| Access to Confidential Records
This page summarizes Federal and Washington State laws that
pertain to privacy of medical records
HIPAA
HIPAA is the Health Insurance Portability and Accountability Act.
The privacy sections of HIPAA are codified in federal regulations
in Title 45 of the Code of Federal Regulations at Section 164,
Subpart E. The standard notation for such references is 45CFR164.
This will be observed below.
In the way of things the federal regulations themselves do not
use the acronym HIPAA at all, that being the title of the parent
legislation. Regulations are made by the Executive branch, HIPAA is
legislation passed by Congress. Go figure.
The following summarizes sections of HIPAA and Washington State
laws and regulations that apply to authorization and receipt of
confidential information by individuals and their agents. HIPAA
refers to a guardian, Attorney-in Fact or person otherwise having
authority to act on behalf of another as a "Personal
Representative" (PR).
The regulation is very detailed. The information below can be a
starting point, but not a substitute for looking at the rule itself
HIPAA privacy rules are mostly about transfers of information within
and among large medical institutions, medical providers, insurance
companies, clearinghouses, government entities and the like, and was
largely intended to prevent the abuse of privacy rights in these
transfers. This page does not address these issues much, but is
focused on informing individuals and PRs as to their rights to
receive information..
For the most part, HIPAA presents almost no new obstacles to
access to information by PRs (at least this is so in Washington
State) but there are many obstacles created by misinterpretations of
HIPAA, or just plain paranoia, on the part of medical providers. The
purpose of this page is to allow advocates to cite chapter and verse
in such situations.
All statutes and regulations are subject to periodic change. The
rules cited below are those that were effective on August 14, 2002.
Users should check current versions of the rule, using this link: HIPAA
or this link to the individual sections HIPAA
be sure to scroll down to sub-part E
| Access
to Records by Personal Representative |
45CFR164.502(g)(1)
Standard: personal representatives. As specified in this
paragraph, a covered entity must, except as provided in
paragraphs (g)(3) and (g)(5) of this section, treat a personal
representative as the individual for purposes of this
subchapter. (2) Implementation specification: adults and
emancipated minors. If under applicable law a person has
authority to act on behalf of an individual who is an adult or
an emancipated minor in making decisions related to health
care, a covered entity must treat such person as a personal
representative under this subchapter, with respect to
protected health information relevant to such personal
representation;
[Emphasis added] [Paragraph (g)(3) refers to some
situations re: un-emancipated minors. Paragraph (g)(5)
refers to abuse or neglect situations. Paragraph (g)(4) refers
to deceased people]
|
Washington Law
RCW 7.70.065 Informed consent -- Persons
authorized to provide for patients who are not competent —
Priority. (1) Informed consent for health care for a patient
who is not competent, as defined in *RCW 11.88.010(1)(b), to
consent may be obtained from a person authorized to consent on
behalf of such patient. Persons authorized to provide informed
consent to health care on behalf of a patient who is not
competent to consent shall be a member of one of the following
classes of persons in the following order of priority: (a) The
appointed guardian of the patient, if any; (b) The individual,
if any, to whom the patient has given a durable power of
attorney that encompasses the authority to make health care
decisions; (c) The patient's spouse; (d) Children of the
patient who are at least eighteen years of age; (e) Parents of
the patient; and (f) Adult brothers and sisters of the
patient. |
Washington Law: Medical Records
RCW
70.02.050 Releases without prior consent of patient |
Washington Law Psychiatric Records
RCW 71.05.390 Confidential information and records --
Disclosure. Except as provided in this section, the fact of
admission and all information and records compiled, obtained,
or maintained in the course of providing services to either
voluntary or involuntary recipients of services at public or
private agencies shall be confidential. Information and
records may be disclosed only: ... (3) When the person
receiving services, or his or her guardian, designates persons
to whom information or records may be released, or if the
person is a minor, when his or her parents make such
designation. |
| Health
Information Defined |
45CFR164.501
Definitions: ... Individually identifiable health information
is information that is a subset of health information,
including demographic information collected from an
individual, and: (1) Is created or received by a health care
provider, health plan, employer, or health care clearinghouse;
and (2) Relates to the past, present, or future physical or
mental health or condition of an individual; the provision of
health care to an individual; or the past, present, or future
payment for the provision of health care to an individual; (i)
That identifies the individual; or (ii) With respect to which
there is a reasonable basis to believe the information can be
used to identify the individual. |
| General Rule of
Patient Access Health Information |
45CFR164.524
Access of individuals to protected health information. (a)
Standard: access to protected health information. 1) Right of
access. Except as otherwise provided in paragraph (a)(2) or
(a)(3) of this section, an individual has a right of access to
inspect and obtain a copy of protected health information
about the individual in a designated record set, for as long
as the protected health information is maintained in the
designated record set, except for: (i) Psychotherapy notes;
(ii) Information compiled in reasonable anticipation of, or
for use in, a civil, criminal, or administrative action or
proceeding; and (iii) Protected health information maintained
by a covered entity that is: [special, and excluded for one
reason or another.] |
| Psychotherapy
Notes Defined |
45CFR164.501
Definitions: ... Psychotherapy notes means notes recorded (in
any medium) by a health care provider who is a mental health
professional documenting or analyzing the contents of
conversation during a private counseling session or a group,
joint, or family counseling session and that are separated
from the rest of the individual’s medical record.
Psychotherapy notes excludes medication prescription and
monitoring, counseling session start and stop times, the
modalities and frequencies of treatment furnished, results of
clinical tests, and any summary of the following items:
diagnosis, functional status, the treatment plan, symptoms,
prognosis, and progress to date |
| Releases of
Information Required by Law |
45CFR164.512
(a)(1) A covered entity may use or disclose protected health
information to the extent that such use or disclosure is
required by law and the use or disclosure complies with and is
limited to the relevant requirements of such law. |
| "Required by
Law" Defined |
45CFR164.501
Definitions: ... Required by law means a mandate contained in
law that compels a covered entity to make a use or disclosure
of protected health information and that is enforceable in a
court of law. Required by law includes, but is not limited to,
court orders and court- ordered warrants; subpoenas or summons
issued by a court, grand jury, a governmental or tribal
inspector general, or an administrative body authorized to
require the production of information; a civil or an
authorized investigative demand; Medicare conditions of
participation with respect to health care providers
participating in the program; and statutes or regulations that
require the production of information, including statutes or
regulations that require such information if payment is sought
under a government program providing public benefits |
| Court Ordered
Release of Information |
45CFR164.512
(e)(1) Permitted disclosures. A covered entity may disclose
protected health information in the course of any judicial or
administrative proceeding: (i) In response to an order of a
court or administrative tribunal, provided that the covered
entity discloses only the protected health information
expressly authorized by such order; or (ii) In response to a
subpoena, discovery request, or other lawful process, that is
not accompanied by an order of a court or administrative
tribunal, if: [long list of conditions re: subpoenae] |
| Circumstances In
Which Health Care Providers Get To Use Common Sense |
Emergencies
45CFR164.510(a)(3)
Emergency circumstances. (i) If the opportunity to
object to uses or disclosures required by paragraph (a)(2) of
this section cannot practicably be provided because of the
individual’s incapacity or an emergency treatment
circumstance, a covered health care provider may use or
disclose some or all of the protected health information
permitted by paragraph (a)(1) of this section for the
facility’s directory, if such disclosure is: (A) Consistent
with a prior expressed preference of the individual, if any,
that is known to the covered health care provider; and (B) In
the individual’s best interest as determined by the covered
health care provider, in the exercise of professional
judgment.
Notifying Family
45CFR164.510(b)(1)(ii)
A covered entity may use or disclose protected health
information to notify, or assist in the notification of
(including identifying or locating), a family member, a
personal representative of the individual, or another person
responsible for the care of the individual of the
individual’s location, general condition, or death. Any such
use or disclosure of protected health information for such
notification purposes must be in accordance with paragraphs
(b)(2), (3), or (4) of this section, as applicable.
When In The Best Interests of the Patient
45CFR164.510
(b)(3) Limited uses and disclosures when the individual
is not present. If the individual is not present for, or the
opportunity to agree or object to the use or disclosure cannot
practicably be provided because of the individual’s
incapacity or an emergency circumstance, the covered entity
may, in the exercise of professional judgment, determine
whether the disclosure is in the best interests of the
individual and, if so, disclose only the protected health
information that is directly relevant to the person’s
involvement with the individual’s health care. A covered
entity may use professional judgment and its experience with
common practice to make reasonable inferences of the
individual’s best interest in allowing a person to act on
behalf of the individual to pick up filled prescriptions,
medical supplies, X-rays, or other similar forms of protected
health information |
| Allowable
Copying Fees |
45CFR164.524(c)(4)
Fees. If the individual requests a copy of the protected
health information or agrees to a summary or explanation of
such information, the covered entity may impose a reasonable,
cost-based fee, provided that the fee includes only the cost
of: (i) Copying, including the cost of supplies for and labor
of copying, the protected health information requested by the
individual; (ii) Postage, when the individual has requested
the copy, or the summary or explanation, be mailed; and (iii)
Preparing an explanation or summary of the protected health
information, if agreed to by the individual as required by
paragraph (c)(2)(ii) of this section |
WASHINGTON LAW
WAC
246-08-400 How much can a medical provider charge for
searching and duplicating medical records? RCW 70.02.010(12)
allows medical providers to charge fees for searching and
duplicating medical records. The fees a provider may charge
cannot exceed the fees listed below: (1) Copying charge per
page: (a) No more than eighty-eight cents per page for the
first thirty pages; (b) No more than sixty-seven cents per
page for all other pages. (2) Additional charges: (a) The
provider can charge a twenty dollar clerical fee for searching
and handling records; (b) If the provider personally edits
confidential information from the record, as required by
statute, the provider can charge the usual fee for a basic
office visit. (3) This section is effective July 1, 2003,
through June 30, 2005. (4) This section does not restrict a
health care provider, a third-party payor, or an insurer
regulated under Title 48 RCW from complying with obligations
imposed by federal or state health care payment programs or
federal or state law. |
Top of Page |