You may rely on the requester’s judgement about what is minimum necessary. Unless the requester is a private insurer, which it usually is.

The RealityNo authorization needed is not the same as send what they asked for.

⚠️

The Problem

One rule applied to four different kinds of request.

Workers compensation, personal injury, employer enquiry and substance use disorder records each run on a different provision, and a single release queue treats them identically.

🔧

The Solution

Make the request type a field, and gate release on what that type needs.

A record cannot leave until the system holds the specific thing that authorises it — the applicable law, the assurances, the authorisation or the court order.

✅

The Resolution

The file shows why each release was lawful at the time it happened.

Reconstructing that eighteen months later, from a queue that recorded only that something was sent, is not a position anyone wants to be in.

HIPAA workers compensation disclosure: what the provision actually says

The operative text is narrower than its reputation. A covered entity may disclose protected health information as authorized by and to the extent necessary to comply with laws relating to workers compensation or other similar programs, established by law, that provide benefits for work-related injuries or illness without regard to fault.

Three limits sit inside that one sentence. It is a permission, not a mandate — may disclose. It is derivative: the disclosure must be authorised by a workers compensation law, so the provision does nothing on its own if no such law reaches the request. And it carries its own scope ceiling in the words to the extent necessary.

The regulator describes three routes to disclosure without authorisation. The workers compensation provision itself; the required-by-law route, where the disclosure must comply with and be limited to what the law requires; and payment, for obtaining payment for health care provided to the injured worker. Different routes, different constraints, and a request can sit on more than one.

Minimum necessary reliance, and the trap inside it

The regulator is explicit that minimum necessary applies here: covered entities are required reasonably to limit the amount of protected health information disclosed under the workers compensation provision to the minimum necessary to accomplish the workers compensation purpose.

It then describes a reliance shortcut, and the shortcut is where practices overreach. The rule permits reliance on a requested disclosure being the minimum necessary when making disclosures to public officials that are permitted under the relevant section, if the public official represents that the information requested is the minimum necessary for the stated purposes.

Public officials. The regulator’s own sentence says the official’s representations, not the requester’s. The other reliance grounds in the same provision cover another covered entity, a member of the workforce or a business associate, and certain research requests. None of them reaches a private carrier or a third-party administrator.

The practical consequence is a build requirement. The release workflow needs to know whether the requester is a public official, because the answer changes whether a human has to scope the release.

Personal injury subpoena response is a different rule entirely

The workers compensation provision is unavailable for a third-party liability claim, and the reason is textual. The provision requires a program that provides benefits without regard to fault. A personal injury claim is fault-based. The predicate is simply absent.

So a request from an accident attorney runs on patient authorisation or on the judicial-proceedings provision. That provision permits disclosure in response to a subpoena, discovery request or other lawful process that is not accompanied by an order — but only on satisfactory assurances, of which there are two alternative kinds.

Either the requesting party has made reasonable efforts to ensure the individual has been given notice of the request, or it has made reasonable efforts to secure a qualified protective order. A qualified protective order has defined content: it prohibits using or disclosing the information for any purpose other than the litigation, and requires return or destruction of the information including all copies at the end of the proceeding.

A bare subpoena is therefore not sufficient authority. The system has to record which of three things arrived — a court order, a satisfactory assurances package, or a patient authorisation — and hold the release until one of them is on file.

Substance use disorder records override all of it

If the practice treats substance use disorder and its records fall under the federal confidentiality rule for those records, the whole analysis changes. That rule was amended with a compliance date of 16 February 2026, so it is now fully in force, and any guidance written before that date describes a regime that no longer applies.

The rule is categorical about process. Its restrictions on use and disclosure apply whether or not the requester has obtained a subpoena or asserts any other justification that is not permitted. So the satisfactory-assurances route that works for ordinary records does not work here.

For a non-criminal proceeding, the route is a court order under the rule’s own procedure, which may be entered only if the court determines that good cause exists — tested against whether other ways of obtaining the information are unavailable or ineffective, and whether the public interest and need outweigh the potential injury to the patient, the physician-patient relationship and treatment.

The exposure here is specific and avoidable: a practice with a mixed population running every workers compensation request through one queue will eventually release a protected record on a subpoena that cannot authorise it. Practices doing addiction treatment EHR and IT work usually segregate these already.

New Jersey medical records fee caps, and the figure people still quote wrong

New Jersey’s workers compensation rules run on party exchange rather than on the federal permission. The employer is required to furnish or make available for inspection and copying all records of medical treatment, and the respondent has the same right where the worker is treated by their own physician. There is a thirty-day clock: a party that fails to furnish the information within thirty days of receiving a demand may be responsible for its adversary’s cost of procuring it.

The rules also allow a petitioner to furnish executed authorisations for records in lieu of producing the records themselves, with copies of anything so obtained furnished to the petitioner within ten days of receipt. Worth reading that carefully: the rule permits authorisations as a substitute for production. It does not require an authorisation for release, and describing it as though it does overstates what the rule says.

One caveat the chart cannot carry: all three figures are framed around requests from the patient or the patient’s representative. Whether they bind a carrier’s or a defence attorney’s request is not something the statute settles, and it is worth asking counsel rather than assuming either way. The practical risk of guessing runs in both directions. A practice that applies the cap to every requester may be leaving recoverable cost on the table across hundreds of files a year. A practice that applies it to none may be overcharging the people the statute was written to protect, which is the more expensive mistake because it is the one that generates a complaint.

Disclosure to the employer is the narrowest gate of all

The regulator’s plain-language position is that the Privacy Rule does not apply to employment records, and that a provider cannot give an employer health information without authorisation unless other laws require it. There is one narrow exception, and it is narrower than its usual reading. It is also the request type most likely to arrive informally — by phone, from someone who knows the patient, asking a question that sounds administrative.

It applies where the provider furnished care at the employer’s request to conduct medical surveillance or to evaluate a work-related injury; where the information disclosed consists of findings concerning a work-related illness or injury or workplace-related medical surveillance; where the employer needs those findings to comply with occupational safety recordkeeping obligations; and where written notice is given to the individual at the time of care or posted at the worksite.

Findings only, for an employer-commissioned evaluation, tied to a recordkeeping duty, with notice. Routine pre-employment physicals and fitness-for-duty examinations generally fall outside it and need an authorisation. Getting that gate into the release queue is HIPAA compliance work rather than legal work, and it sits alongside the rest of our EHR solutions.

Releasing records for injury claims: common questions