(2000)

85 Op. Att'y Gen. 58

Opinion

Dear Mr. Rose:

You have asked whether the Injured Workers' Insurance Fund ("IWIF") may provide copies of medical records that it has obtained in connection with its administration of a workers' compensation claim to the self-insured employer for which IWIF administers the claim. In particular, you ask whether the disclosure of these records to an employer is subject to a State law that limits the "redisclosure" of medical records obtained from a health care provider.

In our opinion, IWIF's provision of these records to a self-insured employer does not implicate the redisclosure provision of the medical records law, provided that the employee is notified, when he or she authorizes the original disclosure, that IWIF is acting as agent for the employer. The employer is subject to the same limitations on the use of the information and redisclosure of the records as IWIF is or as the employer would be if it administered its own workers' compensation claims.

I BackgroundA. IWIF

IWIF, originally known as the State Accident Fund, was created in 1914 to insure employers against liability under the workers' compensation law. See Chapter 800, § 16, Laws of Maryland 1914. In 1990, the General Assembly renamed the agency and made other changes in its governing statute. Chapter 71, Laws of Maryland 1990, now codified at Annotated Code of Maryland, Labor and Employment Article ("LE"), § 10-101 et seq. IWIF is "the statutory insurer of last resort" — i.e, it provides coverage for otherwise uninsurable employers. See R. Gilbert R. Humphreys,Maryland Workers' Compensation Handbook (1993 ed.) at pp. 32-33. In addition to acting as an insurer, IWIF also administers claims for certain employers who elect to self-insure. IWIF is considered an agency or instrumentality of the State and is explicitly subject to the Public Information Act and certain other laws pertaining to State agencies. See § 10-105(b)(2); CentralCollection Unit v. DLD Assoc. Limited Partnership,112 Md. App. 502, 510, 685 A.2d 873 (1996).

B. Medical Records Obtained by IWIF

To administer claims covered by its policies or for which it is claims administrator, IWIF regularly gathers medical records concerning claimants from health care providers. State law requires health care providers and others to preserve the confidentiality of medical records, but permits disclosure with the written authorization or stipulation of the patient. Annotated Code of Maryland, Health-General Article ("HG"), §§ 4-302, 4-303,4-306(b)(6)(ii). For purposes of that statute, "medical record" is defined broadly and includes information transmitted in any form, if the information is identified with a particular patient and relates to the health care of that patient. § 4-301(g).

In order to obtain the necessary written consent for disclosure of medical records, IWIF requires a claimant to execute a Workers' Compensation Commission form on which the claimant agrees to the release of his or her medical records. That form, entitled "Authorization for Release of Medical Information," is addressed to the holder of the records and reads in pertinent part:

I hereby authorize you to give to [record requestor] a copy of all information you may have in my medical record regarding the condition of the following part or parts of my body or my medical condition: (Specify part or parts of body or medical condition.)

______________________________________ ______________________________________ ______________________________________

while under your observation or treatment or otherwise in your possession. This includes, but is not limited to, history, findings, . . . and any subsequent or future developments relating to my health or mental condition.

This authorization is subject to the requirement that the requestor sends a copy of the transmittal letter to the Claimant or his/her attorney and that a copy of all material received pursuant to this authorization is promptly supplied to the Claimant or his/her attorney, as is required by the regulations of the Workers' Compensation Commission.

The form includes spaces for the name of the "record holder," the "patient-claimant," and the "record requestor." See R. Gilbert R. Humphreys, Maryland Workers' Compensation Handbook (1993 ed., 1999 cum. supp.), at p. 65.¹ We understand that currently IWIF is identified as the "record requestor" on forms executed for claims that it administers.

C. Constraints on Redisclosure of Medical Records by IWIF

The medical records law also imposes an obligation of confidentiality on a person, such as IWIF, to whom a medical record is disclosed. In particular, the statute states:

A person to whom a medical record is disclosed may not redisclose the medical record to any other person unless redisclosure is:

(1) authorized by the person in interest;

(2) otherwise permitted by this subtitle;

(3) permitted under Article 88A, § 6(b) of the Code; or

(4) directory information.

§ 4-302(d). Ordinarily, therefore, a redisclosure of medical records by IWIF will require the authorization of the "person in interest" — i.e., the patient or another individual specified by law to give authorization on behalf of the patient.² See § 4-301(k) (definition of "person in interest"). In addition, the Public Information Act ordinarily will bar IWIF from disclosing portions of its records that contain medical or psychological information about an individual, unless other law permits such a disclosure. See Annotated Code of Maryland, State Government Article ("SG"), § 10-617(b).

You indicate that, on occasion, an employer for which IWIF administers a self-insurance program has requested that IWIF provide copies of medical records in its possession relating to one of the employer's employees who has filed a workers' compensation claim. You ask whether IWIF must comply with the conditions of § 4-302(d) for "redisclosure" of medical records to respond to such a request.

II Discussion The State medical records law does not expressly address the sharing of medical records with a self-insured employer by the entity that administers workers' compensation claims for that employer.³ In the absence of statutory direction, we believe that the relationship between IWIF and the claimant's employer is critical to the question whether IWIF's provision of medical records to the employer is a "redisclosure" that implicates § 4-302(d).

A. Relationship Between Employer and Workers' CompensationInsurer

Under the workers' compensation law, an insurer is the alter ego of the claimant's employer for many purposes. In Flood v.Merchants Mutual Insurance Co., 230 Md. 373, 187 A.2d 320 (1963), the Court of Appeals discussed the relationship between an employer and its workers' compensation carrier. In that case, a claimant sued both his employer's workers' compensation insurer and the physicians it had selected to evaluate and treat his work-related injuries, alleging a negligent failure to properly diagnose and treat the injuries. Noting that the employer itself would be immune from suit under the workers' compensation act, the Court reasoned that the workers' compensation law considers "the employer and insurer to be one and the same as far as the exclusiveness of the [workers compensation] remedy" is concerned. The Court concluded that:

when the Legislature by statute authorized employers to contract with insurance companies in order to cover possible claims under [the workers' compensation law] it intended the insurance carrier to stand in the position of the employer.

Id. at 377-78. Accordingly, the Court held that the insurer enjoyed the same immunity from suit by the claimant as the insured employer.

Similarly, numerous sections of the workers' compensation statute treat the insurer as the equivalent of the employer with respect to liability to the claimant. See, e.g., § 9-605 (if employer or insurer pays compensation, payment bars recovery from both); § 9-637 (employer or insurer shall pay the benefit for the period the covered employee is permanently totally disabled); § 9-660 (employer or insurer may be required to provide medical treatment to injured employee); § 9-706(b) (employer or insurer has burden of proving prejudice from employee's failure to give timely notice of claim).

In a 1975 opinion, Attorney General Burch extended the reasoning of Flood to equate a workers' compensation insurer with the insured State employer for purposes of the Public Information Act. 60 Opinions of the Attorney General 559 (1975). That opinion considered whether a prohibition in that Act against disclosure of personnel records by government entities would prevent a State agency from sharing its records concerning a claimant with an investigator from the State Accident Fund, as IWIF was then known. Citing Flood, Attorney General Burch observed that "the State and its agencies, as employer, and the State Accident Fund, as insurer, are intended to be treated as a single entity with respect to their relationship vis-a-vis claimants." Id. at 563. The opinion attributed to the State Accident Fund the same investigatory powers concerning the claim as the employer agency itself would have, stating:

[W]here an employee of the State files a Workmen's Compensation claim, the State Accident Fund, as its Workmen's Compensation insurance carrier, acquires the same rights to investigate the claim as the agency itself possesses. Such rights would necessarily include the right to examine and review personnel files to the same extent as the agency may examine its own files.

Id. At 564. Thus, the 1975 opinion concluded that provision of personnel files to the State Accident Fund by the agency would not violate the prohibition in the Public Information Act against the disclosure of personnel records.

While an employer and its workers' compensation insurer may thus be regarded as a "single entity" in some contexts, there are limits to the identity of interest of an employer and its insurer. An insurer "cannot use its status as such to shield itself from the normal obligations attendant upon those acts unrelated to its role as workers' compensation insurer." Great Atlantic PacificTea Co. v. Imbraguglio, 346 Md. 573, 589-90, 697 A.2d 885 (1997) (property owner could not avoid normal premises liability simply because it also happened to be the workers' compensation insurer of the injured person's employer).

B. IWIF as Agent for Self-Insured Employer

When the employer is a self-insurer, the employer and insurer are in fact a single entity and the workers' compensation law treats a self-insured employer as the equivalent of an insurer.See § 9-902 (insurer or self-insured employer may seek compensation from third party who was responsible for employee's injury). An entity, such as IWIF, that administers claims for a self-insured employer, acts as the agent of the employer. Within the scope of that agency relationship, IWIF acts on behalf of the self-insured employer by investigating claims, paying appropriate benefits, and defending the employer.

An agent like IWIF has a duty to disclose to its principal material information that it acquires within the scope of its agency. Hecht v. Resolution Trust Corp., 333 Md. 324, 345-46,635 A.2d 394 (1994). "One of the primary obligations of an agent to his or her principal is to disclose any information the principal may reasonably want to know." Green v. H R Block, Inc.,355 Md. 488, 518, 735 A.2d 1039 (1999). One rationale for this rule is that the principal may be bound by information acquired by the agent within the scope of the agency. Lohmuller Bldg. Co. v.Gamble, 160 Md. 534, 539, 154 A. 41 (1931).

IWIF collects medical records as part of its duties on behalf of the employer relating to a workers' compensation claim. Because IWIF obtains these records as the employer's agent, and because the employer may be bound by IWIF's actions, the employer is entitled to access to the medical records in IWIF's possession. Disclosing medical records to the self-insured employer's agent is the same as disclosing the records to the employer. Thus, in our opinion, IWIF's provision of copies of medical records to the employer is not a redisclosure for purposes of § 4-302(d).⁴

There are two important qualifications to this conclusion. Both relate to the claimant's initial authorization for disclosure of medical records.

C. Limitations on Employer Access to and Use of Records

Consent to disclosure of medical records "must be informed, voluntary, and specific." 63 Opinions of the Attorney General 432, 437 (1978).⁵ The fact that an individual's authorization for disclosure of medical records will render those records accessible by the individual's employer is likely to be of more than passing interest to the individual. An authorization form that identifies only IWIF as the record requestor does not, in our opinion, adequately inform the claimant that the records will also be available to the claimant's employer. Accordingly, the authorization form should disclose that IWIF is requesting the records as agent for the employer.

The employer's use of employee medical records may similarly be limited by the scope of the initial authorization. While the standard authorization form used in workers' compensation matters does not explicitly limit the use of records by the requestor,⁶ there may be implicit limitations on the use of such information. The authorization form, a preprinted form of the Workers' Compensation Commission, requests only medical records relating to the parts of the body or the medical condition that relate to the claim at issue. It also references regulations of the Workers' Compensation Commission requiring that the claimant be informed of the request and furnished with a copy of any records obtained.⁷ A person executing that authorization form may reasonably believe that his or her authorization extends only to matters related to the workers' compensation claim. Given that the consent to disclose must be informed and voluntary, we believe that an employer should use records received under such an authorization only in connection with the administration or adjudication of a workers' compensation claim, and not for some unrelated purpose.

In any event, as a practical matter, the medical records law constrains the employer's unrelated use of the medical records by limiting redisclosure of those records. Any contemplated redisclosure by the employer must comply with the requirements for redisclosure set forth in § 4-302(d). Accordingly, to use employee medical records obtained through IWIF for a purpose unrelated to the workers' compensation proceeding, the employer would need to obtain a further authorization from the claimant or comply with one of the other statutory exceptions permitting redisclosure of the records.

III Conclusion In sum, when IWIF administers claims for a self-insured employer, it acts as agent of the employer and has a duty to disclose to the employer material information that it has obtained within the scope of its agency. IWIF may provide the employer with copies of a claimant's medical records without reference to the redisclosure provision of the State medical records law. However, IWIF should be identified on the medical records authorization form as the agent of the employer. Moreover, the employer is subject to the same limitations on the use of the information and the redisclosure of those records as IWIF is or as the employer would be if it administered its own workers' compensation claims.

Very truly yours,

J. Joseph Curran, Jr. Attorney General

Kimberly Smith Ward Assistant Attorney General

_____________________ Robert N. McDonald Chief Counsel Opinions Advice

¹ Although this standard form is labeled an "authorization," it does not state a period of time for which the authorization is valid, as required by § 4-303(b). It is likely that the form is actually a "stipulation" for the release of medical records under § 4-306(b)(6)(ii), as it pertains to a proceeding before the Workers' Compensation Commission.

² The three other exceptions to the prohibition against redisclosure generally will not be available to IWIF. First, other provisions of the medical records law allowing disclosure without authorization of the person in interest are unlikely to apply to records held by IWIF. See § 4-305, 4-306. Second, Article 88A, § 6(b) concerns disclosure of records concerning child abuse or neglect. Finally, "directory information" is limited to the presence and general condition of a patient admitted to a health care facility. § 4-301(b).

³ The legislative history of the medical records law is unenlightening on whether the provision of such records to a self-insured employer would be considered a "redisclosure."

⁴ In analogous circumstances, the medical records law permits a health care provider to disclose medical records to third party payors "and their agents" for certain purposes, without obtaining authorization of a person in interest. § 4-305(b)(5).

⁵ The 1978 opinion construed an analogous provision, now codified at Annotated Code of Maryland, Insurance Article ("IA") § 4-403, pertaining to insurer disclosure of medical records of an insured person. That statute does not apply to employers who self-insure for workers' compensation liability. IA, § 1-204.

⁶ The portions of the medical records law that permit disclosure of medical records upon authorization or stipulation of a claimant do not require the requestor to identify the purpose for which the records are sought. See § 4-303,4-306(b)(6)(ii). By contrast, other portions of the statute limit disclosure to a particular purpose. For example, the statute permits a health care provider to disclose records to its agents and employees without patient authorization, "for the sole purpose of offering, providing, evaluating, or seeking payment for health care," and to its legal counsel "regarding only the information in the medical record that relates to the subject matter of therepresentation." § 4-305(b)(1) (emphasis added).

⁷ See COMAR 14.09.01.10. ("When a claim has been filed with the Commission, each party promptly shall provide to all other parties copies of all relevant medical information which is in the possession of the party or that is subsequently received by the party. . . . The duty to disclose applies to all medical information (reports, evaluations, bills, etc.) and continues during the pendency of the claim.").