s attorney of record
and not the individual in accord
with CCP 1985.3(b)(1). HIPAA doesn’t seem to require more.
45 CFR 164.512(e)(1)(ii)(A)
says, “…that reasonable efforts have been made by such
party to ensure that the individual
who is the subject of the protected health information that has
been requested has been given
notice of the request; …” HIPAA doesn’t say that
there must be personal service on the
HIPAA requires that the consumer be given Notice that their records
are being sought,
and given "reasonable" time to object. What is "reasonable
HIPAA doesn’t say what a reasonable time is. It's too early
to tell what this will end up being.
Must a copy service serving a SDT or Authorization on a medical
facility sign a Business
Associate contract with the medical facility?
No. A Business Associate contract is used when the medical facility
contracts with a copy
service to perform services for them. Under HIPAA regulation CFR
164.502 it lists various
scenarios and what is needed for each. SDTs and Auths fall under
subsection (a) -
standard disclosure. BA Contracts fall under subsection (e). See
our letter (Acrobat
document) for more details.
The HIPAA text states that records created for the purposes of a
evaluation or report are exempt from the requirements. Does that
mean that any records from
any doctor are exempt from HIPAA rules once the Work Comp case is
No. Only records created for the specific purpose of an evaluation
during the WC case are
excluded. Records that were created before the WC case, such as
the applicant's complete
medical background still fall under the HIPAA rules. And being excluded
from HIPAA rules
doesn't really matter because no doctor is going to release ANY
records without some sort
of signed Authorization or Subpoena. If you are going to use an
Auth it really should be
< Back to HIPAA Regulations