HIPAA and Workers’ Compensation: When Privacy Rules Apply to Workplace Injuries

When an employee is injured on the job, their medical information moves through a chain of parties — the treating provider, the employer, the workers’ compensation insurer, and often a state administrative board. Workers’ compensation is one of the few areas where HIPAA explicitly steps aside. The Privacy Rule contains a dedicated provision, 45 CFR § 164.512(l), that permits covered entities to disclose protected health information (PHI) as authorized by and to the extent necessary to comply with workers’ compensation laws — without the patient’s signed authorization. Knowing exactly where that permission begins and ends is what keeps a practice compliant.

The workers’ compensation exception

Under § 164.512(l), a treating provider may release injury-related PHI to an employer, an insurer, or a state workers’ compensation board when state law requires it or when the disclosure is needed to obtain payment for care tied to the claim. This is a true exception: most disclosures to an employer would otherwise require written authorization. The limit is scope. The permission covers information about the work-related condition — not the patient’s entire chart. A back-injury claim does not entitle the carrier to records of an unrelated mental health visit or a past surgery.

Who is covered — and who is not

HIPAA only governs covered entities and their business associates. The physician, clinic, or hospital treating the injured worker is a covered entity and must follow the Privacy and Security Rules. Employers, by contrast, are generally not covered entities when they receive workers’ compensation information in their role as employer, and workers’ compensation carriers are typically excluded from the definition as well. That does not mean the data is unprotected — state confidentiality statutes, the Americans with Disabilities Act, and other laws apply — but the obligations differ from HIPAA’s. The provider remains responsible for safeguarding the records on its side of the exchange.

Minimum necessary still applies

Even though authorization is not required, the minimum necessary standard does apply to most workers’ compensation disclosures. Providers should release only the PHI reasonably needed for the claim and should be able to point to the state statute or the payment purpose that justifies each release. Front-desk and billing staff who field these requests need clear written procedures so they do not over-disclose under time pressure, especially when an adjuster asks for “the whole file.”

Run a Security Risk Analysis on the injury-data workflow

Whatever exceptions apply on the privacy side, the Security Rule does not relax. Every covered entity must conduct a Security Risk Analysis under 45 CFR § 164.308(a)(1)(ii)(A) — an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic PHI. For workers’ compensation, that means mapping how injury records flow to carriers and state boards, where they are faxed or emailed, and who can access them. Unencrypted email to an adjuster and shared fax lines are exactly the kinds of gaps an SRA is designed to surface.

The proposed 2026 Security Rule update

Providers should also watch the Notice of Proposed Rulemaking (NPRM) that the HHS Office for Civil Rights published in December 2024. It proposes significant changes to the HIPAA Security Rule — including mandatory encryption, multi-factor authentication, and regular verification of safeguards. The NPRM is a proposal, not a final rule: it has not been finalized, and once a final rule is published, organizations would have a 240-day compliance window. Building disciplined habits now around how injury records are transmitted will make that eventual transition far smoother.

How Medcurity helps

Medcurity gives healthcare organizations a guided way to complete and document the Security Risk Analysis that HIPAA requires, with workflows that map data flows like workers’ compensation disclosures and track remediation over time. Pricing is $499/year (about $42/month) for a single organization; larger or multi-entity organizations can request a quote. The platform turns the once-a-year scramble into a maintained, audit-ready record. For a broader view of your obligations, see our HIPAA compliance checklist, and review the HIPAA right of access rules that govern how patients themselves can request these same records.

Frequently asked questions

Does HIPAA require patient authorization to release records for a workers’ compensation claim?

Generally no. 45 CFR § 164.512(l) permits a covered provider to disclose injury-related PHI as authorized by state workers’ compensation law or as needed to obtain payment, without the patient’s signed authorization — but only for the work-related condition, and bounded by the minimum necessary standard.

Is my employer a HIPAA covered entity when it handles my injury records?

Usually not. Employers acting in their employer capacity, and most workers’ compensation carriers, fall outside HIPAA’s definition of a covered entity. Other laws still protect that information, but HIPAA’s specific obligations apply to the treating provider, not the employer.

Can a workers’ compensation insurer request a worker’s full medical history?

The HIPAA permission is limited to the work-related condition and is governed by the minimum necessary standard. A carrier is not entitled to records of unrelated conditions simply because a claim exists.

Does the HIPAA Security Rule still apply to workers’ compensation data?

Yes. The privacy exception for workers’ compensation does not relax Security Rule obligations. Electronic injury records must be protected, and that workflow must be included in your Security Risk Analysis.