Does HIPAA prohibit companies from obtaining medical information directly from a doctor treating a recipient of workers’ comp benefits?
Georgia’s Supreme Court has weighed in on the matter.
Laura McRae, an Arby’s employee, suffered third-degree burns to her esophagus after mistakenly drinking lye left in a break room cup.
She received workers’ comp benefits and signed a form authorizing release of her medical information.
Her doctor issued a report that McRae had reached maximum medical improvement and sustained a 65% permanent partial disability impairment.
After receiving the report, lawyers for Arby’s requested a conference with her doctor, but the doctor refused to meet without McRae or her attorney present.
Arby’s sought one of two things:
- that McRae’s request for a hearing in her case to be dismissed, or
- that her doctor be ordered to meet with a representative of Arby’s.
The state workers’ comp board ordered McRae to sign a medical release authorizing her doctor to meet privately with a representative of Arby’s.
McRae refused to sign, but the order was upheld by the appellate division of the workers’ comp board and by a state court.
However, the Georgia Court of Appeals reversed the order, holding that Georgia law didn’t require the doctor to meet privately with the employer or its representatives.
That’s when the case went to the Georgia Supreme Court.
Federal vs. state laws
The state’s highest court said Georgia law clearly waives any protection of an employee’s medical records once the worker submits a claim for comp benefits, receives income benefits or the employer has paid any medical expenses.
The Court of Appeals’ ruling had distinguished between medical records and medical information, for example, anything communicated in a face-to-face meeting. It said medical records had to be turned over, but a private meeting between a doctor and employer wasn’t required.
The state supreme court disagreed. It noted the law doesn’t specify how medical information is to be communicated — it doesn’t distinguish between records and verbal communication, for example.
But what about patient privacy required by HIPAA? “HIPAA’s privacy provisions do not preempt Georgia law … because HIPAA exempts from its requirements disclosures made in accordance with state workers’ compensation laws,” the court noted.
However, the court added this word of caution: “We urge the parties when requesting such communications, and the board when authorizing them, to set parameters consistent with privacy protections afforded under state and federal law.” Specifically, the medical information conveyed must pertain to the workers’ comp claim.
For those reasons, the Georgia Supreme Court ruled the workers’ comp board acted properly by ordering McRae to sign a limited medical release or have her case removed from the hearing calendar.
What should the balance be between patient medical privacy and information provided to an employer in a workers’ comp case? Let us know what you think in the comments below.
(Arby’s Restaurant Group v. McRae, GA Supreme Court, 11/5/12) (PDF of decision)