Does HIPAA apply to workers comp medical records requests?

HIPAA applies to the clinic that holds the chart. It does not apply to the workers’ compensation carrier, the TPA, the state agency, or the employer, except to the extent those entities are otherwise covered. Covered providers may disclose work-injury records without an authorization under 45 CFR 164.512(l).

This is for the claims assistant, case coordinator or medical-only examiner at a regional TPA, self-insured desk or carrier unit who works files in Guidewire, Origami Risk, mySedgwick, Juris or a spreadsheet of outstanding items.

A workers’ compensation medical-records request is a request to the clinic or hospital HIM desk for the chart that matches the body part and date of injury. The adjuster uses it to pay, deny, or build an IME or QME packet. Work status is a treating-doctor form; send that to the clinic, not HIM. See how to get a work status report from the treating doctor.

Who HIPAA actually binds

HIPAA’s Privacy Rule binds covered entities: health plans, health care clearinghouses, and health care providers who transmit health information electronically. 45 CFR 160.103 (read 2026-10-10). A workers’ compensation policy is an excepted benefit under 42 U.S.C. 300gg-91(c)(1)(D) (read 2026-10-10), so a WC-only carrier is not a HIPAA health plan.

HHS’s workers’ compensation guidance (OCR, revised April 3, 2003, last reviewed July 26, 2013, read 2026-10-10) is the federal page for this split: the Privacy Rule does not apply to workers’ compensation insurers, administrative agencies, or employers, except to the extent they may otherwise be covered entities.

Party	HIPAA covered entity for this request?
Treating clinic or hospital HIM	Yes. Covered provider. 164.512(l) permits the work-injury disclosure
Workers’ compensation carrier, WC book only	No. Excepted benefit. Not a health plan under 160.103
TPA administering WC	No, unless it is otherwise a covered entity or a business associate of one
State WC board, L&I, or DWC	No, as the workers’ compensation administrative agency
Employer in its employer role	No. Employment records are excluded from PHI under 160.103
Employer-run on-site clinic	Yes, if that clinic is a covered provider

On r/WorkersComp in April 2025 a commenter wrote that work-comp injuries are already exempt from HIPAA. That overstates it. HIPAA still governs the clinic. 164.512(l) is a permitted disclosure, not a wipe of the Privacy Rule.

What 45 CFR 164.512(l) permits

45 CFR 164.512(l) (eCFR as of 2026-10-07, Title 45 last amended 2026-10-06, read 2026-10-10) lets a covered provider disclose protected health information as authorized by, and to the extent necessary to comply with, workers’ compensation law, without an authorization.

HHS lists three paths that do not need a 164.508 form:

Path	What it does
45 CFR 164.512(l)	Disclosure as authorized by, and to the extent necessary to comply with, workers’ compensation law
45 CFR 164.512(a)	Disclosure required by law, limited to what that law requires
Payment, 45 CFR 164.502(a)(1)(ii)	What the provider needs to get paid for the work-injury care

The minimum necessary standard applies to 164.512(l). HHS says it lets the clinic disclose to the full extent authorized by state law. It does not apply when the disclosure is required by law under 164.512(a), or when the individual has signed a 164.508 authorization. 45 CFR 164.502(b)(2)(v) (read 2026-10-10). A separate path at 45 CFR 164.512(b)(1)(v) lets a provider who evaluated a work-related injury at the employer’s request send those findings to the employer, with written notice. That is not the carrier’s HIM request.

What still needs an authorization

164.512(l) is limited to what workers’ compensation law authorizes. A lifetime “any and all” request is what HIM treats as overbroad.

Request	Path	First move
Work-injury records the state’s furnish rule covers	164.512(l), and 164.512(a) where the statute says “shall”	Send a complete request with the release already on the claim
Bill for the work-injury visit	Payment under 164.502(a)(1)(ii)	That packet is not the chart request
Previous condition not directly related to the claim	45 CFR 164.508 authorization	Recut the request to the body part and date of injury
Psychotherapy notes	164.508(a)(2). 164.512(l) is not a listed exception	Leave them on their own diary
Florida out-of-state provider	State bar, not HIPAA	Get the signed form for that facility
Extra records by subpoena in New York	CPLR 3122 plus a 164.508 form, or a judge’s order	Do not treat a Board filing as a blanket for unrelated history

45 CFR 164.508(a)(2) (read 2026-10-10) requires an authorization for psychotherapy notes except for listed uses. 164.512(l) is not on that list. A disclosure required by law under 164.512(a) can still apply.

The employer is not the carrier

The carrier or TPA needs the chart to administer the claim. The employer needs work status and restrictions to offer modified duty.

California Labor Code §3762 (read 2026-10-10) prohibits an insurer, or a TPA retained by a self-insured employer, from disclosing medical information about the claimant to the employer except diagnosis and treatment of the claimed condition, and information needed to modify work duties. On r/WorkersComp in February 2026 a TPA adjuster wrote that they cannot give the employer medical information other than work status and restrictions. Do not close a records row by faxing the chart to the plant.

State furnish rules we read

Only states whose statute, rule, or agency HIPAA page we read. Rules vary by state. Check the state’s rule and counsel. This is not legal advice.

Place	Furnish rule HIPAA sits on	Authorization
Texas	Labor Code §408.025(d) (read 2026-10-10): on request of the injured employee, the employee’s attorney, or the insurance carrier, a health care provider shall furnish records relating to treatment or hospitalization for which compensation is being sought.	Same subsection: diagnosis or treatment records to the carrier without authorization, to determine payment or entitlement.
Florida	§440.13(4)(c) (2026 Florida Statutes, read 2026-10-10): records relevant to the workplace injury must be furnished on the carrier’s request.	No employee authorization. Out-of-state providers need a signed form. Subject to s. 381.004.
California	The claims administrator gets the treating-physician reports needed to administer the claim. Labor Code §3762 limits what then goes to the employer.	Do not send the chart to the employer.
New York	WCB HIPAA page (read 2026-10-10): the Board, insurers, and employers are not covered entities. Providers file CMS-1500 treatment reports without an authorization.	A subpoena for extra records needs a HIPAA-compliant authorization under CPLR 3122, or a judge’s order.
Washington	L&I HIPAA page (read 2026-10-10): authorizations are not needed for L&I or a self-insurer. L&I treats those requests as required by law.	L&I tells providers to send everything requested. Recut your request to the body part and date of injury first.
Minnesota	DLI HIPAA FAQ (read 2026-10-10): DLI and WC payers are not covered entities unless the payer is covered for other claims. Related records go to the parties under Minn. Stat. 176.138.	Data not directly related to the current injury needs employee authorization.

Florida’s out-of-state exception is the one row where a missing authorization is a real bar. Get the signed form for that facility. Keep the in-state HIM request moving.

When HIM still cites HIPAA

A “need a HIPAA form” diary is often a policy bounce, not a legal bar. Keep the outstanding item open. Resend a complete request to the same HIM desk, with the medical release already on the claim, 164.512(l), and the state’s furnish rule. If they will only take their own ROI, complete that form from the release already on the file. Recut any “any and all” request. Do not autodial the injured worker’s cell for this packet.

The chase steps when HIM still will not send are on can a clinic refuse to send workers comp records without an authorization.

Pull the open files with a medical-records row still outstanding and a clock in the next 14 days. Check whether the last HIM bounce was a missing HIPAA form on work-injury records the state’s furnish rule already covers. Attach the medical release already on the claim, name 164.512(l) and the state’s rule, recut any lifetime request, and resend to HIM that afternoon.