Compliance is assured.
OM  is in compliance and has executed Agreements with Specialty Providers, each of which includes a clause on HIPAA along with other legally relevant information. The minimal information provided to OM  by workers’ compensation professionals is appropriately discarded once each referral or appointment is complete. Further, information from Providers to workers’ compensation professionals does NOT pass through OM, as per below. If a workers’ compensation professional has an issue or concern with an OM Provider, such as obtaining documentation timely or scheduling appointments timely, OM makes contact with the Provider, either to help expedite the documentation directly from the Provider to the workers’ compensation professional and/or to resolve the issue or concern. 
 
OM  is an extension of each workers’ compensation team. - 45 CFR § 164.512(l). From OM ’s legal counsel: "Generally speaking, workers’ compensation carriers are not ‘covered entities’ for HIPAA purposes unless they also happen to write health insurance plans. See 45 CFR § 164.512(l). Ordinarily, an ’organization’ such as OM would be considered a ‘business associate’ under the HIPAA Privacy Rule and would have to enter into a contract with the ‘covered entity’ (insurer or physician ‘or provider’) under 45 CFR § 164.502(e), et seq., which spells out how the business associate may use protected health information provided by the carrier. However, because workers’ compensation carriers are not covered entities, they are not required to enter into business associate contracts before sharing information with third parties. The major requirement is that the information shared should be the ‘minimum necessary’ to accomplish the workers’ compensation purpose, and should be disclosed only to those with a business need. Also … note that the ‘physicians and healthcare providers’ are still covered entities, and the doctors' offices, hospitals, etc., strictly speaking, cannot funnel medical information from OM back to the WC carrier (they can provide information directly to the carrier); covered entities may provide information only to ‘the employer, the carrier, an authorized qualified rehabilitation provider, or the attorney for [an] employer or carrier…’ §440.13(4)(c), F.S. (or to state agencies or other physicians).”