HIPAA FAQs

Q: What is the simplest procedure to use when you need to get somebody's records copied?
A: Use an Authorization (release) signed by the patient.

Q: Does HIPPA apply to proceedings in Workers Compensation in California?
A: HIPAA does not apply to Workers' Compensation. Disclosure of Health Information in
California, HIPAA and California Regulations page 17, which cites HIPAA 45 CFR §164.512(l). 
[That section little “L” on page 29 of the statute.]

Q: Does the ordering attorney's name, address and telephone number need to appear on the Subpoena or Authorization?
A: Only the Attorney's name need appear, NOT the address or telephone number.
45 CFR 164.508(c)(1)(iii)

Q: How do I know if the signed Authorization to release records is HIPAA compliant?
A: Use Med-Legal's checklist by clicking here.

Q: How do I know if a Subpoena used to get records is HIPAA compliant?
A: Use Med-Legal's Subpoena checklist by clicking here.

Q: HIPAA requires a "Notice" be served on the individual whenever a Subpoena is used and
signed by an attorney rather than a Judge. Does the Notice To Consumer, as described in
CCP 1985.3 satisfy this requirement?
A: Yes. All of the requirements of the HIPAA Notice overlap the same requirements of a
Notice To Consumer. Med-Legal recommends that a Notice to Consumer be attached to ALL
Subpoenas now, regardless of whether a Judge signed them or not.

Q: Can the 'Notice' be served upon the patient's attorney in a WC or Civil case as opposed
to the patient personally?
A: Yes, the Notice To Consumer (which equates to the HIPAA Notice when Subpoenas are
used) can be served to the individual’s attorney of record and not the individual in accord
with CCP 1985.3(b)(1). HIPAA doesn’t seem to require more. 45 CFR 164.512(e)(1)(ii)(A)
says, “…that reasonable efforts have been made by such party to ensure that the individual
who is the subject of the protected health information that has been requested has been given
notice of the request; …” HIPAA doesn’t say that there must be personal service on the
individual.

Q: HIPAA requires that the consumer be given Notice that their records are being sought,
and given "reasonable" time to object. What is "reasonable time"?
A: HIPAA doesn’t say what a reasonable time is. It's too early to tell what this will end up being.

Q: Must a copy service serving a SDT or Authorization on a medical facility sign a Business
Associate contract with the medical facility?
A: No. A Business Associate contract is used when the medical facility contracts with a copy
service to perform services for them. Under HIPAA regulation CFR 164.502 it lists various
scenarios and what is needed for each. SDTs and Auths fall under subsection (a) -
standard disclosure. BA Contracts fall under subsection (e). See our letter (Acrobat
document) for more details.

Q: The HIPAA text states that records created for the purposes of a workers compensation
evaluation or report are exempt from the requirements. Does that mean that any records from
any doctor are exempt from HIPAA rules once the Work Comp case is filed?
A: No. Only records created for the specific purpose of an evaluation during the WC case are
excluded. Records that were created before the WC case, such as the applicant's complete
medical background still fall under the HIPAA rules. And being excluded from HIPAA rules
doesn't really matter because no doctor is going to release ANY records without some sort
of signed Authorization or Subpoena. If you are going to use an Auth it really should be
HIPAA compliant.

< Back to HIPAA Regulations