6 HIPAA Authorization Mistakes That Delay Your Workers' Compensation Records

HIPAA authorization rejections in California workers' compensation are not complicated. The form was incomplete, the authorization had expired, or the facility needed something specific that wasn't included. The problem is that the rejection comes back two to three weeks after the original request went out. By then it matters.

This is written for the person who fills out and sends the authorization form. Not the attorney who signs it.

‍

1. Missing Date

HIPAA requires both a wet signature and a date. If the claimant signed but didn't date it, the form is incomplete. Facilities won't process it.

This gets missed because the form looks finished at a glance. There's something on the signature line. The date field next to it is blank.

Check both fields before the form leaves the office. If you're sending the form to the claimant for signature, be explicit in the cover note: "Please sign AND date the line at the bottom." Write it out plainly. Claimants aren't trying to cause problems. They just don't read forms carefully, and the date field is easy to overlook.

2. Expired Form 

Most HIPAA authorizations state a validity window on the form itself. Ninety days is common. Some tie validity to the duration of the claim. If the form sat in someone's inbox during a file reassignment, or a claimant took three months to return it, it may already be expired before it goes out.

Some firms date the authorization when it comes back from the claimant and then the form sits for another two months before someone sends it. The validity window has closed. The form goes out anyway. Three weeks later it came back rejected.

Check the expiration date or validity window before anything goes out. If it's close, get a fresh signature. If it expires while it's sitting in their queue, you're back to the beginning.

3. Sensitive Records

This is the one that causes the most confusion because the form looks correct and still gets rejected.

Records involving psychotherapy, substance abuse treatment, and HIV status are governed by protections beyond standard HIPAA. Federal law, specifically 42 CFR Part 2, imposes strict requirements on the release of substance abuse treatment records. California law adds its own layer. A standard HIPAA authorization, even a properly completed one, will not release these records unless it explicitly authorizes them by category.

Here's the part that costs people time: some facilities will process everything except the sensitive records and send what they can, without noting that something was withheld. You receive a partial records package. The claim involves mental health treatment. The mental health records aren't in the file. Nobody told you.

Before the authorization goes out, look at the treatment history. Any indication of mental health treatment, substance use, or HIV status requires a form that specifically authorizes those categories. "Any and all records" language in the body does not cover it. The checkbox needs to be there, or the specific authorization language does. 

We'll be at CCWC covering this and more!

The next three mistakes are simpler to catch but just as expensive when they slip through. 

4. Wrong Facility Name 

Facilities get acquired. They merge with hospital systems. A template your office has been using for two years may carry the old legal name of a facility that has been operating under a different entity for the past eighteen months. Some facilities will reject an authorization if the name doesn't match their current registration.

Physical therapy groups and specialty treatment centers change hands more often than most people expect. The staff is the same. The address is the same. The legal name on the authorization needs to match who they are now.

Verify the current facility name before each submission. Not just once when you build the template.

5. No Date Range

"All records" is not specific enough for most facilities. They need a date range, and the ones that don't ask for clarification will reject the request without one.

In California workers' comp, the date range is usually tied to the injury date: records from the date of injury forward, or a specific treatment window relevant to the disputed claim. Write actual dates on the form. "January 14, 2023 through present." Not "all records related to the above claim." The more specific the range, the less the facility has to ask before pulling the file.

6. Wrong Form 

Some facilities only accept their own proprietary authorization forms. Standard DWC authorizations, generic HIPAA releases, none of it. Their form, or nothing gets processed.

Call ahead. One phone call before the submission saves three weeks of turnaround. If your office handles the same California workers' comp treating facilities on a regular basis, keep a running list of the ones that require their own forms. Save the form itself so it's ready to go. It's the kind of administrative work that feels unnecessary until it saves you from a month-long delay on a file with a QME in six weeks.

None of these require legal expertise to catch. They require someone to slow down and actually look at the form before it goes out. A quick check against these six points takes less time than one follow-up call to a facility that rejected something you sent three weeks ago.

‍

How EWORD Helps

EWORD handles the full HIPAA authorization and records retrieval cycle for California workers' comp firms, including reviewing authorizations before they go out, managing re-submissions, and tracking every outstanding request through to receipt. If resubmissions are costing your team time, we can help.

EWORD Solutions | Legal Support Services for California Workers' Compensation Firms

‍