HIPAA Compliance Guide for Black Lung and Occupational Respiratory Clinics

Black lung and occupational respiratory clinics often handle sensitive medical information alongside details about a worker’s job, exposures, and ability to work. Whether HIPAA applies depends on the clinic’s role and transactions; what the clinic may disclose depends on the purpose, applicable law, and information requested.

This guide explains how to assess covered entity status, protect protected health information (PHI), and handle employer, workers’ compensation, and occupational medical surveillance disclosures. It is general information, not legal advice; apply the rules to your clinic’s facts and the laws in the relevant state.

Which black lung and occupational respiratory clinics must comply with HIPAA?

A clinic is generally a HIPAA covered entity if it is a health care provider that furnishes health care and electronically transmits health information in connection with a HIPAA-standard transaction, such as a claim or eligibility inquiry. The same may be true when the clinic uses a billing service or other business associate to conduct the transaction on its behalf. Simply using email or electronic medical records does not, by itself, make a provider a covered entity. See HHS guidance on covered entities.

Assess the clinic’s actual operations, not just its name or specialty. A clinic that evaluates miners for possible black lung disease or provides occupational respiratory care may be a covered provider if it meets the transaction test. A clinic may also have HIPAA obligations as a business associate when it handles PHI for a covered entity under a business associate arrangement.

If the clinic does not meet the definition of a covered entity or business associate, HIPAA may not govern its records in that capacity. Other federal and state requirements, contracts, professional duties, or employer-specific rules may still apply.

What health and employment information do clinic records contain?

Clinic records may include symptoms, medical and occupational histories, diagnoses, imaging, pulmonary function and spirometry results, treatment plans, medications, and referrals. They may also contain job titles, work duties, exposure histories, respirator use, and details about the purpose of an examination.

When information identifies a patient and relates to their health or care, it may be PHI in the hands of a HIPAA covered entity. Job or exposure information in a patient’s clinic record does not automatically become an employer’s employment record just because it concerns work.

HIPAA distinguishes a provider’s patient records from employment records held by an employer in its capacity as an employer. The Privacy Rule generally does not protect those employer-held employment records, even when they contain health-related information. See HHS guidance on employers and health information in the workplace.

When may clinics disclose medical information to employers?

A covered clinic generally cannot disclose a patient’s PHI directly to an employer just because the employer requests it, pays for an examination, or arranged a workplace program. The clinic generally needs the patient’s valid authorization unless a specific HIPAA permission or legal requirement applies. HHS explains that when an employer asks a provider directly for a worker’s information, the provider generally cannot disclose it without authorization unless another law requires disclosure. See HHS workplace privacy guidance.

Some occupational rules call for a limited report or written medical opinion to an employer. For example, OSHA’s respiratory protection standard requires a written recommendation about the employee’s ability to use a respirator, relevant use limitations, any need for follow-up evaluation, and confirmation that the employee received a copy. This is not blanket permission to disclose the full examination, diagnoses, or test results. See OSHA’s respiratory protection standard.

Before sending any report, identify the legal basis and the recipient’s role, then limit the content to what the applicable rule permits or requires. A clinic should not assume that a request for “fitness for duty” or an employer’s consent form authorizes release of a complete medical record.

How should clinics handle workers’ compensation and occupational surveillance disclosures?

HIPAA allows a covered entity to disclose PHI for workers’ compensation purposes when the disclosure is authorized by and limited to what is necessary to comply with applicable workers’ compensation or similar laws. A clinic may also disclose information when a state or other law requires it. The precise scope depends on the applicable law and the claim; do not treat every workers’ compensation request as permission to send the entire chart. See HHS guidance on workers’ compensation disclosures.

If the clinic relies on an authorization, verify that it is valid and covers the information, recipient, and purpose. If it relies on a legal permission or requirement, document the legal basis and disclose only within its scope. HHS notes that, for disclosures permitted under the workers’ compensation provision, the clinic must reasonably limit PHI to the minimum necessary for that purpose.

Occupational medical surveillance is not one universal disclosure category. The applicable workplace standard determines what information an employer must receive. For respirator medical evaluations, OSHA specifies the contents of the written recommendation. Other surveillance standards may call for different information, so clinics should follow the particular standard rather than assume every surveillance examination permits a broad disclosure. See OSHA’s respiratory protection standard and OSHA’s medical screening and surveillance requirements guide.

When is patient authorization required for disclosure?

For a covered clinic, a disclosure of PHI to an employer or another recipient generally requires a valid written authorization unless the Privacy Rule or another applicable law permits or requires the disclosure without one. A request from an employer, a workplace program agreement, or a general acknowledgment of privacy practices is not necessarily a valid authorization.

A HIPAA authorization must identify the information to be disclosed, who may disclose it, who may receive it, the purpose, and an expiration date or event. It must also include required statements, such as the individual’s right to revoke it and the potential for redisclosure by the recipient. See HHS guidance on authorizations and 45 CFR § 164.508.

Authorization is not the only possible basis for disclosure. HIPAA has specific permissions for matters such as workers’ compensation, disclosures required by law, and certain public health activities. Each permission has conditions and limits; a clinic should identify the applicable provision rather than treating these exceptions as general employer access. See 45 CFR § 164.512.

How does the minimum necessary rule apply to employer disclosures?

When the minimum necessary standard applies, a covered clinic must take reasonable steps to limit the PHI it uses, discloses, or requests to what is needed for the intended purpose. For a non-routine employer request, the clinic should assess the purpose, the legal basis, and the information needed; a request for an entire chart should not be accepted automatically. See HHS guidance on the minimum necessary requirement.

For example, if a valid occupational rule requires an employer to receive a limited written medical opinion, that does not ordinarily mean the employer also needs unrelated diagnoses, detailed test results, or the complete medical history. Follow the specific rule governing the examination and avoid including information beyond its scope.

The standard has exceptions. It does not apply to disclosures made pursuant to a valid individual authorization or disclosures required by law, among other situations. A disclosure under a workers’ compensation permission, however, must still be reasonably limited to the minimum necessary. See 45 CFR § 164.502 and HHS workers’ compensation guidance.

What state and federal privacy laws may impose additional limits?

HIPAA is not the only rule a clinic may need to consider. State medical privacy and confidentiality laws, workers’ compensation statutes, occupational disease reporting requirements, and the specific federal workplace standard may affect whether a disclosure is permitted, required, or limited. Requirements vary by state and by the type of information and examination.

HIPAA generally sets a federal floor for covered entities. A state law that provides greater privacy protection or rights may apply alongside HIPAA; certain other state laws, including laws requiring disease or injury reporting, may also be excepted from HIPAA preemption. Clinics should check the specific state rule rather than assume that HIPAA either overrides it or answers every disclosure question. See HHS guidance on more stringent state laws and HHS guidance on HIPAA preemption.

In practice, first determine whether the clinic is a covered entity, then identify the purpose and legal basis for each disclosure, check applicable state and occupational rules, and send only the information those rules allow or require. Keep patient records distinct from employer-facing opinions and document the basis for disclosures.

FAQs

Does HIPAA apply to every black lung clinic?

No. A clinic generally qualifies as a HIPAA covered entity if it is a health care provider that conducts a HIPAA-standard transaction electronically, directly or through a business associate. The clinic’s name or specialty alone does not determine its status. Other privacy or confidentiality laws may apply even when HIPAA does not.

Can a clinic disclose a miner’s medical information to an employer without authorization?

Generally, a HIPAA-covered clinic needs the miner’s valid authorization to disclose PHI directly to an employer. An exception may apply when a specific law permits or requires disclosure, including certain workers’ compensation disclosures or a disclosure required by law. The clinic should confirm the legal basis and limit the disclosure to its scope.

What information may an occupational surveillance opinion include?

It depends on the applicable occupational standard and the purpose of the examination. Under OSHA’s respirator medical evaluation rule, the written recommendation is limited to respirator-use limitations, the need for follow-up evaluation, and confirmation that the employee received a copy. Other surveillance rules may have different requirements.

Do state laws affect disclosure of occupational health records?

Yes. State privacy and confidentiality laws, workers’ compensation rules, and reporting requirements may add protections or authorize specific disclosures. HIPAA does not automatically displace every state requirement, so clinics should review the law that applies to the particular patient, record, and request.