Although Congress has yet to pass national medical record privacy standards as proposed by the U.S. Department of Health and Human Services, keeping patient records confidential is the law nationwide.

In addition to standard state and federal constitutional privacy rights, there are stringent state and federal laws that govern medical records and protect sensitive information, such as HIV test results, mental health records, pregnancy termination and substance abuse treatment records.

Physicians can and should familiarize themselves with the fine points of federal and state confidentiality laws by contacting their state medical association (see listing on back page).

Generally speaking, medical information may not be disclosed to anyone without the patient’s signed authorization. However, there are exceptions to this under certain limited circumstances.

The basic rule regarding medical records is this: Keep them confidential. The reason is simple: Patients would likely withhold important personal information from their physician, or resist testing or treatment, without a reasonable guarantee that their records would remain protected under the doctor-patient privilege.

Outlined in this issue are common caveats physicians must consider when responding to requests for copies of medical records.

Determining Access
Releasing patient information without the patient’s signed consent is against the law. However, there are situations in which physicians are legally compelled to release information, or are granted the discretion to release information, without patient authorization.

The decision to release medical information depends on who is making the request, the circumstances and any confidentiality concerns surrounding the information itself.

Below are guidelines governing the release of medical records to four frequent requestors: patients, physicians, law enforcement agencies and attorneys.

Requests by Patients
Most states legally assure patients access to the information in their medical records. The rules vary from state to state, and patients’ access to their mental health records in particular may be limited by special statute. Further, patients’ legal guardians or conservators, and deceased patients’ beneficiaries or representatives, are generally granted access to (as well as the authority to release) patients’ medical records.

In most cases, minor patients have the right to access their medical records with respect to any treatment to which they can legally consent. Conversely, the minor patient’s parent or guardian usually is denied the right to access records regarding such treatment without the minor’s signed authorization. The scope of treatments in which a minor has consent capacity is limited and confined mainly to sexually transmitted diseases and pregnancy termination. A parent or guardian retains access to a minor’s records for treatment to which the parent or guardian has consented.

When it comes to charges for reproducing medical records, physicians may bill “reasonable costs” to anyone authorized to receive the records. The costs are generally set by state statute and cannot be exceeded.

It is also important to note that physicians cannot refuse a patient access to his or her records because of an outstanding bill for medical services.

Requests by Physicians
As a rule, a physician cannot grant another physician access to patients’ medical records. Only the patient can authorize the release of records from one physician to another by signing an authorization form. While a general form is sufficient for the release of most medical records, it does not cover HIV, psychiatric and substance abuse records (see sample form on adjacent page). The patient must sign a specific authorization for the release of those records to a third party, including another physician.

In some states, however, there are exceptions. Specific state laws exist that grant physicians discretion to disclose patients’ HIV information to certain parties, such as the following:

• medical personnel who have undergone significant exposure to the patient during the course of their duties
• the patient’s sex partner(s)
• individuals with whom the patient has shared needles.

Physicians should keep in mind that the patient’s privacy is paramount. If questions or concerns arise, insureds should call a SCPIE risk manager or their state medical association for suggestions on how to proceed.

Requests by Law Enforcement Agencies
Law enforcement officers may not access medical records without a valid court order, search warrant or the patient’s or patient representative’s signed authorization, except under extremely limited circumstances.

The exceptions include results of examinations requested by law enforcement agencies (e.g., blood alcohol levels) and records regarding rape or sexual assault, child abuse or elder abuse. (In fact, mandatory reporting requirements obligate physicians who suspect that a patient is the victim of child abuse or elder abuse to share any portion of the patient’s record that would aid an investigation.) When responding to a search warrant, the physician should do the following:

• Ask the officer or prosecutor in charge for credentials, a business card and a copy of the search warrant.
• Document the time the warrant was served and carefully review it to ensure that only the areas specified are searched.
• Take detailed notes on what is searched and seized, and request an inventory of seized items.
• Refrain from interfering with the search in any way.

Requests by Attorneys Subpoenas
When responding to a subpoena for medical records, the physician or person in charge of the records should review the document to ensure that it is valid, and to confirm which records are being sought and by whom. All subpoenas should be accompanied by an affidavit and documentation of patient notification.

It is not necessary for the physician to obtain patient authorization to release medical records as long as the requesting party has properly notified the patient or his or her attorney. The exceptions are, again, records regarding HIV test results, substance abuse treatment and psychiatric treatment. The release of that information typically requires either specific written authorization from the patient or a court order. If a physician is served with a valid subpoena for legally accessible records but the patient objects to releasing them, the physician should ask the patient for written verification that he or she is filing a motion with the court to quash the subpoena. The patient should be advised that unless written notice is provided by the date the records are due to be produced, the physician will have to comply with the subpoena. Written notification may consist of a letter from the patient stating his or her objection to the release of records, or a copy of the motion the patient filed with the court.

The following questions can help determine the validity of a subpoena for medical records. If the answer to any of the questions is no, the subpoena may not be valid and the records should not be produced. In that case, the physician should contact the requesting party to discuss the issue and document everything in writing.

• Did a state court issue the subpoena?
• Is it accompanied by a completed affidavit that describes the exact documents to be produced?
• Does the affidavit explain how the records are relevant to the lawsuit and why there is “good cause” for their production?
• Does the affidavit also acknowledge that the requested documents are under the physician’s control?
• Is written authorization from the patient or a proof of service attached to the subpoena to verify that the patient or his or her attorney is aware of the request?

Prelitigation Requests
Physicians are also obligated to honor written requests for medical records made by attorneys prior to litigation, provided the requests are accompanied by signed authorizations from the patient or patient’s representatives. Since such a request often signals an impending lawsuit, the insured should contact a SCPIE risk manager immediately.

Physicians who refuse prelitigation requests to release records will likely have to explain their reasons in court. If they fail to establish substantial justification for their refusal, they will be forced to produce the records and likely be held liable for expenses incurred in the suit to enforce the law.

Conclusion
Patient confidentiality is almost always nonnegotiable. With very few exceptions, physicians are legally and ethically bound to maintain the trust and strict confidence of the doctor-patient relationship. On the rare occasion when a more significant concern supersedes confidentiality, the physician must release only the portion of the patient’s record that is relevant to the issue at hand.

Careful review of the state and federal laws that protect patient confidentiality is recommended to help physicians avoid an accidental breach that could lead to a lawsuit and/or disciplinary action. SCPIE risk managers are available around the clock at 800/585-7799 for clarification on questions concerning confidentiality laws, requestor rights and physician responsibility.

Authorization for Release of Medical Records

Patient Name
Date of Birth
SSN

I request and authorize:
[name and address of physician or organization RELEASING the
information]

to release medical information and records concerning the history,
treatment, examinations and/or hospitalizations from [date] through
[date] to:

[name and address of physician, individual or entity RECEIVING the
information].

I understand that this information will be used for [reason information
needed].

I understand that this form does NOT authorize the release of any
medical information concerning HIV test results and/or treatments,
sexually transmitted diseases, psychiatric care, psychological assessment
and/or treatment, drug or alcohol abuse treatment or pregnancy
termination.

I understand that the release or transfer of the information specified
above to any person or entity not specified above is prohibited.

I understand that I may revoke this consent at any time except to the
extent that action has already been taken and that it will expire
[number of months] months from the date indicated below.

Signature of patient 				Date

Signature of patient’s legal representative (if applicable)

Legal representative’s relationship to patient

Sample
Sample

Selected State Medical Associations

Medical Association of the State of Alabama
www.masalink.org
334/263-6441

Arizona Medical Association
www.armadoc.com
602/246-8901

California Medical Association
www.cmanet.org
415/882-0900

Colorado Medical Society
www.cms.org
720/859-1001

Connecticut State Medical Society
www.csms.org
203/865-0587

Florida Medical Association
www.fmaonline.org
850/224-6496

Medical Association of Georgia
www.mag.org
404/876-7535

Illinois State Medical Society
www.isms.org
312/782-1654

Kentucky Medical Association
www.kyma.org
502/426-6200

Louisiana State Medical Society
www.lsms.org
225/763-8500

Minnesota Medical Association
www.mnmed.org
612/378-1875

Missouri State Medical Association
www.msma.org
573/636-5151

Nevada State Medical Association
www.nsmadocs.org
702/798-6711

Medical Society of New Jersey
www.msnj.org
609/896-1766

New Mexico Medical Society
www.nmms.org/nmms
505/828-0237

Ohio State Medical Association
www.osma.org
614/527-6762

Oklahoma State Medical Association
www.osmaonline.org
405/843-9571

Oregon Medical Association
www.ormedassoc.org
503/226-1555

Texas Medical Association
www.texmed.org
512/370-1300

Utah Medical Association
www.utahmed.org
801/355-7477

Washington State Medical Association
www.wsma.org
206/441-9762