Author, Jim Malone, Workers’ Compensation Claims Advocate, Rancho Mesa Insurance Services, Inc.

Timely reporting of an employee’s work-related serious injury, illness or death can pose a challenge to the employer. As of January 1, 2020, these incidents (including any hospitalizations, unless the injured worker is admitted for medical observation or diagnostic testing) must be reported immediately to Cal/OSHA. Immediately means as soon as practically possible but not longer than 8 hours after the employer knows or, with diligent inquiry, would have known of the serious injury, illness or death.

Monitoring the employee’s status at a hospital can be difficult if the employer has not put in place procedures and policies that will authorize a healthcare provider to disclose information that is covered by the Health Insurance Portability and Accountability Act (HIPAA). For example, the employer must follow-up with the hospital providing care to the injured employee to determine if the incident must be reported to Cal/OSHA. The employer will need to know if the employee has been moved from the emergency room and admitted to the hospital for in-patient treatment. 

Ensuring policies and procedures are developed and implemented to restrict the use and disclosure of protected health information (PHI), are important elements of HIPAA compliance. If health information is used for purposes not permitted by the HIPAA Privacy Rule, or is deliberately disclosed to individuals not authorized to receive the information, there are possible penalties for the covered entity or individual responsible.

HIPAA permits PHI to be used for healthcare operations, treatment purposes, and in connection with payment for healthcare services. It can be argued that employers need this information to comply with State and Federal OSHA laws. Information may be disclosed to third parties for said purposes, provided an appropriate relationship exists between the disclosing covered entity (i.e., the hospital) and the recipient’s covered entity or business associate (i.e., the employee or employer). A covered entity can only share PHI with another covered entity if the recipient had previously or currently has a treatment relationship with the patient. The PHI has to relate to that relationship. In the case of a disclosure to a business associate, a Business Associate Agreement must have been obtained. Disclosures must be restricted to the minimum necessary information that will allow the recipient to accomplish the intended purpose of use. 

Prior to any use or disclosure of health information that is not expressly permitted by the HIPAA Privacy Rule, one of two steps must be taken:

1. A HIPAA authorization must be obtained from a patient, in writing, permitting the covered entity or business associate to use the data for a specific purpose not otherwise permitted under HIPAA.

2. The health information must be stripped of all information that allows a patient to be identified.

Employers may consider obtaining signed business associate agreements or HIPAA authorizations from their employees before any injury or accident occurs. This will ensure they are able to get the appropriate protected medical information from the hospitals so they can report “serious injury or illness” accurately and timely to Cal/OSHA. 

Therefore, it is extremely important for employers to learn the existing laws and new changes to these laws and have a plan of action in place to address these concerns before the next serious injury, illness, or death occurs.

Currently, reporting to Cal/OSHA can be made by telephone or e-mail. With these reporting changes, Cal/OSHA has also been directed to establish an on-line mechanism for reporting these injuries. It is always important to document when these incidents are reported to Cal/OSHA. Until an online mechanism is established, use of e-mail would be such method for documentation. Monitoring of the Cal/OSHA website for implementation of the on-line mechanism of reporting is also suggested.

For more information on how to report serious injuries and illnesses to Cal/OSHA, please reference “Cal/OSHA Updates: AB 1804 Changes How Injuries and Illnesses Are Reported.”

For more information about what is considered a serious injury or illness under Cal/OSHA, please reference “Cal/OSHA Updates: AB 1805 Changes Definition of Serious Injury or Illness.”