Mobile Access to Health Documents Guide Published for Comment

Earlier this month, the Technical Committee of Integrating the Healthcare Enterprise released a guide to implementing access to health records via mobile devices.  IHE is a group of healthcare professionals with more than 500 member organizations worldwide focused on technological issues in healthcare practice.  The goal of the guide, titled Mobile Access to Health Documents, is to provide developers with an application programming interface designed to ensure secure access to health records on mobile platforms.  IHE is currently soliciting public comment on the guide.

Mobile Access to Health Documents may be a valuable tool for healthcare professionals in ensuring compliance with federal law.  The Security Rule of the Health Insurance Portability and Accountability Act requires healthcare providers to meet a number of criteria to evaluate and implement safeguards on access to electronic protected health information.  Since the risk of security breaches for mobile technology which is used to access health documents is rapidly increasing, it is important for healthcare professionals to keep these developments in mind.  Healthcare professionals should also review their technical safeguards to ensure compliance with HIPAA.

© 2012 Parsonage Vandenack Williams LLC

For more information, contact info@pvwlaw.com

Advertisements

Medical Records Access Guide Nebraska

Nebraska

Parties to litigation often request a patient’s medical records for use as proof or lack thereof of a causal connection between an event and the purported injuries resulting from it. Requests for medical records for use in judicial or administrative proceedings generally take the form of an authorization from the patient consenting to release of the medical record, an order from the presiding court or administrative agency, or a subpoena from the opposing party in a civil proceeding.  Patients may also seek access to their medical records for other purposes.  This Medical Records Guide analyzes what is required of a health care provider when confronted with a request for medical records. Included in this guide are the requirements of a health care provider under the Health Insurance Portability and Accountability Act (HIPAA) and state law to the extent state law is not preempted by HIPAA. Please note that there are special rules and regulations regarding records containing information related to mental health, psychotherapy notes, substance abuse treatment, and communicable and sexually transmitted diseases. As a result, specific sections have been included in this guide for medical records containing those types of information.

             A health care provider must grant a patient access to his or her medical records for review during regular business hours within 10 days of a request. If the patient’s medical records no longer exist, cannot be found, or if another health care provider or third party has the patient’s medical records, then the health care provider must inform the patient of such within 10 days of the initial request. If the medical record is maintained by another health care provider or an off-site health information management firm, the patient should be informed of the third party’s name and address. If, due to unusual circumstances, 10 days is insufficient to gather the patient’s medical records for review, then the health care provider has a total of 21 days  to provide the patient with access to the patient’s medical records. Despite the additional 11 day allowance, the health care provider must inform the patient in writing of the unusual circumstance that has caused the delay.

Although a patient has a statutory right to a copy of his or her medical records, generally a patient does not have a right to his or her original medical records. If the patient requests his or her medical records in hard copy form, the health care provider must provide a photocopied version of the patient’s medical records within 30 days from the receipt of the request for the records.

All requests by the patient for access to, or copies of, the patient’s medical records must be in writing. The request and any authorization for release are valid for 180 days after the date of execution by the patient.  

Under HIPAA, a patient’s written authorization to disclose that patient’s protected health information to a third party must, by its terms, expire either upon a) the occurrence of a specified event or b) a date certain.  HIPAA puts no limit on how long these time periods can be.  Thus, a provider can select as long a time period as desired and still comply with HIPAA.  Nebraska law, however, sets a limit on the time period an authorization can be effective with respect to the release of a patient’s medical records.  Under Nebraska law, the patient’s authorization to release medical records must expire no more than 180 days from the date of signature.  This Nebraska law is not preempted by HIPAA.

As a result of these two standards, many providers in Nebraska use authorization forms limiting all disclosures to 180 days from execution.  The Nebraska statute referenced above, however, only applies to disclosures of a patient’s medical records.  Thus, a single authorization form can be drafted in such a way as to provide that it will expire in 180 days only with respect to the disclosure of medical records while still having a longer “shelf life” for purposes of disclosures other than releases of medical records (i.e., verbal discussions with the patient’s family members).

A sample HIPAA-compliant authorization form is available at the end of these materials, marked as Appendix A.

  Upon receipt of a subpoena, discovery request or other lawful process requesting a patient’s medical records, the health care provider should immediately send a letter to the patient informing the patient as to the existence of the subpoena, and giving the patient an opportunity to object to the release of his or her medical records.  See Appendix B for an example of such a letter to the patient.  Prior to providing any medical records, the health care provider must ensure that it has received, along with the subpoena, “satisfactory assurance” that the patient whose records are being requested has received notice of the subpoena or request and has not objected to the request. A health care provider should be satisfied that reasonable efforts have been made by the requesting party to ensure that the patient has been given notice of the request or that reasonable efforts have been made to secure a qualified protective order; one of the following three types of documentation will suffice for a showing of reasonable efforts:

(i)         An order from a court or administrative agency;

(ii)         A written, HIPAA compliant, authorization from the patient allowing disclosure of the medical record;

(iii)        A written statement from the requesting party and accompanying documentation demonstrating that:

(a)        The requesting party has made a good faith effort to provide written notice of the request to the patient, the notice had sufficient information to permit the patient to raise any objection to the court, the time for the patient to raise objections has lapsed and either no objections were filed or all objections filed have been resolved in favor of the requesting party;

(b)        All parties in the litigation have agreed to a qualified protective order that will require the parties to only use the medical records for the purpose of the litigation, followed by destruction of the copies, and have presented the order to the court presiding over the dispute; or

(c)        The requesting party has requested a qualified protective order from the presiding court that will require the parties to only use the medical records for the purpose of the litigation, followed by destruction of the copies.

If the subpoena satisfies one of the above requirements, or the party requesting the medical records by subpoena subsequently satisfies one of the above requirements, the health care provider must provide the medical records, but only to the extent specifically identified in the subpoena.

If, however, the subpoena is not accompanied by any of the supporting documentation, the health care provider should not disclose the medical records but rather should immediately send a letter to the requesting third party informing them of the health care provider’s policy regarding the release of medical records.  See Appendix C for an example of a letter to the third party who is requesting the medical records.

NOTE:  All court orders, subpoenas, and warrants should be issued from a court of competent jurisdiction.  This means the court has jurisdiction over the health care provider and/or the health care provider’s medical practice.  For example, a Texas court does not have jurisdiction over a Nebraska medical practice.  A Texas court, therefore, cannot order or subpoena documents from a Nebraska medical practice and the proper method to address such an order or subpoena can get complicated.  In the event a health care provider receives a subpoena or court order from a jurisdiction in which the health care provider does not practice medicine, then the health care provider should immediately contact legal counsel. 

Compensation Court.  There will often be a dispute over what portion of the employee’s medical record is “relevant” to the workers’ compensation proceeding.  In such a situation, the health care provider may want to use the same approach as discussed above for handling civil subpoenas.

(i)         Mental Health. “Mental health records” include any records of mental health treatment or time spent in a mental health facility or program. Generally, “mental health records” may be released upon a court order or to the patient or the patient’s authorized representative upon written request by the patient or the patient’s authorized representative.  Mental health records may also be disclosed to a third party pursuant to a written authorization signed by the patient or the patient’s authorized representative.  However, in either case, if the treating psychiatrist, psychologist, or mental health practitioner determines that release of the mental health records would not be in the best interests of the patient or that disclosure is reasonably likely to endanger the life or physical safety of the patient or another person, then the mental health records can be withheld. 

(ii)        Psychotherapy Notes.  HIPAA provides increased standards for release of “psychotherapy notes” on a patient.  “Psychotherapy notes” are defined as notes recorded by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session and that are separated from the rest of the individual’s medical record. A health care provider must obtain an authorization specific to psychotherapy notes for any use or disclosure of psychotherapy notes, except: (i) use by the originator of the psychotherapy notes for treatment; (ii) use or disclosure by the health care provider for its own training programs; (iii) use or disclosure by the health care provider to defend itself in a legal action or other proceeding brought by the individual; (iv) a disclosure require by law; or (v) to prevent a threat to a person or the public.

(iii)       Substance Abuse.  Substance abuse treatment records can be disclosed to the patient or the patient’s authorized representative upon written request by the patient or the patient’s authorized representative.  Substance abuse treatment records can also be disclosed to a third party pursuant to a written authorization signed by the patient or the patient’s authorized representative.  However, in either case, disclosure is subject to the health care provider’s determination that disclosure is not likely to endanger the life or physical safety of the patient or another person.  Absent a HIPAA-compliant authorization for release, substance abuse treatment records may only be released to a third party pursuant to a court order.

(iv)      Federally Funded Substance Abuse Programs.  Substance abuse records of persons treated in federally funded programs may be disclosed to the patient or the patient’s authorized representative upon written request by the patient or the patient’s authorized representative.  Substance abuse treatment records of persons treated in federally funded programs may also be disclosed to a third party pursuant to a written authorization signed by the patient or the patient’s authorized representative, if the authorization contains the following special clause pertaining to redisclosure:

This information has been disclosed to you from records protected by Federal confidentiality rules (42 CFR part 2).  The Federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR part 2.  A general authorization for the release of medical or other information is NOT sufficient for this purpose.  The Federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient.

Absent such an authorization, substance abuse records of persons treated in federally funded programs may only be disclosed pursuant to court order.  Wrongful disclosure of information of persons treated in federally funded substance abuse programs is a criminal offense.  

(v)       Communicable Diseases and Sexually Transmitted Diseases.  The reports of communicable diseases, including but not limited to sexually transmitted diseases and HIV/AIDS, that are required by law to be made to the Nebraska Department of Health and Human Services or other governmental agencies, are confidential, not subject to subpoena, and not admissible in any court action.  Such information, however, may be disclosed to other governmental agencies, pursuant to applicable law, for the protection of public health if all personal information that could be used to determine the patient’s identity has been removed.

In addition, medical records containing information related to communicable and sexually transmitted diseases can be disclosed to the patient or the patient’s authorized representative, or to a third party, pursuant to a written request by the patient or the patient’s authorized representative, subject to the health care provider’s determination that disclosure is not likely to endanger the life or physical safety of the patient or another person.  Patient information and test results concerning communicable and sexually transmitted diseases are confidential and are not subject to subpoena, search warrant, or discovery process.

   A health care provider cannot charge a patient for access to the patient’s medical records.  However, the provider may charge a limited amount to the patient or the patient’s authorized representative for a copy of a medical record.  The health care provider may charge a patient or his or her authorized personal representative a “reasonable cost‑based fee” for copying.  A reasonable cost-based fee includes the cost of supplies and labor required to produce the copy. Postage may also be charged  if the copy is to be sent to the patient or a personal representative via a mail delivery service. A provider may not charge a “handling” fee or charge for the costs of retrieving the record.  In addition, the charges cannot exceed:

(a)       50 cents per page for copies of regular medical records that can be copied on a standard photocopy machine;

(b)        Reasonable copy charges for medical records that cannot routinely be copied on a standard photocopy machine; and

(c)        The cost of labor and materials involved in furnishing copies of X-rays and similar special medical records. If the provider is unable to reproduce X-rays or other requested records, the person making the request may arrange, at his or her expense, for the reproduction of such records.

If the health care provider and patient agree that the health care provider will provide the patient with a summary or explanation of the patient’s medical record, then the health care provider may charge preparatory fees for the summary, so long as the parties agree to the preparatory fees up front.

  An exception to the permissibility of allowable charges for copies of medical records is that a health care provider may not charge a patient for copies of the patient’s medical records for use in supporting an application for disability benefits or assistance, an appeal relating to the denial of such benefits or assistance relating to the following federal and state programs: Nebraska Aid to Dependent Children; Nebraska Medicaid Program; Federal Old-Age, Survivors, and Disability Insurance Benefits; Supplemental Security Income; and Medicare. 

A patient requesting medical records for one of the above purposes exempt from allowable charges must provide the health care provider with a statement or document from the respective state or federal agency confirming the filing of the application or appeal.  A health care provider is only required to provide a copy free of charge for the above purposes if the patient is the party requesting the record.  If the state or federal agency overseeing the application or appeal makes the request for the patient’s medical records, then the health care provider may charge the state or federal agency in the manner prescribed in subsection (iv) below, unless there is a specific state or federal law allowing such agency to obtain medical records free of charge.

  If a request for a patient’s medical record is from the patient’s employer, workers’ compensation carrier or Nebraska Workers’ Compensation Court, the health care provider can charge such parties for copies based on the fee schedule published by the Nebraska Workers’ Compensation Court.  The current Nebraska Workers’ Compensation Court fee schedule provides for the same rates as set forth above under the heading “Patient Request – General.”

(iv)      Allowable Charges for Copies – Other Third Party Requests.   When a request for a patient’s medical records is from a third party not otherwise described above, the health care provider may charge a reasonable fee for providing copies.  However, the “reasonable cost-based fee” described in subsection (i) above is not required when the party requesting the record is someone other than the individual or his or her personal representative.  As a result, a provider may charge a party other than the patient or his or her personal representative a handling fee up to $20 in addition to the fee schedule described in subsection (i) above. Case law provides that the lower “reasonable cost-based fee” is not available for the patient’s attorney. Despite having authority to act for the patient under agency principles, the attorney can be charged the handling fee applicable to third party requests. However, if a patient requests the medical record for his or her attorney, the permissible fees are those outlined in subsection (i) above.

NOTE:  Although this Section IX has focused on the allowable fees for the production of documents, to the extent a health care provider is asked to provide expert testimony, deposition, or a narrative report on a specific subject, the health care provider may set his/her/its fees for services in advance pursuant to a contract or fee schedule. 

  

Appendix A – Authorization Form

Authorization to use and/or disclose health information

            Authorization.  The undersigned hereby authorizes and its employees to use and/or disclose to for the following purpose(s)

(may state “per my request”) following health information (may state “entire medical record”)

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                the following health information (may state “entire medical record”):

including, if applicable, the following health information related to testing, diagnosis, and/or treatment for (please initial applicable line): _________ HIV (AIDS virus), _________ sexually transmitted diseases, _________ mental health, or __________ drug and/or alcohol abuse.

            Conditions.  We may not condition your right to receive health care services from us upon your signing this authorization.  However, if the treatment to be provided is for research purposes, your failure to sign this authorization will prevent us from providing such treatment.

            Further Uses and Disclosures.  When we use or disclose your health information to other parties as you have instructed in this authorization, we will not have the ability to monitor whether your health information may be further used or disclosed by such parties.  In such a situation, your disclosed health information may no longer be protected by federal and state privacy laws.

            Expiration.  This authorization shall expire with respect to your medical records upon the earliest of (expiration date or event) or one hundred eighty (180) days from the date of this authorization.  After the expiration date, we will need to obtain a new authorization from you to disclose your medical records.  With respect to information other than your medical records, this authorization shall expire upon the earliest of (expiration date or event).

            Revocation.  You have the right to revoke this authorization at any time in accordance with our Notice of Privacy Practices.  When we receive your revocation, we will immediately stop using or disclosing the health information you authorized us to use and disclose in this authorization form.  Your revocation shall not apply to those uses and disclosures we made on your behalf pursuant to this authorization prior to the time we received your written revocation.

By signing below, you acknowledge receipt of a signed copy of this authorization.

_________________________________
Printed Name

________________________________
Date

_________________________________
Signature

 

Note:  If signed by someone other than the patient, we need written proof of your authority.

 

 

Appendix B – Letter to Patient

 

 

Dear [Patient’s Name]:

 

We value our relationship with you and want you to know that a high priority is the confidentiality of your medical record.  We want to let you know that we have received a subpoena from [requesting third party] requesting this office to provide a copy of your medical records.  For your convenience, we have attached a copy of the request to this letter. 

This office will be, absent your written objection, required to disclose the requested medical records if certain conditions are met.  You may already be aware of this request and determined that such disclosure is not objectionable; nevertheless, the purpose of this letter is to give you an additional opportunity to object to all or a portion of the requested disclosure to [requesting third party].  If this office does not receive a written objection from you within ten (10) days of the date of this letter and [requesting third party] has satisfied the conditions necessary to allow disclosure under the applicable federal and state laws, this office will proceed with the disclosure as requested.

If you have any questions about this office’s disclosure policy with regard to your health care records, please feel free to contact [name and phone number of appropriate contact at your office]. 

Very truly yours,

 


 

Appendix C – Letter to Third Party

Sample Letter to a Third Party Who is Requesting Disclosure of Protected Health Care Information for Use in a Judicial or Administrative Proceeding

 

Dear [Requesting Third Party]:

 

We have received your [insert “subpoena” etc.] requesting that this office disclose to you certain health records relating to [insert patient’s name].

Pursuant to the federal Health Insurance Portability and Accountability Act of 1996 and other applicable law, this office may not disclose health records for use in a judicial or administrative proceeding unless specified conditions have been met.

Following a review of your request, we have determined that you have not provided sufficient documentation.  Federal law requires that this office receive documentation satisfying at least one of the following three conditions prior to disclosing the type of records you have requested:

(1)               Written authorization from a patient meeting the requirements of 45 C.F.R. § 164.508(c);

(2)               An order of a court or administrative tribunal directing that this office disclose the requested materials; or

(3)               A written statement from you the requesting party, accompanied by copies of all supporting documentation, demonstrating the following:

(a)        The party requesting the information has made a good faith attempt to provide written notice of the request to the individual (or, if the individual’s location is unknown, to mail a notice to the individual’s last known address);

(b)        The notice included sufficient information about the litigation or proceeding in which the information is requested to permit the individual to raise an objection to the court or administrative tribunal; and

(c)        The time for the individual to raise objections to the court or administrative tribunal has elapsed and either no objections were filed by the individual or all objections filed by the individual have been resolved by the court or the administrative tribunal and the disclosures being sought are consistent with such resolution.

Or

A written statement from you the requesting party, accompanied by copies of all supporting documentation, demonstrating the following:

(a)        The parties to the dispute giving rise to the request for information have agreed to a “qualified protective order,” as defined by 45 C.F.R. § 164.512(e)(v), and have presented it to the court or administrative tribunal with jurisdiction over the dispute; or

(b)        The party seeking the information has requested a qualified protective order, as defined by 45 C.F.R. § 164.512(e)(v) from such court or administrative tribunal.

If you have questions about this office’s disclosure policy with regard to health records, please feel free to contact our office for further clarification.

Sincerely,

  

 

 

© 2008 Parsonage Vandenack Williams LLC

 

For more information, contact info@pvwlaw.com

 

 

 

 

 

 

 

 

Medical Records Access Guide Iowa

Responding to requests for Medical Records for Use in
Judicial or Administrative Proceedings

Iowa

I.                   Patient Request for Access to or Copies of Medical Records. 

All requests by the patient for access to, or copies of, the patient’s medical record must be in writing. A health care provider must grant a patient access to or copies of his or her medical records within thirty (30) days of receipt of the request unless the requested information is not accessible or maintained onsite, in which event the health care provider shall take action no later than 60 days from the receipt of the request. If unable to act within 30 or 60 days as appropriate, the health care provider may extend the time by no more than 30 days and shall provide the patient with a  written statement of the reasons for the delay and the date by which the request will be completed.  

II.                Patient Authorization to Provide Medical Records to Third Parties.  

A patient may request that a health care provider make available the patient’s medical records to a third party. If the patient requests that the patient’s medical records be turned over to a third party, such as the patient’s attorney, and the health care provider determines that disclosure is not likely to endanger the life or physical safety of the patient or another person, then the health care provider may provide the record if the patient has executed a valid written authorization. However, the only information that may be disclosed is the information specifically authorized for disclosure in the written authorization; do not over-disclose. When permitting the use of a patient authorization, a health care provider must use a HIPAA compliant authorization.  A sample HIPAA compliant authorization form is available at the end of these materials, marked as Appendix A.

 

III.             Requests For Deceased or Incapacitated Patients’ Medical Records.

If an individual is legally incapable of acting for him or herself, a health care provider may disclose the individual’s records only to the individual’s “personal representative.” A personal representative is defined as an executor, administrator, or other person who has authority to act on behalf of the deceased individual or the individual’s estate. Proof of appointment to such personal representative capacity can often be obtained from the county register in the county where probate of the estate has been commenced. Likewise, when a patient lacks the legal capacity to give consent to medical treatment, a health care provider may release the patient’s medical records only to a personal representative of the patient. For purposes of an incapacitated individual, a personal representative must be someone that has authority under state law to make health care decisions for the incapacitated individual.  A health care provider may also disclose deceased patients’ medical records to funeral directors as needed, and to coroners or medical examiners to identify the deceased person, determine the cause of death, and perform other functions authorized by law.

IV.             Requests Via Court Order.   

A health care provider must disclose protected health information contained in a medical record to comply with a court order, including an order of an administrative tribunal or agency. Such disclosures must be limited to the protected health information expressly authorized by the order.  Again, do not over-disclose. If such an order requests the production of a patient’s medical record, authorization from the patient is not necessary and the health care provider must comply with the requirements of the order.   A health care provider should, but is not required to, notify the patient that the record must be disclosed prior to releasing the patient’s medical records pursuant to the order.

V.                Requests Via Criminal Subpoena, Search Warrant or Grand Jury Subpoena.

Criminal subpoenas, search warrants, and grand jury subpoenas that request a patient’s medical records raise numerous legal issues. If a health care provider receives a criminal subpoena, search warrant, or grand jury subpoena, then the health care provider should contact legal counsel immediately.

VI.             Requests Via Civil Subpoena, Discovery Request,  or Other Lawful Process 

A health care provider cannot disclose medical records of any kind, or for any reason, without the patient’s written authorization or a court order.

NOTE: All court orders, subpoenas, and warrants should be issued from a court of competent jurisdiction.  This means the court has jurisdiction over the health care provider and/or health care provider’s medical practice. For example, a Texas court does not have jurisdiction over a Nebraska medical practice.  A Texas court, therefore, cannot order or subpoena documents from a Nebraska medical practice and the proper method to address such an order or subpoena can get complicated.  In the event a health care provider receives a subpoena or court order from a jurisdiction in which the health care provider does not practice medicine, then the health care provider should immediately contact legal counsel.

VII.          Requests from the Workers’ Compensation Court, Workers’ Compensation Insurance Carrier, Employers or Employees.  

A health care provider can disclose an injured or ill patient’s protected health information contained in a medical record without his or her authorization when requested for purposes of adjudicating the individual’s workers’ compensation claim. Medical records “relevant” to workers’ compensation cases are to be made available upon request to the patient’s employer, workers’ compensation insurance carrier, third‑party administrator of workers’ compensation benefits, and the Workers’ Compensation Court. 

In addition, individuals do not have a right to request that a health care provider restrict a disclosure of protected health information about them for workers’ compensation purposes. If a requested disclosure is required by law or authorized by, and necessary to comply with, a workers’ compensation or similar law, the relevant documents must be provided.

VIII.       “Super-Confidential” Medical Records: Records Pertaining to Mental Health, Psychotherapy Notes, Substance Abuse, Communicable Diseases, and Sexually Transmitted Diseases (“STDs”).   

Medical records regarding mental health, substance abuse, communicable and sexually transmitted diseases, often called “super-confidential” records, are subject to a higher standard of confidentiality and release due to their highly sensitive and private nature. Below is a brief description of the requirements for disclosure of such sensitive materials. In the alternative, a health care provider may elect to produce the otherwise properly requested record with the “super-confidential” portions of the medical record redacted. The redacted record can then be produced with an accompanying letter stating that the health care provider is in possession of additional records that cannot be released absent a court order or the patient’s written consent.

(i)         Mental Health.  “Mental health information” means oral, written, or recorded information which indicates the identity of an individual receiving professional services and which relates to the diagnosis, course, or treatment of the individual’s mental or emotional condition. Generally, mental health information may be disclosed to the patient or the patient’s authorized representative upon written request by the patient or the patient’s authorized representative.  Mental health records may also be disclosed to a third party pursuant to a written authorization signed by the patient or the patient’s authorized representative.  However, in either case, if the treating psychiatrist, psychologist, or mental health provider determines that release of the mental health records would not be in the best interests of the patient or that disclosure is reasonably likely to endanger the life or physical safety of the patient or another person, the mental health records may be withheld.  Psychological test material is confidential, is not subject to a subpoena, search warrant, or discovery process, and cannot be disclosed to the patient or any other party; but such information may be released to a psychologist upon written authorization from the patient or the patient’s authorized representative.

 (ii)        Psychotherapy Notes.  HIPPA provides increased standards for release of a “psychotherapy notes” of a patient. “Psychotherapy notes” are defined as notes recorded by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session and that are separated from the rest of the individual’s medical record. A health care provider must obtain an authorization specific to psychotherapy notes for any use or disclosure of psychotherapy notes, except: (i) use by the originator of the psychotherapy notes for treatment; (ii) use or disclosure by the health care provider for its own training programs; (iii) use or disclosure by the health care provider to defend itself in a legal action or other proceeding brought by the individual; (iv) a disclosure require by law; or (v) to prevent a threat to a person or the public.

(iii)       Substance Abuse.  Substance abuse treatment records may be disclosed to the patient or the patient’s authorized representative upon written request by the patient or the patient’s authorized representative.  Substance abuse treatment records may also be disclosed to a third party pursuant to a written authorization signed by the patient or the patient’s authorized representative.  However, in either case, disclosure is subject to the health care provider’s determination that disclosure is not likely to endanger the life or physical safety of the patient or another person.  The identity of the person seeking substance abuse treatment is confidential, cannot be disclosed to law enforcement, and is not admissible in a legal proceeding unless authorized by the patient.  If the patient is a minor, the health care provider cannot disclose the minor patient’s identity to the parent without the minor patient’s consent.  Substance abuse treatment facility records and/or involuntary commitment records are confidential unless there is an emergency or the patient provides written authorization.  Absent an emergency or patient authorization, substance abuse treatment facility records and/or involuntary commitment records are not subject to a subpoena, search warrant, or discovery process.

(iv)      Federally Funded Substance Abuse Programs.  Substance abuse records of persons treated in federally funded programs may be disclosed to the patient or the patient’s authorized representative upon written request by the patient or the patient’s authorized representative.  Substance abuse treatment records of persons treated in federally funded programs may also be disclosed to a third party pursuant to a written authorization signed by the patient or the patient’s authorized representative, which contains the following special no re-disclosure clause:

This information has been disclosed to you from records protected by Federal confidentiality rules (42 CFR part 2).  The Federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR part 2.  A general authorization for the release of medical or other information is NOT sufficient for this purpose.  The Federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient.

Absent such an authorization, substance abuse records of persons treated in federally funded programs may only be disclosed pursuant to court order.  Wrongful disclosure of information of persons treated in federally funded substance abuse programs is a criminal violation and is subject to a $500 fine for a first time offense.  

(v)       Communicable Diseases and Sexually Transmitted Diseases. Reports of communicable diseases, sexually transmitted diseases and HIV/AIDS, which are required to be given to the Iowa Department of Human Services are confidential, unless the information is de-identified, and if not de-identified are not subject to a subpoena, search warrant, or discovery process.

(vi)      HIV Testing.  Any information, including reports and records, obtained, submitted, and maintained concerning HIV/AIDS testing and counseling is confidential and not subject to a subpoena, search warrant or discovery process, except such information may be disclosed upon a written release from the patient, subject to the health care provider’s determination that disclosure will not likely endanger the life or physical safety of the patient or another person.  Absent such an authorization, such information may only be disclosed pursuant to a special court order, which, among other things, shows a compelling need and protects the information from re-disclosure.  If a sexual offender is tested, the results may be disclosed to the victim, a counselor designated by the victim, the victim’s physician if requested by the victim, the parent, guardian, or custodian of the victim if the victim is a minor, or to a specified third party designated in a written, informed consent signed by the offender.

IX. Permissible Charges for Copying and Reproduction of Medical Records.   

(i)         Allowable Charges for Copies – Patient Requests, Generally.  A health care provider cannot charge a patient for access to the patient’s medical records.  However, the provider may charge a limited amount to the patient or the patient’s authorized representative for a copy of a medical record.  The health care provider may charge a patient or his or her authorized personal representative a “reasonable cost‑based fee” for copying.  A reasonable cost-based fee includes the cost of supplies and labor required to produce the copy. Postage may also be charged  if the copy is to be sent to the patient or a personal representative via a mail delivery service. A provider may not charge a “handling” fee or charge for the costs of retrieving the record. 

However, if the health care provider and patient agree that the health care provider will provide the patient with a summary or explanation of the patient’s medical record, the health care provider may charge preparatory fees for the summary, so long as the parties agree to the preparatory fees up front.

(ii)       Allowable Charges for Copies – Workers’ Compensation Requests.  If the request for a patient medical record is for use in a workers’ compensation proceeding, the initial and final assessments shall be provided free of charge when requested for the purpose of determining payment and liability.  However, if copies of additional records or reports are requested, the health care provider can charge the actual costs of providing such copies.  Such actual costs include the cost of supplies, labor, and postage, and cannot exceed:

(a)   $20 for 1 to 20 pages; plus

(b)   $1 for each additional page over 20 up to 30; plus

(c)   50 cents for each additional page over 30 up to 100; plus

(d)   25 cents for each additional page over 100 up to 200; plus

(e)   10 cents for each additional page over 200

(iii)      Allowable Charges for Copies – Other Third Party RequestsWhen a request for a patient’s medical records is from a third party not otherwise described above, the health care provider may charge a reasonable fee for providing copies.

NOTE:  Although this Section IX has focused on the allowable fees for the production of documents, to the extent a health care provider is asked to provide expert testimony, deposition, or a narrative report on a specific subject, the health care provider may set his/her/its fees for services in advance pursuant to a contract or fee schedule.

 

Appendix A – Authorization Form

AUTHORIZATION TO USE AND/OR DISCLOSE HEALTH INFORMATION

            Authorization.  The undersigned hereby authorizes and its employees to use and/or disclose to for the following purpose(s) (may state “per  request”)

                                                                                                                                                           

 

the following health information (may state “entire medical record”): including, if applicable, the following health information related to testing, diagnosis, and/or treatment for (please initial applicable line): _________ HIV (AIDS virus), _________ sexually transmitted diseases, _________ mental health, or __________ drug and/or alcohol abuse.

 

            Conditions.  We may not condition your right to receive health care services from us upon your signing this authorization.  However, if the treatment to be provided is for research purposes, your failure to sign this authorization will prevent us from providing such treatment.

            Further Uses and Disclosures.  When we use or disclose your health information to other parties as you have instructed in this authorization, we will not have the ability to monitor whether your health information may be further used or disclosed by such parties.  In such a situation, your disclosed health information may no longer be protected by federal and state privacy laws.

            Expiration.  This authorization shall expire upon the earliest of (expiration date or event) or one hundred eighty (180) days from the date of this authorization.  After the expiration date, we will need to obtain a new authorization from you if required by law.

            Revocation.  You have the right to revoke this authorization at any time in accordance with our Notice of Privacy Practices.  When we receive your revocation, we will immediately stop using or disclosing the health information you authorized us to use and disclose in this authorization form.  Your revocation shall not apply to those uses and disclosures we made on your behalf pursuant to this authorization prior to the time we received your written revocation.

By signing below, you acknowledge receipt of a signed copy of this authorization.

_________________________________
Printed Name

________________________________
Date

_________________________________
Signature

 

Note:  If signed by someone other than the patient, we need written proof of your authority.

 

Appendix B – Letter to Third Party

Sample Letter to a Third Party Who is Requesting Disclosure of Protected Health Care Information for Use in a Judicial or Administrative Proceeding

 

Dear [Requesting Third Party],

 

We have received your [subpoena, discovery request, etc.] requesting that this office disclose to you certain health care records relating to [patient’s name].  Pursuant to the administrative simplification requirements of the Health Insurance Portability and Accountability Act of 1996 and other applicable state and federal laws, this office may not disclose the patient’s medical records for use in a judicial or administrative proceeding unless specified conditions have been met.

Following a review of your request, we have determined that you have not provided sufficient documentation.  It is the policy of this office to require the receipt of documentation satisfying at least one of the following three conditions prior to making any disclosures of individually identifiable health care information.

(1)               A written authorization from the patient that meets the requirements of 45 C.F.R. § 164.508(c);

(2)               An order from a court or administrative tribunal directing that this office disclose the requested materials; or

(3)               A written statement along with copies of all related documentation from you, the requesting party, that establishes:

(a)        The party requesting the information has made a good faith opportunity to provide written notice to the patient;

(b)        The notice included sufficient information about the litigation to permit the patient to raise an objection to the court or agency; and

(c)        The time for the Patient to raise objections to the court/tribunal has elapsed and either no objections were filed or the objection has been resolved in the requesting party’s favor.

Or

A written statement along with copies of all related documentation from you, the requesting party, that establishes:

(a)        The parties to the litigation have agreed to a “qualified protective order,” as defined by 45 C.F.R. § 164.512(e)(v), that has been presented to the court/administrative tribunal; or

(b)        The party seeking the disclosure has requested a qualified protective order, as defined above, from the court/administrative tribunal.

If you have questions about this office’s disclosure policy with regard to health information, please feel free to contact [Name of Appropriate Contact at Your Office] for further clarification.

Sincerely,

 

Appendix C – Letter to Patient

 

Dear [Patient’s Name],

 

We value our relationship with you and want you to know that a high priority is the confidentiality of your medical record.  We want to let you know that we have received a subpoena from [requesting third party] requesting this office to provide a copy of your medical records.  For your convenience, we have attached a copy of the request to this letter. 

This office will be, absent your written objection, required to disclose the requested medical records if certain conditions are met.  You may already be aware of this request and determined that such disclosure is not objectionable; nevertheless, the purpose of this letter is to give you an additional opportunity to object to all or a portion of the requested disclosure to [requesting third party].  If this office does not receive a written objection from you within ten (10) days of the date of this letter and [requesting third party] has satisfied the conditions necessary to allow disclosure under the applicable federal and state laws, this office will proceed with the disclosure as requested.

If you have any questions about this office’s disclosure policy with regard to your health care records, please feel free to contact [name and phone number of appropriate contact at your office]. 

Very truly yours,

 

 

 

© 2008 Parsonage Vandenack Williams LLC

 

For more information, contact info@pvwlaw.com

Medical Records Access Guide Minnesota

Responding to requests for Medical Records for Use in
Judicial or Administrative Proceedings
 

Minnesota

Parties to litigation often request a patient’s medical records for use as proof or lack thereof of a causal connection between an event and the purported injuries resulting from it. Requests for medical records for use in judicial or administrative proceedings generally take the form of an authorization from the patient consenting to release of the medial record, an order from the presiding court or administrative agency, or a subpoena from the opposing party in a civil proceeding.  The Medical Records Guide analyzes what is required of a health care provider when confronted with a request for medical records. Included in this guide are the requirements of a health care provider under the Health Insurance Portability and Accountability Act (HIPAA) and Minnesota state law to the extent state law is not preempted by HIPAA.  However, if Minnesota state laws provide greater privacy protections or privacy rights with respect to individually identifiable health information than HIPAA does, the state law will prevail. Please note that there are special rules and regulations regarding records containing information related to mental health, psychotherapy notes, substance abuse treatment, and communicable and sexually transmitted diseases. As a result, specific sections have been included for medical records containing those types of information.

All requests by the patient for access to, or copies of, the patient’s medical record must be in writing. A health care provider must grant a patient access to or copies of his or her medical records within thirty (30) days of receipt of the request unless the requested information is not accessible or maintained onsite, in which event the health care provider shall take action no later than 60 days from the receipt of the request. If unable to act within 30 or 60 days as appropriate, the health care provider may extend the time by no more than 30 days and shall provide the patient with a  written statement of the reasons for the delay and the date by which the request will be completed.  

II.                Patient Authorization to Provide Medical Records to Third Parties.  

A patient may request that a health care provider make available the patient’s medical records to a third party. If the patient requests that the patient’s medical records be turned over to a third party, such as the patient’s attorney, and the health care provider determines that disclosure is not likely to endanger the life or physical safety of the patient or another person, the health care provider should provide the record if the patient has executed a valid written authorization. However, the only information that may be disclosed is the information specifically authorized for disclosure in the written authorization; do not over-disclose. When permitting the use of a patient authorization, a health care provider must use a HIPAA compliant authorization. 

Under HIPAA, a patient’s authorization to disclose his or her protected health information to a third party must expire, by its terms, either upon a) the occurrence of a specified event or b) a date certain. Under federal law, there is no limit on how far in the future this date certain can be.  Thus, a provider can select as long a time period as desired and still comply with HIPAA.  To comply with Minnesota law, however, the patient’s consent to release his or her medical record  is generally valid only for one year or a lesser period specified in the consent.  This Minnesota law is not preempted by HIPAA.

Providers in Minnesota are thus subject to two standards regarding a patient’s authorization to release his or her medical record.  The Minnesota law placing an absolute expiration on the patient’s , however, only applies to disclosures of the patient’s medical record. Thus, a single authorization form can be drafted in such a way as to provide that it will expire in 180 days only with respect to the disclosure of medical records while still having a longer “shelf life” for purposes of disclosures other than releases of medical records (i.e., verbal discussions with the patient’s family members). 

A sample HIPAA- and Minnsota- compliant authorization form is available at the end of these materials, marked as Appendix A.

 

III.             Requests For Deceased or Incapacitated Patients’ Medical Records.

If an individual is legally incapable of acting for him or herself, a health care provider may disclose the individual’s records only to the individual’s “personal representative.” A personal representative is defined as an executor, administrator, or other person who has authority to act on behalf of the deceased individual or the individual’s estate. Proof of appointment to such personal representative capacity can often be obtained from the county register in the county where probate of the estate has been commenced. Likewise, when a patient lacks the legal capacity to give consent to medical treatment, a health care practitioner may release the patient’s medical records only to a personal representative of the patient. For purposes of an incapacitated individual, a personal representative must be someone that has authority under state law to make health care decisions for the incapacitated individual.  A health care provider may also disclose deceased patients’ medical records to funeral directors as needed, and to coroners or medical examiners to identify the deceased person, determine the cause of death, and perform other functions authorized by law.

A health care provider must disclose protected health information contained in a medical record to comply with a court order, including an order of an administrative tribunal or agency. Such disclosures must be limited to the protected health information expressly authorized by the order; again, do not over-disclose. If a court order requests the production of a patient’s medical record, authorization from the patient is not necessary and the health care provider must comply with the requirements of the order.   A health care provider should, but is not required to, notify the patient that the record must be disclosed prior to releasing the patient’s medical records pursuant to the order.

V.                Requests Via Criminal Subpoena, Search Warrant or Grand Jury Subpoena.

Criminal subpoenas, search warrants, and grand jury subpoenas that request a patient’s medical records raise numerous legal issues. If a health care provider receives a criminal subpoena, search warrant or a grand jury subpoena, the health care provider should contact legal counsel immediately.

VI.             Requests Via Civil Subpoena, Discovery Request, or Other Lawful Process. 

It is common in civil litigation matters involving personal injuries for a party to request a patient’s medical records through the use of a subpoena, discovery request or other lawful process without an accompanying order signed by a court or administrative tribunal.  The most common request will be a subpoena issued by a party’s attorney for the medical records of a client.  The document will generally be captioned “Subpoena” or at least contain the term “Subpoena” in the caption, along with the names of two non-governmental opposing parties. The subpoena should also identify the court presiding over the action. Prior to disclosing any information, the provider should verify that the court is a court of competent jurisdiction and that the subpoena is signed by one of the parties’ attorneys or a notary public. 

Upon receipt of a subpoena, discovery request or other lawful process requesting a patient’s medical records, the health care provider should immediately send a letter to the patient informing the patient as to the existence of the subpoena, and giving the patient an opportunity to object to the release of the patient’s medical records.  See Appendix B for an example of such a letter to the patient.  Prior to providing any medical records, the health care provider must ensure that it has received, along with the subpoena, “satisfactory assurance” that the patient whose records are being requested has received notice of the subpoena or request and has not objected to the request. A health care provider should be satisfied that reasonable efforts have been made by the requesting party to ensure that the patient has been given notice of the request or that reasonable efforts have been made to secure a qualified protective order; one of the following three types of documentation will suffice for a showing of reasonable efforts:

(i)         An order from a court or administrative agency;

(ii)        A written, HIPAA compliant, authorization from the patient allowing disclosure of the medical record;

(iii)       A written statement from the requesting party and accompanying documentation demonstrating that:

(a)        The requesting party has made a good faith effort to provide written notice of the request to the patient, the notice had sufficient information to permit the patient to raise any objection to the court, the time for the patient to raise objections has lapsed and either no objections were filed or all objections filed have been resolved in favor of the requesting party;

(b)        All parties in the litigation have agreed to a qualified protective order that will require the parties to only use the medical records for the purpose of the litigation, followed by destruction of the copies, and have presented the order to the court presiding over the dispute; or

(c)        The requesting party has requested a qualified protective order from the presiding court that will require the parties to only use the medical records for the purpose of the litigation, followed by destruction of the copies.

If the subpoena satisfies one of the above requirements, or the party requesting the medical records by subpoena subsequently satisfies one of the above requirements, the health care provider must provide the medical records, but only to the extent specifically identified in the subpoena.

If, however, the subpoena is not accompanied by any of the supporting documentation, the health care provider should not disclose the medical records but rather should immediately send a letter to the requesting third party informing them of the health care provider’s policy regarding the release of medical records.  See Appendix C for an example of a letter to the third party who is requesting the medical records.

NOTE: All court orders, subpoenas, and warrants discussed in Sections IV, V, and VI above should be issued from a court of competent jurisdiction.  This means the court has jurisdiction over the health care provider and/or health care provider’s medical practice. For example, a Texas court does not have jurisdiction over a Nebraska medical practice.  A Texas court, therefore, cannot order or subpoena documents from a Nebraska medical practice and the proper method to address such an order or subpoena may get complicated.  In the event a health care provider receives a subpoena or court order from a jurisdiction in which the health care provider does not practice medicine, the health care provider should immediately contact legal counsel.

VII.          Requests from the Workers’ Compensation Court, Workers’ Compensation Insurance Carrier, Employers or Employees.

A health care provider may disclose an injured or ill worker’s protected health information contained in a medical record without his or her authorization when requested for purposes of adjudicating the individual’s workers’ compensation claim. Medical records “relevant” to workers’ compensation cases are to be made available upon request to the patient’s employer, workers’ compensation insurance carrier, third‑party administrator of workers’ compensation benefits, and the Workers’ Compensation Court. 

In addition, individuals do not have a right to request that a health care provider restrict a disclosure of protected health information about them for workers’ compensation purposes. If a requested disclosure is required by law or authorized by, and necessary to comply with, a workers’ compensation or similar law, the relevant documents must be provided.

VIII.       “Super-Confidential” Medical Records: Records Pertaining to Mental Health, Psychotherapy Notes, Substance Abuse, Communicable Diseases and Sexually Transmitted Diseases (“STDs”).   

Medical records regarding mental health, substance abuse, communicable and sexually transmitted diseases, often called “super-confidential” records, are subject to a higher standard of confidentiality and release due to their highly sensitive and private nature. Below is a brief description of the requirements for disclosure of such sensitive material. In the alternative, a health care provider may elect to produce the otherwise properly requested record with the “super-confidential” portions of the medical record redacted. The redacted record can then be produced with an accompanying letter stating that the health care provider is in possession of additional records that cannot be released absent a court order or the patient’s written consent.

(i)         Mental Health.  “Mental health information” means oral, written, or recorded information which indicates the identity of an individual receiving professional services and which relates to the diagnosis, course, or treatment of the individual’s mental or emotional condition. Generally, mental health information may be disclosed to the patient or the patient’s authorized representative upon written request by the patient or the patient’s authorized representative.  Mental health records may also be disclosed to a third party pursuant to a written authorization signed by the patient or the patient’s authorized representative.  However, in either case, if the treating psychiatrist, psychologist, or mental health practitioner determines that release of the mental health records would not be in the best interests of the patient or that disclosure is reasonably likely to endanger the life or physical safety of the patient or another person, the mental health records may be withheld.  Psychological test material is confidential, is not subject to a subpoena, search warrant, or discovery process, and cannot be disclosed to the patient or any other party; but such information may be released to a psychologist upon written authorization from the patient or the patient’s authorized representative.

(ii)        Psychotherapy Notes.  HIPAA provides increased standards for release of a “psychotherapy notes” of a patient. “Psychotherapy notes” are defined as notes recorded by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session and that are separated from the rest of the individual’s medical record. A health care provider must obtain an authorization specific to psychotherapy notes for any use or disclosure of psychotherapy notes, except: (i) use by the originator of the psychotherapy notes for treatment; (ii) use or disclosure by the health care provider for its own training programs; (iii) use or disclosure by the health care provider to defend itself in a legal action or other proceeding brought by the individual; (iv) a disclosure require by law; or (v) to prevent a threat to a person or the public.

(iii)       Substance Abuse.  Substance abuse treatment records may be disclosed to the patient or the patient’s authorized representative upon written request by the patient or the patient’s authorized representative.  Substance abuse treatment records may also be disclosed to a third party pursuant to a written authorization signed by the patient or the patient’s authorized representative.  However, in either case, disclosure is subject to the health care provider’s determination that disclosure is not likely to endanger the life or physical safety of the patient or another person.  The identity of the person seeking substance abuse treatment is confidential, cannot be disclosed to law enforcement, and is not admissible in a legal proceeding unless authorized by the patient.  If the patient is a minor, the health care provider cannot disclose the minor patient’s identity to the parent without the minor patient’s consent.  Substance abuse treatment facility records and/or involuntary commitment records are confidential unless there is an emergency or the patient provides written authorization.  Absent an emergency or patient authorization, substance abuse treatment facility records and/or involuntary commitment records are not subject to a subpoena, search warrant, or discovery process.

(iv)      Federally Funded Substance Abuse Programs.  Substance abuse records of persons treated in federally funded programs may be disclosed to the patient or the patient’s authorized representative upon written request by the patient or the patient’s authorized representative.  Substance abuse treatment records of persons treated in federally funded programs may also be disclosed to a third party pursuant to a written authorization signed by the patient or the patient’s authorized representative, which contains the following special no re-disclosure clause:

This information has been disclosed to you from records protected by Federal confidentiality rules (42 CFR part 2).  The Federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR part 2.  A general authorization for the release of medical or other information is NOT sufficient for this purpose.  The Federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient.

Absent such an authorization, substance abuse records of persons treated in federally funded programs may only be disclosed pursuant to court order.  Wrongful disclosure of information of persons treated in federally funded substance abuse programs is a criminal violation and is subject to a $500 fine for a first time offense.  

(v)       Communicable Diseases and Sexually Transmitted DiseasesReports of communicable diseases, sexually transmitted diseases and HIV/AIDS, which are required to be given to the Department of Public Health and Environment are confidential, unless the information is de-identified, and if not de-identified are not subject to a subpoena, search warrant, or discovery process.

(vi)      HIV Testing.  Any information, including reports and records, obtained, submitted, and maintained concerning HIV/AIDS testing and counseling is confidential and not subject to a subpoena, search warrant or discovery process, except such information is de-identified or upon a written release from the patient, subject to the health care provider’s determination that disclosure will not likely endanger the life or physical safety of the patient or another person. 

IX.        Permissible Charges for Copying and Reproduction of Medical Records.  

A health care provider cannot charge a patient for access to the patient’s medical records. However, the provider may charge a limited amount to the patient or the patient’s authorized representative for a copy of a medical record.  The health care provider may charge a patient or his or her authorized personal representative a “reasonable cost‑based fee” for copying.  A reasonable cost-based fee includes the cost of supplies and labor required to produce the copy. Postage may also be charged  if the copy is to be sent to the patient or a personal representative via a mail delivery service. A provider may not charge a “handling” fee or charge for the costs of retrieving the record. 

However, if the health care provider and patient agree that the health care provider will provide the patient with a summary or explanation of the patient’s medical record, the health care provider may charge preparatory fees for the summary, so long as the parties agree to the preparatory fees up front.

Under Minnesota state law, when a provider makes copies of patient records upon a patient’s request, the provider may charge the patient no more than 75 cents per page, plus ten dollars for time spent retrieving and copying the records.  This limitation does not apply to x-rays.  The provider may charge no more than the actual cost of reproducing the x-rays, plus no more than ten dollars for the time spent retrieving and copying the x-rays.

NOTE:  Although this Section IV has focused on the allowable fees for the production of documents, to the extent a health care provider is asked to provide expert testimony, deposition, or a narrative report on a specific subject, the health care provider may set his/her/its fees for services in advance pursuant to a contract or fee schedule.


 

Appendix A – Authorization Form

AUTHORIZATION TO USE AND/OR DISCLOSE HEALTH INFORMATION

            Authorization.  The undersigned hereby authorizes and its employees to use and/or disclose to for the following purpose(s) (may state “per my request”)                                                                                                                                                                                                                               

                                                                                                                                             

                                                                                                                                                          

 

the following health information (may state “entire medical record”):

 

                                                                                                                                                      

 

including, if applicable, the following health information related to testing, diagnosis, and/or treatment for (please initial applicable line): _________ HIV (AIDS virus), _________ sexually transmitted diseases, _________ mental health, or __________ drug and/or alcohol abuse.

            Conditions.  We may not condition your right to receive health care services from us upon your signing this authorization.  However, if the treatment to be provided is for research purposes, your failure to sign this authorization will prevent us from providing such treatment.

            Further Uses and Disclosures.  When we use or disclose your health information to other parties as you have instructed in this authorization, we will not have the ability to monitor whether your health information may be further used or disclosed by such parties.  In such a situation, your disclosed health information may no longer be protected by federal and state privacy laws.

            Expiration.  This authorization shall expire with respect to your medical records one year from the date of your signature unless you provide for an earlier expiration date here:__________.  After the expiration date, we will need to obtain a new authorization from you if required by law.  With respect to information other than your medical records, this authorization shall expire upon the earliest of (expiration date or event).

            Revocation.  You have the right to revoke this authorization at any time in accordance with our Notice of Privacy Practices.  When we receive your revocation, we will immediately stop using or disclosing the health information you authorized us to use and disclose in this authorization form.  Your revocation shall not apply to those uses and disclosures we made on your behalf pursuant to this authorization prior to the time we received your written revocation.

By signing below, you acknowledge receipt of a signed copy of this authorization.

_________________________________
Printed Name

________________________________
Date

_________________________________
Signature

 

Note:  If signed by someone other than the patient, we need written proof of your authority.

 

Appendix B – Letter to Third Party

Sample Letter to a Third Party Who is Requesting Disclosure of Protected Health Care Information for Use in a Judicial or Administrative Proceeding

 

Dear [Requesting Third Party];

 

We have received your [subpoena, discovery request, etc.] requesting that this office disclose to you certain health care records relating to [patient’s name].  Pursuant to the administrative simplification requirements of the Health Insurance Portability and Accountability Act of 1996 and other applicable state and federal laws, this office may not disclose the patient’s medical records for use in a judicial or administrative proceeding unless specified conditions have been met.

Following a review of your request, we have determined that you have not provided sufficient documentation.  It is the policy of this office to require the receipt of documentation satisfying at least one of the following three conditions prior to making any disclosures of individually identifiable health care information.

(1)               A written authorization from the patient that meets the requirements of 45 C.F.R. § 164.508(c);

(2)               An order from a court or administrative tribunal directing that this office disclose the requested materials; or

(3)               A written statement along with copies of all related documentation from you, the requesting party, that establishes:

(a)        The party requesting the information has made a good faith opportunity to provide written notice to the patient;

(b)        The notice included sufficient information about the litigation to permit the patient to raise an objection to the court or agency; and

(c)        The time for the Patient to raise objections to the court/tribunal has elapsed and either no objections were filed or the objection has been resolved in the requesting party’s favor.

Or

A written statement along with copies of all related documentation from you, the requesting party, that establishes:

(a)        The parties to the litigation have agreed to a “qualified protective order,” as defined by 45 C.F.R. § 164.512(e)(v), that has been presented to the court/administrative tribunal; or

(b)        The party seeking the disclosure has requested a qualified protective order, as defined above, from the court/administrative tribunal.

If you have questions about this office’s disclosure policy with regard to health information, please feel free to contact [Name of Appropriate Contact at Your Office] for further clarification.

                                                                        Sincerely,

 

Appendix C – Letter to Patient

 

Dear [Patient’s Name],

 

We value our relationship with you and want you to know that a high priority is the confidentiality of your medical record.  We want to let you know that we have received a subpoena from [requesting third party] requesting this office to provide a copy of your medical records.  For your convenience, we have attached a copy of the request to this letter. 

This office will be, absent your written objection, required to disclose the requested medical records if certain conditions are met.  You may already be aware of this request and have determined that such disclosure is not objectionable; nevertheless, the purpose of this letter is to give you an additional opportunity to object to all or a portion of the requested disclosure to [requesting third party].  If this office does not receive a written objection from you within ten (10) days of the date of this letter and [requesting third party] has satisfied the conditions necessary to allow disclosure under the applicable federal and state laws, this office will proceed with the disclosure as requested.

If you have any questions about this office’s disclosure policy with regard to your health care records, please feel free to contact [name and phone number of appropriate contact at your office]. 

Very truly yours,

 

 

 

© 2008 Parsonage Vandenack Williams LLC

 

For more information, contact info@pvwlaw.com

Medical Records Access Guide South Dakota

RESPONDING TO REQUESTS FOR MEDICAL RECORDS FOR USE IN JUDICIAL OR ADMINISTRATIVE PROCEEDINGS

 

South Dakota

 

 Parties to civil litigation often request a patient’s medical records for sue as proof or lack thereof of a causal connection between an event and the purported injuries resulting there from.  Requests for medical records for use in judicial or administrative proceedings generally take the form of an authorization from the patient consenting to release of the medical record, an order from the presiding court or administrative agency or a subpoena from the opposing party in a civil proceeding.  The following article analyzes what is required of a health care provider when confronted with a request for medical records.  Included in this guide are requirements of a health care provider under the Health Insurance Portability and Accountability Act (HIPAA) and state law when not otherwise preempted by HIPAA.  However, if state laws provide greater privacy protections or a privacy right with respect to individually identifiable health information than HIPAA does, the state law will prevail.  Please note that there are special rules and regulation regarding records containing information related to mental health, psychotherapy notes, substance abuse treatment, and communicable and sexually transmitted diseases.  As a result, specific sections have been included for medical records containing those various types of information

 

I.                    Patient Request for Access to or Copies of Medical Records.

 

A patient is a person who consults or is examined or interviewed by a physician or psychotherapist.  Patients, or the patient’s designated representative, have a statutory right to review and make copies of any records maintained by a health care practitioner regarding the patient’s health history and treatment rendered.  However, if the health care provider determines access would be reasonably likely to endanger the life or physical safety of the patient or another person, the health care provider may refuse to honor such right.  In addition, it should be noted that certain laboratory records are prohibited by law from being disclosed.

 

All requests by the patient for access to, or copies of, the patient’s medical record must be in writing.  If the entity grants the request, in whole or in part, it must inform the individual of the acceptance of the request and provide the access requested.  If the covered entity denies the request, in whole or in part, it must provide the individual with a written denial.  A health care provider must grant a patient access to or copies of his or her medical records no later than thirty (30) days of receipt of the request unless the request information is not accessible or maintained onsite, in which event the health care provider shall take action no later than 60 days from the receipt of the request.  If unable to act within 30 or 60 days as appropriate, the health care provider may extend the time by no more than 30 days and shall provide the patient with a written statement of the reasons for the delay and the date by which the request will be completed.  The covered entity can only use the extension one time.

 

A patient has a privilege to refuse to disclose and to prevent any other person from disclosing confidential communications made for the purpose of diagnosis or treatment of his physical, mental, or emotional condition, including alcohol or drug addition, among himself, physician, or psychotherapist, and persons who are participating in the diagnosis or treatment under the direction of the physician or psychotherapist, including members of the patient’s family

 

II.                Patient Authorization to Provide Medical Records to Third Parties.

A patient may request that a health care provider make available the patient’s medical records to a third party. If the patient requests that the patient’s medical records be turned over to a third party, such as the patient’s attorney, and the health care provider determines that disclosure is not likely to endanger the life or physical safety of the patient or another person, the health care provider may provide the record if the patient has executed a valid written authorization. However, the only information that may be disclosed is the information specifically authorized for disclosure in the written authorization; do not over-disclose. When permitting the use of a patient authorization, a health care provider must use a HIPAA compliant authorization.  A sample HIPAA compliant authorization form is available at the end of these materials, marked as Appendix A.

III.             Requests For Deceased or Incapacitated Patients’ Medical Records.

 If an individual is legally incapable of acting for him or herself, a health care provider may disclose the individual’s records only to the individual’s “personal representative.” A personal representative is defined as an executor, administrator, or other person who has authority to act on behalf of the deceased individual or the individual’s estate. Proof of appointment to such personal representative capacity can often be obtained from the county register in the county where probate of the estate has been commenced. Likewise, when a patient lacks the legal capacity to give consent to medical treatment, the person who was the physician or psychotherapist at the time of the communications may release the patient’s medical records only to a personal representative of the patient. For purposes of an incapacitated individual, a personal representative must be someone that has authority under state law to make health care decisions for the incapacitated individual.  A health care provider may also disclose deceased patients’ medical records to funeral directors as needed, and to coroners or medical examiners to identify the deceased person, determine the cause of death, and perform other functions authorized by law.

IV.             Requests Via Court Order.

A health care provider must disclose protected health information contained in a medical record to comply with a court order, including an order of an administrative tribunal or agency. Such disclosures must be limited to the protected health information expressly authorized by the order; again, do not over-disclose. If a court order requests the production of a patient’s medical record, authorization from the patient is not necessary and the health care provider must comply with the requirements of the order.   A health care provider should, but is not required to, notify the patient that the record must be disclosed prior to releasing the patient’s medical records pursuant to the order.

V.                Requests Via Criminal Subpoena, Search Warrant or Grand Jury Subpoena.

Criminal subpoenas, search warrants, and grand jury subpoenas that request a patient’s medical records raise numerous legal issues. If a health care provider receives a criminal subpoena, search warrant or a grand jury subpoena, the health care provider should contact legal counsel immediately.

VI.             Requests Via Civil Subpoena, Discovery Request,  or Other Lawful Process

It is common in civil litigation matters involving personal injuries for a party to request a patient’s medical records through the use of a subpoena, discovery request or other lawful process without an accompanying order signed by a court or administrative tribunal.  The most common request will be a subpoena issued by a party’s attorney for the medical records of a client.  The document will generally be captioned “Subpoena” or at least contain the term “Subpoena” in the caption, along with the names of two non-governmental opposing parties. The subpoena should also identify the court presiding over the action. Prior to disclosing any information, the provider should verify that the court is a court of competent jurisdiction and that the subpoena is signed by one of the parties’ attorneys or a notary public. 

Upon receipt of a subpoena, discovery request or other lawful process requesting a patient’s medical records, the health care provider should immediately send a letter to the patient informing the patient as to the existence of the subpoena, and giving the patient an opportunity to object to the release of the patient’s medical records.  See Appendix B for an example of such a letter to the patient.  Prior to providing any medical records, the health care provider must ensure that it has received, along with the subpoena, “satisfactory assurance” that the patient whose records are being requested has received notice of the subpoena or request and has not objected to the request. A health care provider should be satisfied that reasonable efforts have been made by the requesting party to ensure that the patient has been given notice of the request or that reasonable efforts have been made to secure a qualified protective order; one of the following three types of documentation will suffice for a showing of reasonable efforts:

(i)         An order from a court or administrative agency;

(ii)        A written, HIPAA compliant, authorization from the patient allowing disclosure of the medical record;

(iii)       A written statement from the requesting party and accompanying documentation demonstrating that:

(a)        The requesting party has made a good faith effort to provide written notice of the request to the patient, the notice had sufficient information to permit the patient to raise any objection to the court, the time for the patient to raise objections has lapsed and either no objections were filed or all objections filed have been resolved in favor of the requesting party;

(b)        All parties in the litigation have agreed to a qualified protective order that will require the parties to only use the medical records for the purpose of the litigation, followed by destruction of the copies, and have presented the order to the court presiding over the dispute; or

(c)        The requesting party has requested a qualified protective order from the presiding court that will require the parties to only use the medical records for the purpose of the litigation, followed by destruction of the copies.

If the subpoena satisfies one of the above requirements, or the party requesting the medical records by subpoena subsequently satisfies one of the above requirements, the health care provider must provide the medical records, but only to the extent specifically identified in the subpoena.

If, however, the subpoena is not accompanied by any of the supporting documentation, the health care provider should not disclose the medical records but rather should immediately send a letter to the requesting third party informing them of the health care provider’s policy regarding the release of medical records.  See Appendix C for an example of a letter to the third party who is requesting the medical records.

 NOTE: All court orders, subpoenas, and warrants discussed in Sections IV, V, and VI above should be issued from a court of competent jurisdiction.  This means the court has jurisdiction over the health care provider and/or health care provider’s medical practice. For example, a Texas court does not have jurisdiction over a South Dakota medical practice.  A Texas court, therefore, cannot order or subpoena documents from a South Dakota medical practice and the proper method to address such an order or subpoena may get complicated.  In the event a health care provider receives a subpoena or court order from a jurisdiction in which the health care provider does not practice medicine, the health care provider should immediately contact legal counsel.

VII.          Requests from the Workers’ Compensation Court, Workers’ Compensation Insurance Carrier, Employers or Employees.

A health care provider shall disclose an injured or ill worker’s protected health information contained in a medical record without his or her authorization when requested for purposes of adjudicating the individual’s workers’ compensation claim. Medical records “relevant” to workers’ compensation cases are to be made available upon request to the patient’s employer, workers’ compensation insurance carrier, third‑party administrator of workers’ compensation benefits, and the Workers’ Compensation Court. 

No “relevant” information developed in connection with treatment or examination for which compensations is sought may be considered privileged.  If a requested disclosure is required by law or authorized by, and necessary to comply with, a workers’ compensation or similar law, the relevant documents must be provided.  If a medical practitioner or surgeon willfully fails to make any report required of the practitioner or surgeon, the Department of Labor may order the forfeiture of surgeon.

VIII.       “Super-Confidential” Medical Records: Records Pertaining to Mental Health, Psychotherapy Notes, Substance Abuse, Communicable Diseases and Sexually Transmitted Diseases (“STDs”).  

Medical records regarding mental health, substance abuse, communicable and sexually transmitted diseases, often called “super-confidential” records, are subject to a higher standard of confidentiality and release due to their highly sensitive and private nature. Below is a brief description of the requirements for disclosure of such sensitive material. In the alternative, a health care provider may elect to produce the otherwise properly requested record with the “super-confidential” portions of the medical record redacted. The redacted record can then be produced with an accompanying letter stating that the health care provider is in possession of additional records that cannot be released absent a court order or the patient’s written consent.

(i)         Mental Health.  “Mental health information” means oral, written, or recorded information which indicates the identity of an individual receiving professional services and which relates to the diagnosis, course, or treatment of the individual’s mental or emotional condition. Generally, mental health information may be disclosed to the patient or the patient’s authorized representative upon written request by the patient or the patient’s authorized representative.  Mental health records may also be disclosed to a third party pursuant to a written authorization signed by the patient or the patient’s authorized representative.  However, in either case, if the treating psychiatrist, psychologist, or mental health practitioner determines that release of the mental health records would not be in the best interests of the patient or that disclosure is reasonably likely to endanger the life or physical safety of the patient or another person, the mental health records may be withheld.  Psychological test material is confidential, is not subject to a subpoena, search warrant, or discovery process, and cannot be disclosed to the patient or any other party; but such information may be released to a psychologist upon written authorization from the patient or the patient’s authorized representative.

(ii)        Psychotherapy Notes.  HIPAA provides increased standards for release of a “psychotherapy notes” of a patient. “Psychotherapy notes” are defined as notes recorded by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session and that are separated from the rest of the individual’s medical record. A health care provider must obtain an authorization specific to psychotherapy notes for any use or disclosure of psychotherapy notes, except: (i) to hospitalize the patient for mental illness; (ii) court orders examination; (iii) use or disclosure by the health care provider to defend itself in a legal action or other proceeding brought by the individual; (iv) a disclosure require by law; or (v) to prevent a threat to a person or the public.

(iii)             Substance Abuse.  Substance abuse treatment records may be disclosed to the patient or the patient’s authorized representative upon written request by the patient or the patient’s authorized representative.  Substance abuse treatment records may also be disclosed to a third party pursuant to a written authorization signed by the patient or the patient’s authorized representative.  However, in either case, disclosure is subject to the health care provider’s determination that disclosure is not likely to endanger the life or physical safety of the patient or another person.  The identity of the person seeking substance abuse treatment is confidential, cannot be disclosed to law enforcement, and is not admissible in a legal proceeding unless authorized by the patient.  If the patient is a minor, the health care provider cannot disclose the minor patient’s identity to the parent without the minor patient’s consent.  Substance abuse treatment facility records and/or involuntary commitment records are confidential unless there is an emergency or the patient provides written authorization.  Absent an emergency or patient authorization, substance abuse treatment facility records and/or involuntary commitment records are not subject to a subpoena, search warrant, or discovery process.

(iv)      Federally Funded Substance Abuse Programs.  Substance abuse records of persons treated in federally funded programs may be disclosed to the patient or the patient’s authorized representative upon written request by the patient or the patient’s authorized representative.  Substance abuse treatment records of persons treated in federally funded programs may also be disclosed to a third party pursuant to a written authorization signed by the patient or the patient’s authorized representative, which contains the following special no re-disclosure clause:

This information has been disclosed to you from records protected by Federal confidentiality rules (42 CFR part 2).  The Federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR part 2.  A general authorization for the release of medical or other information is NOT sufficient for this purpose.  The Federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient.

Absent such an authorization, substance abuse records of persons treated in federally funded programs may only be disclosed pursuant to court order.  Wrongful disclosure of information of persons treated in federally funded substance abuse programs is a criminal violation and is subject to a $500 fine for a first time offense.

(v)       Communicable Diseases and Sexually Transmitted Diseases. Reports of communicable diseases, sexually transmitted diseases and HIV/AIDS, which are required to be given to the South Dakota Department of Human Services are confidential, unless the information is de-identified, and if not de-identified are not subject to a subpoena, search warrant, or discovery process.

(vi)      HIV Testing.  Any information, including reports and records, obtained, submitted, and maintained concerning HIV/AIDS testing and counseling is confidential and not subject to a subpoena, search warrant or discovery process, except such information may be disclosed upon a written release from the patient, subject to the health care provider’s determination that disclosure will not likely endanger the life or physical safety of the patient or another person.  Absent such an authorization, such information may only be disclosed pursuant to a special court order, which, among other things, shows a compelling need and protects the information from re-disclosure.  If a sexual offender is tested, the results may be disclosed to the victim, a counselor designated by the victim, the victim’s physician if requested by the victim, the parent, guardian, or custodian of the victim if the victim is a minor, or to a specified third party designated in a written, informed consent signed by the offender.

IX. Permissible Charges for Copying and Reproduction of Medical Records.

  A health care provider cannot charge a patient for access to the patient’s medical records.  However, the provider may charge a limited amount to the patient or the patient’s authorized representative for a copy of a medical record.  The health care provider may charge a patient or his or her authorized personal representative a “reasonable cost‑based fee” for copying.  A reasonable cost-based fee includes the cost of supplies and labor required to produce the copy. Postage may also be charged if the copy is to be sent to the patient or a personal representative via a mail delivery service. A provider may not charge a “handling” fee or charge for the costs of retrieving the record. 

However, if the health care provider and patient agree that the health care provider will provide the patient with a summary or explanation of the patient’s medical record, the health care provider may charge preparatory fees for the summary, so long as the parties agree to the preparatory fees up front. 

NOTE:  Although this Section IX has focused on the allowable fees for the production of documents, to the extent a health care provider is asked to provide expert testimony, deposition, or a narrative report on a specific subject, the health care provider may set his/her/its fees for services in advance pursuant to a contract or fee schedule.

 

Appendix A – Authorization Form

AUTHORIZATION TO USE AND/OR DISCLOSE HEALTH INFORMATION

            Authorization.  The undersigned hereby authorizes and its employees to use and/or disclose to  for the following purpose(s) (may state “per my request”)                                                                                                                                                                                                                                           

                                                                                                                                                        

                                                                                                                                              

 the following health information (may state “entire medical record”):

                                                                                                                                               

 

including, if applicable, the following health information related to testing, diagnosis, and/or treatment for (please initial applicable line): _________ HIV (AIDS virus), _________ sexually transmitted diseases, _________ mental health, or __________ drug and/or alcohol abuse.

            Conditions.  We may not condition your right to receive health care services from us upon your signing this authorization.  However, if the treatment to be provided is for research purposes, your failure to sign this authorization will prevent us from providing such treatment.

            Further Uses and Disclosures.  When we use or disclose your health information to other parties as you have instructed in this authorization, we will not have the ability to monitor whether your health information may be further used or disclosed by such parties.  In such a situation, your disclosed health information may no longer be protected by federal and state privacy laws.

            Expiration.  This authorization shall expire upon the earliest of (expiration date or event) or one hundred eighty (180) days from the date of this authorization.  After the expiration date, we will need to obtain a new authorization from you if required by law.

            Revocation.  You have the right to revoke this authorization at any time in accordance with our Notice of Privacy Practices.  When we receive your revocation, we will immediately stop using or disclosing the health information you authorized us to use and disclose in this authorization form.  Your revocation shall not apply to those uses and disclosures we made on your behalf pursuant to this authorization prior to the time we received your written revocation.

By signing below, you acknowledge receipt of a signed copy of this authorization.

____________________________________
Printed Name

____________________________________
Date

_____________________________________
Signature

 

Note:  If signed by someone other than the patient, we need written proof of your authority.

 

Appendix B – Letter to Third Party

Sample Letter to a Third Party Who is Requesting Disclosure of Protected Health Care Information for Use in a Judicial or Administrative Proceeding

 

Dear [Requesting Third Party],

 

We have received your [subpoena, discovery request, etc.] requesting that this office disclose to you certain health care records relating to [patient’s name].  Pursuant to the administrative simplification requirements of the Health Insurance Portability and Accountability Act of 1996 and other applicable state and federal laws, this office may not disclose the patient’s medical records for use in a judicial or administrative proceeding unless specified conditions have been met.

Following a review of your request, we have determined that you have not provided sufficient documentation.  It is the policy of this office to require the receipt of documentation satisfying at least one of the following three conditions prior to making any disclosures of individually identifiable health care information.

(1)               A written authorization from the patient that meets the requirements of 45 C.F.R. § 164.508(c);

(2)               An order from a court or administrative tribunal directing that this office disclose the requested materials; or

(3)               A written statement along with copies of all related documentation from you, the requesting party, that establishes:

(a)        The party requesting the information has made a good faith opportunity to provide written notice to the patient;

(b)        The notice included sufficient information about the litigation to permit the patient to raise an objection to the court or agency; and

(c)        The time for the Patient to raise objections to the court/tribunal has elapsed and either no objections were filed or the objection has been resolved in the requesting party’s favor.

Or

A written statement along with copies of all related documentation from you, the requesting party, that establishes:

(a)        The parties to the litigation have agreed to a “qualified protective order,” as defined by 45 C.F.R. § 164.512(e)(v), that has been presented to the court/administrative tribunal; or

(b)        The party seeking the disclosure has requested a qualified protective order, as defined above, from the court/administrative tribunal.

If you have questions about this office’s disclosure policy with regard to health information, please feel free to contact [Name of Appropriate Contact at Your Office] for further clarification.

Sincerely,

 

 

 

Appendix C – Letter to Patient

  Dear [Patient’s Name],

 

We value our relationship with you and want you to know that a high priority is the confidentiality of your medical record.  We want to let you know that we have received a subpoena from [requesting third party] requesting this office to provide a copy of your medical records.  For your convenience, we have attached a copy of the request to this letter. 

This office will be, absent your written objection, required to disclose the requested medical records if certain conditions are met.  You may already be aware of this request and have determined that such disclosure is not objectionable; nevertheless, the purpose of this letter is to give you an additional opportunity to object to all or a portion of the requested disclosure to [requesting third party].  If this office does not receive a written objection from you within ten (10) days of the date of this letter and [requesting third party] has satisfied the conditions necessary to allow disclosure under the applicable federal and state laws, this office will proceed with the disclosure as requested.

If you have any questions about this office’s disclosure policy with regard to your health care records, please feel free to contact [name and phone number of appropriate contact at your office]. 

Very truly yours,

    

© 2008 Parsonage Vandenack Williams LLC

 

For more information, contact info@pvwlaw.com

 

 

 

 

 

 

Medical Records Access Guide Michigan

 

Responding to requests for Medical Records for Use in
Judicial or Administrative Proceedings

Michigan

Parties to litigation often request a patient’s medical records for use as proof or lack thereof of a causal connection between an event and the purported injuries resulting from it. Requests for medical records for use in judicial or administrative proceedings generally take the form of an authorization from the patient consenting to release of the medical record, an order from the presiding court or administrative agencys or a subpoena from the opposing party in a civil proceeding.  This Medical Records Guide analyzes what is required of a health care provider when confronted with a request for medical records. Included in this guide are the requirements of a health care provider under the Health Insurance Portability and Accountability Act (HIPAA) and Michigan state law to the extent state law is not otherwise preempted by HIPAA.  However, if Michigan state laws provide greater privacy protections or privacy rights with respect to individually identifiable health information than HIPAA does, the state law will prevail.  Please note that there are special rules and regulations regarding records containing information related to mental health, psychotherapy notes, substance abuse treatment, and communicable and sexually transmitted diseases. As a result, specific sections have been included in this guide for medical records containing those types of information.

I.                   Patient Request for Access to or Copies of Medical Records.

Patients, or the patient’s designated representative, have a statutory right to review and make copies of any records maintained by a health care practitioner regarding the patient’s health history and treatment rendered. However, if the health care provider determines access would be reasonably likely to endanger the life or physical safety of the patient or another person, the health care provider may refuse to honor such right.  In addition, it should be noted that certain laboratory records are prohibited by law from being disclosed.

All requests by the patient for access to, or copies of, the patient’s medical record must be in writing. A health care provider must grant a patient access to or copies of his or her medical records within thirty (30) days of receipt of the request unless the requested information is not accessible or maintained onsite, in which event the health care provider shall take action no later than 60 days from the receipt of the request. If unable to act within 30 or 60 days as appropriate, the health care provider may extend the time by no more than 30 days and shall provide the patient with a  written statement of the reasons for the delay and the date by which the request will be completed.  

II.                Patient Authorization to Provide Medical Records to Third Parties.  

A patient may request that a health care provider make available the patient’s medical records to a third party. If the patient requests that the patient’s medical records be turned over to a third party, such as the patient’s attorney, and the health care provider determines that disclosure is not likely to endanger the life or physical safety of the patient or another person, the health care provider may provide the record if the patient has executed a valid written authorization. However, the only information that may be disclosed is the information specifically authorized for disclosure in the written authorization; do not over-disclose. When permitting the use of a patient authorization, a health care provider must use a HIPAA compliant authorization.  A sample HIPAA compliant authorization form is available at the end of these materials, marked as Appendix A.

 

III.             Requests For Deceased or Incapacitated Patients’ Medical Records.

If an individual is legally incapable of acting for him or herself, a health care provider can disclose the individual’s records only to the individual’s “personal representative.” A personal representative of a deceased person is defined as an executor, administrator, or other person who has authority to act on behalf of the deceased individual or the individual’s estate. Proof of appointment to such personal representative capacity can often be obtained from the county register in the county where probate of the estate has been commenced. When a patient lacks the legal capacity to give consent to medical treatment, a health care practitioner may release the patient’s medical records only to a personal representative of the patient who must be someone with authority under state law to make health care decisions for the incapacitated individual.  A health care provider may also disclose deceased patients’ medical records to funeral directors as needed, and to coroners or medical examiners to identify the deceased person, determine the cause of death, and perform other functions authorized by law.

IV.             Requests Via Court Order.  

A health care provider must disclose protected health information contained in a medical record to comply with a court order, including an order of an administrative tribunal or agency. Such disclosures must be limited to the protected health information expressly authorized by the order.   Again, do not over-disclose. If such an order requests the production of a patient’s medical record, authorization from the patient is not necessary and the health care provider must comply with the requirements of the order.   A health care provider should, but is not required to, notify the patient that the record must be disclosed prior to releasing the patient’s medical records pursuant to the order.

V.                Requests Via Criminal Subpoena, Search Warrant or Grand Jury Subpoena.

Criminal subpoenas, search warrants, and grand jury subpoenas that request a patient’s medical records raise numerous legal issues. If a health care provider receives a criminal subpoena, search warrant, or grand jury subpoena, then the health care provider should contact legal counsel immediately.

VI.             Requests Via Civil Subpoena, Discovery Request,  or Other Lawful Process 

It is common in civil litigation involving personal injury for a party to request a patient’s medical records through the use of a subpoena, discovery request or, other process without an accompanying order signed by a court or administrative tribunal or agency.  The most common request will be a subpoena, issued by a party’s attorney, for the medical records of a client.  The document will generally be captioned “Subpoena” or at least contain the term “Subpoena” in the caption, along with the names of two non-governmental opposing parties. The subpoena should also identify the court presiding over the action. Prior to disclosing any information, the provider should verify that the court is a court of competent jurisdiction and that the subpoena is signed by one of the parties’ attorneys or a notary public. 

Upon receipt of a subpoena, discovery request or other lawful process requesting a patient’s medical records, the health care provider should immediately send a letter to the patient informing the patient as to the existence of the subpoena, and giving the patient an opportunity to object to the release of his or her medical records.  See Appendix B for an example of such a letter to the patient.  Prior to providing any medical records, the health care provider must ensure that it has received, along with the subpoena, “satisfactory assurance” that the patient whose records are being requested has received notice of the subpoena or request and has not objected to the request. A health care provider should be satisfied that reasonable efforts have been made by the requesting party to ensure that the patient has been given notice of the request or that reasonable efforts have been made to secure a qualified protective order; one of the following three types of documentation will suffice for a showing of reasonable efforts:

(i)         An order from a court or administrative agency;

(ii)        A written, HIPAA compliant, authorization from the patient allowing disclosure of the medical record;

(iii)       A written statement from the requesting party and accompanying documentation demonstrating that:

(a)        The requesting party has made a good faith effort to provide written notice of the request to the patient, the notice had sufficient information to permit the patient to raise any objection to the court, the time for the patient to raise objections has lapsed and either no objections were filed or all objections filed have been resolved in favor of the requesting party;

(b)        All parties in the litigation have agreed to a qualified protective order that will require the parties to only use the medical records for the purpose of the litigation, followed by destruction of the copies, and have presented the order to the court presiding over the dispute; or

(c)        The requesting party has requested a qualified protective order from the presiding court that will require the parties to only use the medical records for the purpose of the litigation, followed by destruction of the copies.

If the subpoena satisfies one of the above requirements, or the party requesting the medical records by subpoena subsequently satisfies one of the above requirements, the health care provider must provide the medical records, but only to the extent specifically identified in the subpoena.

If, however, the subpoena is not accompanied by any of the supporting documentation, the health care provider should not disclose the medical records but rather should immediately send a letter to the requesting third party informing them of the health care provider’s policy regarding the release of medical records.  See Appendix C for an example of a letter to the third party who is requesting the medical records.

NOTE: All court orders, subpoenas, and warrants should be issued from a court of competent jurisdiction.  This means the court has jurisdiction over the health care provider and/or health care provider’s medical practice. For example, a Texas court does not have jurisdiction over a Nebraska medical practice.  A Texas court, therefore, cannot order or subpoena documents from a Nebraska medical practice and the proper method to address such an order or subpoena can get complicated.  In the event a health care provider receives a subpoena or court order from a jurisdiction in which the health care provider does not practice medicine, then the health care provider should immediately contact legal counsel.

VII.          Requests from the Workers’ Compensation Court, Workers’ Compensation Insurance Carrier, Employers or Employees.  

A health care provider can disclose an injured or ill patient’s protected health information contained in a medical record without his or her authorization when requested for purposes of adjudicating the individual’s workers’ compensation claim. Medical records “relevant” to workers’ compensation cases are to be made available upon request to the patient’s employer, workers’ compensation insurance carrier, third‑party administrator of workers’ compensation benefits, and the Workers’ Compensation Court. 

In addition, individuals do not have a right to request that a health care provider restrict a disclosure of protected health information about them for workers’ compensation purposes. If a requested disclosure is required by law or authorized by, and necessary to comply with, a workers’ compensation or similar law, the relevant documents must be provided.

VIII.       “Super-Confidential” Medical Records: Records Pertaining to Mental Health, Psychotherapy Notes, Substance Abuse, Communicable Diseases, and Sexually Transmitted Diseases (“STDs”).   

Medical records regarding mental health, substance abuse, communicable and sexually transmitted diseases, often called “super-confidential” records, are subject to a higher standard of confidentiality and release due to their highly sensitive and private nature. Below is a brief description of the requirements for disclosure of such sensitive material. In the alternative, a health care provider may elect to produce the otherwise properly requested record with the “super-confidential” portions of the medical record redacted. The redacted record can then be produced with an accompanying letter stating that the health care provider is in possession of additional records that cannot be released absent a court order or the patient’s written consent.

(i)         Mental Health.  “Mental health information” means oral, written, or recorded information which indicates the identity of an individual receiving professional services and which relates to the diagnosis, course, or treatment of the individual’s mental or emotional condition. Generally, mental health information may be disclosed to the patient or the patient’s authorized representative upon written request by the patient or the patient’s authorized representative.  Mental health records may also be disclosed to a third party pursuant to a written authorization signed by the patient or the patient’s authorized representative.  However, in either case, if the treating psychiatrist, psychologist, or mental health practitioner determines that release of the mental health records would not be in the best interests of the patient or that disclosure is reasonably likely to endanger the life or physical safety of the patient or another person, the mental health records may be withheld.  Psychological test material is confidential, is not subject to a subpoena, search warrant, or discovery process, and cannot be disclosed to the patient or any other party; but such information may be released to a psychologist upon written authorization from the patient or the patient’s authorized representative.

(ii)        Psychotherapy Notes.  HIPPA provides increased standards for release of “psychotherapy notes” on a patient. “Psychotherapy notes” are defined as notes recorded by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session and that are separated from the rest of the individual’s medical record. A health care provider must obtain an authorization specific to psychotherapy notes for any use or disclosure of psychotherapy notes, except: (i) use by the originator of the psychotherapy notes for treatment; (ii) use or disclosure by the health care provider for its own training programs; (iii) use or disclosure by the health care provider to defend itself in a legal action or other proceeding brought by the individual; (iv) a disclosure require by law; or (v) to prevent a threat to a person or the public.

(iii)       Substance Abuse.  Substance abuse treatment records can be disclosed to the patient or the patient’s authorized representative upon written request by the patient or the patient’s authorized representative.  Substance abuse treatment records can also be disclosed to a third party pursuant to a written authorization signed by the patient or the patient’s authorized representative.  However, in either case, disclosure is subject to the health care provider’s determination that disclosure is not likely to endanger the life or physical safety of the patient or another person.  The identity of the person seeking substance abuse treatment is confidential, cannot be disclosed to law enforcement, and is not admissible in a legal proceeding unless authorized by the patient.  If the patient is a minor, the health care provider cannot disclose the minor patient’s identity to the parent without the minor patient’s consent.  Substance abuse treatment facility records and/or involuntary commitment records are confidential unless there is an emergency or the patient provides written authorization.  Absent an emergency or patient authorization, substance abuse treatment facility records and/or involuntary commitment records are not subject to a subpoena, search warrant, or discovery process.

(iv)      Federally Funded Substance Abuse Programs.  Substance abuse records of persons treated in federally funded programs may be disclosed to the patient or the patient’s authorized representative upon written request by the patient or the patient’s authorized representative.  Substance abuse treatment records of persons treated in federally funded programs may also be disclosed to a third party pursuant to a written authorization signed by the patient or the patient’s authorized representative, if the authorization contains the following special clause pertaining to redisclosure:

This information has been disclosed to you from records protected by Federal confidentiality rules (42 CFR part 2).  The Federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR part 2.  A general authorization for the release of medical or other information is NOT sufficient for this purpose.  The Federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient.

Absent such an authorization, substance abuse records of persons treated in federally funded programs may only be disclosed pursuant to court order.  Wrongful disclosure of information of persons treated in federally funded substance abuse programs is a criminal violation.

(v)       Communicable Diseases and Sexually Transmitted Diseases. Reports of communicable diseases, sexually transmitted diseases and HIV/AIDS, which are required to be given to the Department of Public Health and Environment are confidential, unless the information is de-identified, and if not de-identified are not subject to subpoena, search warrant, or discovery process.

(vi)      HIV Testing.  Any information, including reports and records, obtained, submitted, and maintained concerning HIV/AIDS testing and counseling is confidential and not subject to a subpoena, search warrant or discovery process, except such information is de-identified or upon a written release from the patient, subject to the health care provider’s determination that disclosure will not likely endanger the life or physical safety of the patient or another person. 

IX. Permissible Charges for Copying and Reproduction of Medical Records.  

A health care provider cannot charge a patient for access to the patient’s medical records. However, the provider may charge a limited amount to the patient or the patient’s authorized representative for a copy of a medical record.  The health care provider may charge a patient or his or her authorized personal representative a “reasonable cost‑based fee” for copying.  A reasonable cost-based fee includes the cost of supplies and labor required to produce the copy. Postage may also be charged  if the copy is to be sent to the patient or a personal representative via a mail delivery service. A provider may not charge a “handling” fee or charge for the costs of retrieving the record. 

However, if the health care provider and patient agree that the health care provider will provide the patient with a summary or explanation of the patient’s medical record, the health care provider may charge preparatory fees for the summary, so long as the parties agree to the preparatory fees up front.

NOTE:  Although this Section IX has focused on the allowable fees for the production of documents, to the extent a health care provider is asked to provide expert testimony, deposition, or a narrative report on a specific subject, the health care provider may set his/her/its fees for services in advance pursuant to a contract or fee schedule.


 

Appendix A – Authorization Form

AUTHORIZATION TO USE AND/OR DISCLOSE HEALTH INFORMATION

            Authorization.  The undersigned hereby authorizes                                                                and its employees to use and/or disclose to                                                                                  for the following purpose(s) (may state “per my request”)     

                                                                                                                                                                                                                                      

                                                                                                                                                           

                                                                                                                                                           

 

the following health information (may state “entire medical record”):

                                                                                                                                               

                                                                                                                                               

                                                                                                                                              

                                                                                                                                                           

 

including, if applicable, the following health information related to testing, diagnosis, and/or treatment for (please initial applicable line): _________ HIV (AIDS virus), _________ sexually transmitted diseases, _________ mental health, or __________ drug and/or alcohol abuse.

            Conditions.  We may not condition your right to receive health care services from us upon your signing this authorization.  However, if the treatment to be provided is for research purposes, your failure to sign this authorization will prevent us from providing such treatment.

            Further Uses and Disclosures.  When we use or disclose your health information to other parties as you have instructed in this authorization, we will not have the ability to monitor whether your health information may be further used or disclosed by such parties.  In such a situation, your disclosed health information may no longer be protected by federal and state privacy laws.

            Expiration.  This authorization shall expire upon the earliest of (expiration date or event) or one hundred eighty (180) days from the date of this authorization.  After the expiration date, we will need to obtain a new authorization from you if required by law.

            Revocation.  You have the right to revoke this authorization at any time in accordance with our Notice of Privacy Practices.  When we receive your revocation, we will immediately stop using or disclosing the health information you authorized us to use and disclose in this authorization form.  Your revocation shall not apply to those uses and disclosures we made on your behalf pursuant to this authorization prior to the time we received your written revocation.

By signing below, you acknowledge receipt of a signed copy of this authorization.

 

____________________________________
Printed Name

____________________________________
Date

_____________________________________
Signature

 

Note:  If signed by someone other than the patient, we need written proof of your authority.

Appendix B – Letter to Third Party

Sample Letter to a Third Party Who is Requesting Disclosure of Protected Health Care Information for Use in a Judicial or Administrative Proceeding

 

Dear [Requesting Third Party],

 

We have received your [subpoena, discovery request, etc.] requesting that this office disclose to you certain health care records relating to [patient’s name].  Pursuant to the administrative simplification requirements of the Health Insurance Portability and Accountability Act of 1996 and other applicable state and federal laws, this office may not disclose the patient’s medical records for use in a judicial or administrative proceeding unless specified conditions have been met.

Following a review of your request, we have determined that you have not provided sufficient documentation.  It is the policy of this office to require the receipt of documentation satisfying at least one of the following three conditions prior to making any disclosures of individually identifiable health care information.

(1)               A written authorization from the patient that meets the requirements of 45 C.F.R. § 164.508(c);

(2)               An order from a court or administrative tribunal directing that this office disclose the requested materials; or

(3)               A written statement along with copies of all related documentation from you, the requesting party, that establishes:

(a)        The party requesting the information has made a good faith opportunity to provide written notice to the patient;

(b)        The notice included sufficient information about the litigation to permit the patient to raise an objection to the court or agency; and

(c)        The time for the Patient to raise objections to the court/tribunal has elapsed and either no objections were filed or the objection has been resolved in the requesting party’s favor.

Or

A written statement along with copies of all related documentation from you, the requesting party, that establishes:

(a)        The parties to the litigation have agreed to a “qualified protective order,” as defined by 45 C.F.R. § 164.512(e)(v), that has been presented to the court/administrative tribunal; or

(b)        The party seeking the disclosure has requested a qualified protective order, as defined above, from the court/administrative tribunal.

If you have questions about this office’s disclosure policy with regard to health information, please feel free to contact [Name of Appropriate Contact at Your Office] for further clarification.

                                                                        Sincerely,

 

Appendix C – Letter to Patient

 

 

 

 

 

 

 

 

Dear [Patient’s Name],

 

We value our relationship with you and want you to know that a high priority is the confidentiality of your medical record.  We want to let you know that we have received a subpoena from [requesting third party] requesting this office to provide a copy of your medical records.  For your convenience, we have attached a copy of the request to this letter. 

This office will be, absent your written objection, required to disclose the requested medical records if certain conditions are met.  You may already be aware of this request and determined that such disclosure is not objectionable; nevertheless, the purpose of this letter is to give you an additional opportunity to object to all or a portion of the requested disclosure to [requesting third party].  If this office does not receive a written objection from you within ten (10) days of the date of this letter and [requesting third party] has satisfied the conditions necessary to allow disclosure under the applicable federal and state laws, this office will proceed with the disclosure as requested.

If you have any questions about this office’s disclosure policy with regard to your health care records, please feel free to contact [name and phone number of appropriate contact at your office]. 

Very truly yours,

 

 

  

   

 

 

 

 

 

 

© 2008 Parsonage Vandenack Williams LLC

 

For more information, contact info@pvwlaw.com

 

  

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Medical Records Access Guide Colorado

 

 

Responding to requests for Medical Records for Use in
Judicial or Administrative Proceedings

Colorado

Parties to civil litigation often request a patient’s medical records for use as proof or lack thereof of a causal connection between an event and the purported injuries resulting therefrom. Requests for medical records for use in judicial or administrative proceedings generally take the form of an authorization from the patient consenting to release of the medial record, an order from the presiding court or administrative agency or a subpoena from the opposing party in a civil proceeding.  The following article analyzes what is required of a health care provider when confronted with a request for medical records. Included in this guide are the requirements of a health care provider under the Health Insurance Portability and Accountability Act (HIPAA) and Colorado state law when not otherwise preempted by HIPAA.  However, if Colorado state laws provide greater privacy protections or privacy rights with respect to individually identifiable health information than HIPAA does, the state law will prevail. Please note that there are special rules and regulation regarding records containing information related to mental health, psychotherapy notes, substance abuse treatment, and communicable and sexually transmitted diseases. As a result, specific sections have been included for medical records containing those various types of information.

I.                   Patient Request for Access to or Copies of Medical Records. 

Patients, or the patient’s designated representative, have a statutory right to review and make copies of any records maintained by a health care practitioner regarding the patient’s health history and treatment rendered. However, if the health care provider determines access would be reasonably likely to endanger the life or physical safety of the patient or another person, the health care provider may refuse to honor such right.  In addition, it should be noted that certain laboratory records are prohibited by law from being disclosed.

All requests by the patient for access to, or copies of, the patient’s medical record must be in writing. A health care provider must grant a patient access to or copies of his or her medical records within thirty (30) days of receipt of the request unless the requested information is not accessible or maintained onsite, in which event the health care provider shall take action no later than 60 days from the receipt of the request. If unable to act within 30 or 60 days as appropriate, the health care provider may extend the time by no more than 30 days and shall provide the patient with a  written statement of the reasons for the delay and the date by which the request will be completed. 

II.                Patient Authorization to Provide Medical Records to Third Parties.  

A patient may request that a health care provider make available the patient’s medical records to a third party. If the patient requests that the patient’s medical records be turned over to a third party, such as the patient’s attorney, and the health care provider determines that disclosure is not likely to endanger the life or physical safety of the patient or another person, the health care provider may provide the record if the patient has executed a valid written authorization. However, the only information that may be disclosed is the information specifically authorized for disclosure in the written authorization; do not over-disclose. When permitting the use of a patient authorization, a health care provider must use a HIPAA compliant authorization.  A sample HIPAA compliant authorization form is available at the end of these materials, marked as Appendix A.

 

III.             Requests For Deceased or Incapacitated Patients’ Medical Records.

If an individual is legally incapable of acting for him or herself, a health care provider may disclose the individual’s records only to the individual’s “personal representative.” A personal representative is defined as an executor, administrator, or other person who has authority to act on behalf of the deceased individual or the individual’s estate. Proof of appointment to such personal representative capacity can often be obtained from the county register in the county where probate of the estate has been commenced. Likewise, when a patient lacks the legal capacity to give consent to medical treatment, a health care practitioner may release the patient’s medical records only to a personal representative of the patient. For purposes of an incapacitated individual, a personal representative must be someone that has authority under state law to make health care decisions for the incapacitated individual.  A health care provider may also disclose deceased patients’ medical records to funeral directors as needed, and to coroners or medical examiners to identify the deceased person, determine the cause of death, and perform other functions authorized by law.

IV.             Requests Via Court Order.   

A health care provider must disclose protected health information contained in a medical record to comply with a court order, including an order of an administrative tribunal or agency. Such disclosures must be limited to the protected health information expressly authorized by the order; again, do not over-disclose. If a court order requests the production of a patient’s medical record, authorization from the patient is not necessary and the health care provider must comply with the requirements of the order.   A health care provider should, but is not required to, notify the patient that the record must be disclosed prior to releasing the patient’s medical records pursuant to the order.

V.                Requests Via Criminal Subpoena, Search Warrant or Grand Jury Subpoena.

Criminal subpoenas, search warrants, and grand jury subpoenas that request a patient’s medical records raise numerous legal issues. If a health care provider receives a criminal subpoena, search warrant or a grand jury subpoena, the health care provider should contact legal counsel immediately.

VI.             Requests Via Civil Subpoena, Discovery Request,  or Other Lawful Process 

It is common in civil litigation matters involving personal injuries for a party to request a patient’s medical records through the use of a subpoena, discovery request or other lawful process without an accompanying order signed by a court or administrative tribunal.  The most common request will be a subpoena issued by a party’s attorney for the medical records of a client.  The document will generally be captioned “Subpoena” or at least contain the term “Subpoena” in the caption, along with the names of two non-governmental opposing parties. The subpoena should also identify the court presiding over the action. Prior to disclosing any information, the provider should verify that the court is a court of competent jurisdiction and that the subpoena is signed by one of the parties’ attorneys or a notary public. 

Upon receipt of a subpoena, discovery request or other lawful process requesting a patient’s medical records, the health care provider should immediately send a letter to the patient informing the patient as to the existence of the subpoena, and giving the patient an opportunity to object to the release of the patient’s medical records.  See Appendix B for an example of such a letter to the patient.  Prior to providing any medical records, the health care provider must ensure that it has received, along with the subpoena, “satisfactory assurance” that the patient whose records are being requested has received notice of the subpoena or request and has not objected to the request. A health care provider should be satisfied that reasonable efforts have been made by the requesting party to ensure that the patient has been given notice of the request or that reasonable efforts have been made to secure a qualified protective order; one of the following three types of documentation will suffice for a showing of reasonable efforts:

(i)         An order from a court or administrative agency;

(ii)        A written, HIPAA compliant, authorization from the patient allowing disclosure of the medical record;

(iii)       A written statement from the requesting party and accompanying documentation demonstrating that:

(a)        The requesting party has made a good faith effort to provide written notice of the request to the patient, the notice had sufficient information to permit the patient to raise any objection to the court, the time for the patient to raise objections has lapsed and either no objections were filed or all objections filed have been resolved in favor of the requesting party;

(b)        All parties in the litigation have agreed to a qualified protective order that will require the parties to only use the medical records for the purpose of the litigation, followed by destruction of the copies, and have presented the order to the court presiding over the dispute; or

(c)        The requesting party has requested a qualified protective order from the presiding court that will require the parties to only use the medical records for the purpose of the litigation, followed by destruction of the copies.

If the subpoena satisfies one of the above requirements, or the party requesting the medical records by subpoena subsequently satisfies one of the above requirements, the health care provider must provide the medical records, but only to the extent specifically identified in the subpoena.

If, however, the subpoena is UnotU accompanied by any of the supporting documentation, the health care provider should not disclose the medical records but rather should immediately send a letter to the requesting third party informing them of the health care provider’s policy regarding the release of medical records.  See Appendix C for an example of a letter to the third party who is requesting the medical records.

NOTE: All court orders, subpoenas, and warrants discussed in Sections IV, V, and VI above should be issued from a court of competent jurisdiction.  This means the court has jurisdiction over the health care provider and/or health care provider’s medical practice. For example, a Texas court does not have jurisdiction over a Nebraska medical practice.  A Texas court, therefore, cannot order or subpoena documents from a Nebraska medical practice and the proper method to address such an order or subpoena may get complicated.  In the event a health care provider receives a subpoena or court order from a jurisdiction in which the health care provider does not practice medicine, the health care provider should immediately contact legal counsel.

VII.          Requests from the Workers’ Compensation Court, Workers’ Compensation Insurance Carrier, Employers or Employees.  

A health care provider may disclose an injured or ill worker’s protected health information contained in a medical record without his or her authorization when requested for purposes of adjudicating the individual’s workers’ compensation claim. Medical records “relevant” to workers’ compensation cases are to be made available upon request to the patient’s employer, workers’ compensation insurance carrier, third‑party administrator of workers’ compensation benefits, and the Workers’ Compensation Court. 

In addition, individuals do not have a right to request that a health care provider restrict a disclosure of protected health information about them for workers’ compensation purposes. If a requested disclosure is required by law or authorized by, and necessary to comply with, a workers’ compensation or similar law, the relevant documents must be provided.

VIII.       “Super-Confidential” Medical Records: Records Pertaining to Mental Health, Psychotherapy Notes, Substance Abuse, Communicable Diseases and Sexually Transmitted Diseases (“STDs”).   

Medical records regarding mental health, substance abuse, communicable and sexually transmitted diseases, often called “super-confidential” records, are subject to a higher standard of confidentiality and release due to their highly sensitive and private nature. Below is a brief description of the requirements for disclosure of such sensitive material. In the alternative, a health care provider may elect to produce the otherwise properly requested record with the “super-confidential” portions of the medical record redacted. The redacted record can then be produced with an accompanying letter stating that the health care provider is in possession of additional records that cannot be released absent a court order or the patient’s written consent.

(i)         UMental HealthU.  “Mental health information” means oral, written, or recorded information which indicates the identity of an individual receiving professional services and which relates to the diagnosis, course, or treatment of the individual’s mental or emotional condition. Generally, mental health information may be disclosed to the patient or the patient’s authorized representative upon written request by the patient or the patient’s authorized representative.  Mental health records may also be disclosed to a third party pursuant to a written authorization signed by the patient or the patient’s authorized representative.  However, in either case, if the treating psychiatrist, psychologist, or mental health practitioner determines that release of the mental health records would not be in the best interests of the patient or that disclosure is reasonably likely to endanger the life or physical safety of the patient or another person, the mental health records may be withheld.  Psychological test material is confidential, is not subject to a subpoena, search warrant, or discovery process, and cannot be disclosed to the patient or any other party; but such information may be released to a psychologist upon written authorization from the patient or the patient’s authorized representative.

(ii)        UPsychotherapy Notes.U  HIPAA provides increased standards for release of a “psychotherapy notes” of a patient. “Psychotherapy notes” are defined as notes recorded by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session and that are separated from the rest of the individual’s medical record. A health care provider must obtain an authorization specific to psychotherapy notes for any use or disclosure of psychotherapy notes, except: (i) use by the originator of the psychotherapy notes for treatment; (ii) use or disclosure by the health care provider for its own training programs; (iii) use or disclosure by the health care provider to defend itself in a legal action or other proceeding brought by the individual; (iv) a disclosure require by law; or (v) to prevent a threat to a person or the public.

(iii)       USubstance AbuseU.  Substance abuse treatment records may be disclosed to the patient or the patient’s authorized representative upon written request by the patient or the patient’s authorized representative.  Substance abuse treatment records may also be disclosed to a third party pursuant to a written authorization signed by the patient or the patient’s authorized representative.  However, in either case, disclosure is subject to the health care provider’s determination that disclosure is not likely to endanger the life or physical safety of the patient or another person.  The identity of the person seeking substance abuse treatment is confidential, cannot be disclosed to law enforcement, and is not admissible in a legal proceeding unless authorized by the patient.  If the patient is a minor, the health care provider cannot disclose the minor patient’s identity to the parent without the minor patient’s consent.  Substance abuse treatment facility records and/or involuntary commitment records are confidential unless there is an emergency or the patient provides written authorization.  Absent an emergency or patient authorization, substance abuse treatment facility records and/or involuntary commitment records are not subject to a subpoena, search warrant, or discovery process.

(iv)      UFederally Funded Substance Abuse ProgramsU.  Substance abuse records of persons treated in federally funded programs may be disclosed to the patient or the patient’s authorized representative upon written request by the patient or the patient’s authorized representative.  Substance abuse treatment records of persons treated in federally funded programs may also be disclosed to a third party pursuant to a written authorization signed by the patient or the patient’s authorized representative, which contains the following special no re-disclosure clause:

This information has been disclosed to you from records protected by Federal confidentiality rules (42 CFR part 2).  The Federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR part 2.  A general authorization for the release of medical or other information is NOT sufficient for this purpose.  The Federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient.

Absent such an authorization, substance abuse records of persons treated in federally funded programs may only be disclosed pursuant to court order.  Wrongful disclosure of information of persons treated in federally funded substance abuse programs is a criminal violation and is subject to a $500 fine for a first time offense. 

(v)       UCommunicable Diseases and Sexually Transmitted DiseasesU. Reports of communicable diseases, sexually transmitted diseases and HIV/AIDS, which are required to be given to the Department of Public Health and Environment are confidential, unless the information is de-identified, and if not de-identified are not subject to a subpoena, search warrant, or discovery process.

(vi)      UHIV TestingU.  Any information, including reports and records, obtained, submitted, and maintained concerning HIV/AIDS testing and counseling is confidential and not subject to a subpoena, search warrant or discovery process, except such information is de-identified or upon a written release from the patient, subject to the health care provider’s determination that disclosure will not likely endanger the life or physical safety of the patient or another person. 

IX. Permissible Charges for Copying and Reproduction of Medical Records.  

A health care provider cannot charge a patient for access to the patient’s medical records. However, the provider may charge a limited amount to the patient or the patient’s authorized representative for a copy of a medical record.  The health care provider may charge a patient or his or her authorized personal representative a “reasonable cost‑based fee” for copying.  A reasonable cost-based fee includes the cost of supplies and labor required to produce the copy. Postage may also be charged  if the copy is to be sent to the patient or a personal representative via a mail delivery service. A provider may not charge a “handling” fee or charge for the costs of retrieving the record. 

However, if the health care provider and patient agree that the health care provider will provide the patient with a summary or explanation of the patient’s medical record, the health care provider may charge preparatory fees for the summary, so long as the parties agree to the preparatory fees up front.

NOTE:  Although this Section IX has focused on the allowable fees for the production of documents, to the extent a health care provider is asked to provide expert testimony, deposition, or a narrative report on a specific subject, the health care provider may set his/her/its fees for services in advance pursuant to a contract or fee schedule.


 

UAppendix A – Authorization Form

AUTHORIZATION TO USE AND/OR DISCLOSE HEALTH INFORMATION

            UAuthorizationU.  The undersigned hereby authorizes and its employees to use and/or disclose to for the for the following health information (may state “entire medical record”):

U                                                                                                                                               

U                                                                                                                                               

U                                                                                                                                               

                                                                                                                                                           

 

including, if applicable, the following health information related to testing, diagnosis, and/or treatment for (please initial applicable line): _________ HIV (AIDS virus), _________ sexually transmitted diseases, _________ mental health, or __________ drug and/or alcohol abuse.

            UConditionsU.  We may not condition your right to receive health care services from us upon your signing this authorization.  However, if the treatment to be provided is for research purposes, your failure to sign this authorization will prevent us from providing such treatment.

            UFurther Uses and DisclosuresU.  When we use or disclose your health information to other parties as you have instructed in this authorization, we will not have the ability to monitor whether your health information may be further used or disclosed by such parties.  In such a situation, your disclosed health information may no longer be protected by federal and state privacy laws.

            UExpirationU.  This authorization shall expire upon the earliest of U(expiration date or event)U or one hundred eighty (180) days from the date of this authorization.  After the expiration date, we will need to obtain a new authorization from you if required by law.

            URevocationU.  You have the right to revoke this authorization at any time in accordance with our Notice of Privacy Practices.  When we receive your revocation, we will immediately stop using or disclosing the health information you authorized us to use and disclose in this authorization form.  Your revocation shall not apply to those uses and disclosures we made on your behalf pursuant to this authorization prior to the time we received your written revocation.

By signing below, you acknowledge receipt of a signed copy of this authorization.

 

____________________________________
Printed Name

____________________________________
Date

_____________________________________
Signature

 

Note:  If signed by someone other than the patient, we need written proof of your authority.

 

UAppendix B – Letter to Third Party

USample Letter to a Third Party Who is Requesting Disclosure of Protected Health Care Information for Use in a Judicial or Administrative Proceeding

 

Dear [Requesting Third Party],

 

We have received your [subpoena, discovery request, etc.] requesting that this office disclose to you certain health care records relating to [patient’s name].  Pursuant to the administrative simplification requirements of the Health Insurance Portability and Accountability Act of 1996 and other applicable state and federal laws, this office may not disclose the patient’s medical records for use in a judicial or administrative proceeding unless specified conditions have been met.

Following a review of your request, we have determined that you have not provided sufficient documentation.  It is the policy of this office to require the receipt of documentation satisfying at least one of the following three conditions prior to making any disclosures of individually identifiable health care information.

(1)               A written authorization from the patient that meets the requirements of 45 C.F.R. § 164.508(c);

(2)               An order from a court or administrative tribunal directing that this office disclose the requested materials; or

(3)               A written statement along with copies of all related documentation from you, the requesting party, that establishes:

(a)        The party requesting the information has made a good faith opportunity to provide written notice to the patient;

(b)        The notice included sufficient information about the litigation to permit the patient to raise an objection to the court or agency; and

(c)        The time for the Patient to raise objections to the court/tribunal has elapsed and either no objections were filed or the objection has been resolved in the requesting party’s favor.

Or

A written statement along with copies of all related documentation from you, the requesting party, that establishes:

(a)        The parties to the litigation have agreed to a “qualified protective order,” as defined by 45 C.F.R. § 164.512(e)(v), that has been presented to the court/administrative tribunal; or

(b)        The party seeking the disclosure has requested a qualified protective order, as defined above, from the court/administrative tribunal.

If you have questions about this office’s disclosure policy with regard to health information, please feel free to contact [Name of Appropriate Contact at Your Office] for further clarification.

                                                                        Sincerely,

 

UAppendix C – Letter to Patient

 

 

 

 

 

 

 

 

Dear [Patient’s Name],

 

We value our relationship with you and want you to know that a high priority is the confidentiality of your medical record.  We want to let you know that we have received a subpoena from [requesting third party] requesting this office to provide a copy of your medical records.  For your convenience, we have attached a copy of the request to this letter. 

This office will be, absent your written objection, required to disclose the requested medical records if certain conditions are met.  You may already be aware of this request and have determined that such disclosure is not objectionable; nevertheless, the purpose of this letter is to give you an additional opportunity to object to all or a portion of the requested disclosure to [requesting third party].  If this office does not receive a written objection from you within ten (10) days of the date of this letter and [requesting third party] has satisfied the conditions necessary to allow disclosure under the applicable federal and state laws, this office will proceed with the disclosure as requested.

If you have any questions about this office’s disclosure policy with regard to your health care records, please feel free to contact [name and phone number of appropriate contact at your office]. 

Very truly yours,

 

          

 

 

 

 

 

© 2008 Parsonage Vandenack Williams LLC

 

For more information, contact info@pvwlaw.com