Can a clinic refuse to send medical records to a workers comp adjuster without an authorization?

HIPAA does not let a clinic refuse workers’ compensation records to the carrier just because there is no signed authorization. 45 CFR 164.512(l) permits that disclosure without one, to the extent state workers’ compensation law requires or authorizes it. Attach the medical release already on the claim. Rules vary.

This is for the claims assistant, case coordinator or medical-only examiner at a regional TPA, self-insured desk or carrier unit who works files in Guidewire, Origami Risk, mySedgwick, Juris or a spreadsheet of outstanding items.

A workers’ compensation medical-records request is a request to the clinic or hospital HIM desk for the chart that matches the body part and date of injury. The adjuster uses it to pay, deny, or build an IME or QME packet. Work status is a treating-doctor form; send that to the clinic, not HIM. See how to get a work status report from the treating doctor.

What HIPAA actually says

HIPAA still applies to the clinic. It does not apply to the workers’ compensation carrier, the state agency, or the employer, except to the extent those entities are otherwise covered. HHS’s workers’ compensation guidance (last reviewed July 26, 2013, read 2026-10-10) is the federal page for this split.

Path	What it does
45 CFR 164.512(l) (eCFR as of 2026-10-07, read 2026-10-10)	Lets a covered provider disclose protected health information as authorized by, and to the extent necessary to comply with, workers’ compensation law, without an authorization. The state’s furnish rule is what requires the chart.
45 CFR 164.512(a)	Lets the provider disclose what another law requires, limited to that law.
Payment, 45 CFR 164.502(a)(1)(ii)	Lets the provider send what it needs to get paid for the work-injury care.
A signed 45 CFR 164.508 authorization	Covers records the state’s workers’ compensation law does not already authorize, including a previous condition not directly related to the claim (HHS FAQ, reviewed August 3, 2026, read 2026-10-10).

The minimum necessary standard applies to 164.512(l). HHS says it lets the clinic disclose to the full extent authorized by state law, and does not apply when the disclosure is required by law (FAQ, reviewed January 9, 2023, read 2026-10-10). An injured worker cannot use a 45 CFR 164.522 restriction to block a disclosure required by law or authorized by, and necessary to comply with, workers’ compensation law (FAQ, reviewed January 9, 2023, read 2026-10-10).

On r/WorkersComp in April 2025 a commenter wrote that work-comp injuries are already exempt from HIPAA. That overstates it. HIPAA still governs the clinic. 164.512(l) is a permitted disclosure.

What to put in the request

HIM will bounce an incomplete packet even when 164.512(l) already permits the disclosure. Send a complete request to the HIM fax or portal on the claim.

Item	Why it is on the request
Claim number, injured worker name, date of injury, body part	Match to the right chart
Date range of records sought	A lifetime “any and all” request is what HIM treats as overbroad
The medical release already on the claim	Clinics still often want it as policy, even where 164.512(l) allows disclosure without one
A line naming 164.512(l) and the state’s furnish rule	So the privacy officer can approve the release without inventing a HIPAA bar
Return fax or portal, assistant name, callback, diary date	So the chart lands on this file
On a Texas file, that the request is for records of treatment or hospitalization for which compensation is being sought	Texas Labor Code §408.025(d) uses that phrasing

Send it on the HIM channel. Do not autodial the injured worker’s cell for this packet. Do not fax the chart to the plant when the outstanding item is records for the carrier.

What HIM is actually refusing

A “need a HIPAA form” diary is often a policy bounce, not a legal bar.

What HIM said	What it usually is	First move
“We need a signed HIPAA authorization”	Policy. 164.512(l) already permits the work-injury disclosure	Resend with the release already on the claim, plus 164.512(l) and the state’s furnish rule
“We only accept our form”	Their ROI template	Fill their form. Attach the same release. Stay on that HIM desk
Silence after one fax to the treating clinic	Wrong desk	Work status goes to the treating clinic. The chart goes to HIM
“We do not have those dates”	Incomplete, or another facility holds them	Ask which facility holds them. Log the gap. Keep the row open
Refusal of psychotherapy notes	Real bar unless a 164.508(a)(2) authorization or a required-by-law path applies	Pull the work-injury records on their own diary
Blanket “any and all” from birth	Overbroad. HHS treats unrelated prior conditions as a 164.508 issue	Recut the request to the body part and date of injury

45 CFR 164.508(a)(2) (read 2026-10-10) requires an authorization for psychotherapy notes. 164.512(l) is not on the listed exceptions. A disclosure required by law under 164.512(a) can still apply.

State furnish rules we read

Only states whose statute or rule we read. Other states differ. Check the state’s division and counsel. This is not legal advice.

Place	Furnish rule	Authorization
Texas	§408.025(d) (read 2026-10-10): on request of the injured employee, the employee’s attorney, or the insurance carrier, a health care provider shall furnish records relating to treatment or hospitalization for which compensation is being sought. Extra bill documentation: 15 days under 28 TAC §133.20(h) (read 2026-10-10).	The same subsection lets the provider disclose diagnosis or treatment records to the carrier without authorization, to determine payment or entitlement.
Florida	§440.13(4)(c) (2026 Florida Statutes, read 2026-10-10): on the carrier’s request, records relevant to the workplace injury must be furnished. Willful refusal after a reasonable request is a penalty under paragraph (8)(b).	Release does not require the injured employee’s authorization. Out-of-state providers need a signed authorization. Subject to s. 381.004.
California	8 CCR §9785(c), (f)(7) (read 2026-10-10): the primary treating physician reports to the claims administrator, including additional information reasonably requested to administer the claim. Civil Code §56.10(c)(2) (read 2026-10-10) lets a provider disclose to an insurer to determine payment.	Do not send the chart to the employer. Labor Code §3762 (read 2026-10-10) limits what the insurer or TPA may tell the employer to diagnosis and treatment of the claimed condition, and information needed to modify work duties.

Florida’s out-of-state exception is the one row where a missing authorization is a real bar. Log it. Get the signed form for that facility. Keep the in-state HIM request moving.

When HIM still will not send

Keep the outstanding item open. A policy bounce is not a closed row.

1. Pull the outstanding medical-records row from Guidewire, Origami Risk, mySedgwick, Juris or the spreadsheet. Confirm a complete first request already went to HIM, not the treating-clinic fax.
2. Resend the same packet to the same HIM desk, with the medical release already on the claim, 164.512(l), and the state’s furnish rule. Log the sent date, number, and who took it.
3. If nothing is back in three business days, call that HIM desk. Ask for the supervisor by name, then the privacy officer.
4. If they will only take their own ROI, complete that form from the release already on the file. Do not wait on a new signature for work-injury records the state already authorizes.
5. Recut any “any and all” request to the body part and date of injury. Leave psychotherapy notes on their own diary with a 164.508 authorization if the file needs them.
6. When the compensability or medical-legal clock is inside 14 days, escalate inside the TPA, then to counsel. On a Florida file, put §440.13(4)(c) in the resend.

The employer usually gets work status and restrictions, not the chart. On r/WorkersComp in February 2026 a TPA adjuster wrote that they cannot give the employer medical information other than work status and restrictions. Do not close the row by faxing the chart to the employer.

Pull the open files with a medical-records row still outstanding and a clock in the next 14 days. Confirm each has a complete request already sent to HIM, with the claim number, date of injury, body part, the medical release already on the claim, and a return fax. Resend any packet that went only to the treating-clinic fax, recut any lifetime “any and all” request, and log the sent date that afternoon.