Not true - authorization is required
I have heard this trick before where a lawyer's office will say that "workers comp records are not covered under HIPAA" so that an authorization or subpeona is not required. This is not the case for MEDICAL records. Because you are a Covered Entity (CE) under HIPAA you are obligated to follow the requirements. The information you have in the patient's record is certainly Protected Health Information (PHI) as as such, you have to treat it as such under HIPAA. The information being released to the attorney does not fall under treatment, payment (because the requestor is not the one who will reimburse you for the treatment) or operations. As such, then the information can only be released to them with a signed authorization by the patient or a subpeona. Another trick they do - if the subpoeana is not signed by a judge (some are only signed by attorneys) and is not accompanied by a signed authorization by the patient, it is not valid for release of PHI.
Where "workers comp is not covered under HIPAA" DOES apply are records kept by state Workers Compensation boards, as they are not CE's and therefore HIPAA does not apply. There could be PHI in those records, so it is imperfect, but in your case, you are a CE and you are storing PHI, therefore you do need the authorization and/or subpeona.
Hope this helps.
