When case managers from workers’ compensation insurance companies contact Stormont Vail Health in Topeka, Kansas, for patients’ appointment schedules and information about their most recent visit, the employees at the clinics and hospitals are unsure whether to be forthcoming. The case managers often are persistent, and workers’ comp is a form of insurance, so maybe employees can oblige them under HIPAA because it allows covered entities to share protected health information for treatment, payment and operations. But maybe not. What’s the right answer? They’re cautious after all the HIPAA training at Stormont Vail Health, which is why calls have been coming into the HIPAA privacy office.

“Most phone calls start with, ‘I have Betty Lou calling from XYZ Case Management about a workers’ comp patient. She wants to know when the next appointment is scheduled and wants a copy of the last visit. Can we give her this information?’” says HIPAA Privacy Officer Barbara Duncan. “Our pain management clinic is a frequent receiver of these calls. Trying to determine who we can talk to and what information could be shared was a challenge for them. The employees are very hyper about privacy, so they were very in tune to ask questions before responding.”