HIPAA Compliance Guide for Disability Carrier Medical Review Offices

HIPAA Applicability to Disability Insurers

Covered entity status and excepted benefits

Under the HIPAA Privacy Rule, most disability income products are considered excepted benefits. As a result, disability insurers typically are not HIPAA covered entities. You still routinely handle protected health information (PHI), but HIPAA obligations attach primarily to the providers and health plans disclosing that PHI—not to your carrier—unless you serve as a business associate.

Practical implications for medical review offices

Because you are usually outside HIPAA’s direct scope, providers generally need a HIPAA-compliant authorization from the claimant before sending PHI to your medical review team. Your requests should make that clear, specify the purpose (disability claim evaluation), and define a tight date range to support the minimum necessary standard applied by the disclosing covered entity.

When you might be a business associate

If your organization performs a function for a covered entity that involves PHI—separate from your own claims activities—you may be a business associate for that specific engagement. In that narrow case, a Business Associate Agreement (BAA) and full Privacy Rule safeguards apply to that engagement.

Disclosure of Protected Health Information to Disability Insurers

Permissible pathways

Covered entities commonly disclose PHI to disability insurers based on an individual’s HIPAA-compliant authorization. Disclosures “required by law” may also occur where applicable. Routine payment or health care operations disclosures under HIPAA usually do not cover disability insurers because you do not pay for medical care; you assess work capacity and benefit eligibility.

The minimum necessary standard

When a provider discloses PHI without an authorization under a HIPAA permission, the minimum necessary standard applies. For disclosures made pursuant to a valid authorization, the standard does not apply; however, your request should still be narrowly tailored to what you actually need. Specify records types, providers, and dates to support focused, efficient reviews.

Scope of PHI you should request

Ask for condition-specific records, objective test results, functional capacity assessments, treatment plans, work restrictions, and return-to-work notes. Avoid blanket “all records” requests unless clearly justified by the claim facts. This approach respects the HIPAA Privacy Rule’s intent and accelerates provider cooperation.

HIPAA-Compliant Authorization Requirements

Core elements to include

Your HIPAA-compliant authorization should, in plain language, include the following: a description of the information to be disclosed; the name (or specific identification) of the disclosing provider and your company as recipient; the purpose (disability claim evaluation); an expiration date or event; the individual’s signature and date; statements on the right to revoke; whether you condition benefits on signing (typically yes for claim evaluation); and the potential for re-disclosure by a non-HIPAA entity.

Best-practice drafting tips

• Define a reasonable date range and list specific record categories to honor the minimum necessary standard in practice.
• Provide separate checkboxes for sensitive categories where required by state law (e.g., HIV, genetic information, substance use disorder records).
• State how revocations should be submitted and how already-released records will be handled.
• Use claimant-friendly language and readable formatting to reduce provider pushback and delays.

Psychotherapy notes authorization

A general medical authorization is not sufficient for psychotherapy notes. If such notes are truly necessary, obtain a separate, explicit psychotherapy notes authorization that specifically references “psychotherapy notes authorization” and the originating provider. In most disability reviews, summaries and treatment records—excluding psychotherapy notes—are adequate.

Role of SSA-827 Authorization Form

What the SSA-827 form does

The SSA-827 form authorizes disclosure of records to the Social Security Administration (SSA) for a federal disability determination. It contains the required elements of the HIPAA Privacy Rule and is widely recognized by providers handling Social Security Disability Insurance (SSDI) or SSI evidence requests.

Limits for private disability carriers

The SSA-827 generally authorizes release to SSA and its agents—not to private disability insurers. Do not rely on an SSA-827 as your sole basis to obtain PHI for a private disability claim. Instead, secure your own HIPAA-compliant authorization that explicitly names your company as the recipient.

How to use it effectively

When a claimant has both SSA and private claims, ask the claimant to sign both the SSA-827 and your carrier’s authorization. You can also model your form’s language after the SSA-827’s clarity, while tailoring it to your specific claim needs and retention practices.

Handling of Psychotherapy Notes

Why psychotherapy notes are different

Psychotherapy notes are the clinician’s separate notes documenting or analyzing counseling conversations; they exclude medication lists, session start/stop times, treatment plans, and similar information. The HIPAA Privacy Rule gives these notes heightened protection.

Obtaining psychotherapy notes

You must obtain a separate, note-specific authorization that clearly identifies the notes and the provider. Combining this consent with a general authorization is not acceptable. Request these notes only when essential to adjudicate the claim and after consulting with your legal or compliance team.

Preferred alternatives

In most disability reviews, treatment summaries, diagnoses, functional assessments, and return-to-work recommendations suffice. Ask providers for such materials instead of psychotherapy notes to reduce sensitivity concerns and accelerate turnaround.

Use of Electronic Records Express Platform

What Electronic Records Express is for

Electronic Records Express (ERE) is SSA’s platform for submitting medical evidence directly to SSA. Use ERE only when you or your vendor are transmitting records for an SSA disability determination and the submission is properly linked to the SSA case.

Operational safeguards when using ERE

• Confirm the correct SSA case and identifiers before uploading; do not mix private carrier claim materials into an SSA eFolder.
• Follow SSA file format and indexing guidance; upload only the records authorized for the SSA case.
• Maintain internal logs of what was sent, by whom, and when, and reconcile confirmations.

Private claims need separate secure channels

Do not use ERE for private disability claims. For non-SSA matters, rely on secure portals, encrypted email with approved safeguards, or secure file transfer solutions. Align your processes with your information security program and document each transmission.

HIPAA Compliance Checklist for Disability Claims Administrators

• Determine status: Confirm you are handling an excepted benefits product and are not acting as a covered entity; identify any business associate roles separately.
• Use strong forms: Obtain a HIPAA-compliant authorization that names your company, defines purpose and scope, and includes revocation and re-disclosure statements.
• Target the ask: Request only the records you need, with specific categories and date ranges to support the minimum necessary standard at the provider.
• Respect special protections: Secure a separate psychotherapy notes authorization when truly necessary; otherwise, request summaries or treatment records.
• Secure transmission: For SSA matters, use Electronic Records Express correctly; for private claims, use approved secure channels and keep auditable logs.
• Vendor oversight: Vet retrieval vendors, IME networks, and reviewers; require confidentiality commitments and, where applicable, BAAs.
• Track lifecycle: Record each request, receipt, use, and destruction/retention action; honor revocations promptly and segregate overbroad materials.
• Train and test: Provide role-based training on the HIPAA Privacy Rule, authorizations, and sensitive data handling; test with periodic audits.

Conclusion

By relying on a precise HIPAA-compliant authorization, respecting psychotherapy notes safeguards, using Electronic Records Express only for SSA cases, and operationalizing the minimum necessary standard, your medical review office can accelerate evidence flow while honoring the HIPAA Privacy Rule and claimant trust.

FAQs.

What information requires HIPAA authorization for disability claims?

Most disclosures of PHI from providers to a private disability insurer require a HIPAA-compliant authorization signed by the claimant. Request focused categories—such as diagnoses, testing, treatment notes, functional limits, and return-to-work guidance—tied to a defined date range. Psychotherapy notes require their own separate authorization.

How does the SSA-827 form facilitate HIPAA compliance?

The SSA-827 includes the HIPAA Privacy Rule’s required elements and authorizes providers to send records to SSA for federal disability determinations. It does not generally authorize release to private disability carriers, so you should obtain your own carrier-specific HIPAA-compliant authorization for your claim.

What special rules apply to psychotherapy notes?

Psychotherapy notes have heightened protection under HIPAA. A general medical authorization does not permit disclosure of these notes. You must obtain a separate, explicit psychotherapy notes authorization naming the provider and the notes; in most cases, treatment summaries or evaluations will meet your review needs without accessing the notes.

How should disability review offices handle electronic submission of PHI?

Use Electronic Records Express only for SSA disability cases and follow SSA’s submission controls. For private disability claims, transmit PHI through approved secure channels—such as a secure portal or encrypted transfer—maintain auditable logs, and limit each upload to the records authorized and necessary for the claim.