Proguard.org Case Law
Access to Confidential Records

This page summarizes Federal and Washington State laws that pertain to privacy of medical records

HIPAA

HIPAA is the Health Insurance Portability and Accountability Act. The privacy sections of HIPAA are found in Title 45 of the Code of Federal Regulations at Section 164. The standard notation for such references is 45CFR164. This will be observed below.

The following summarizes sections of HIPAA and Washington State laws and regulations that apply to authorization and receipt of confidential information by individuals and their agents. HIPAA refers to a guardian, Attorney-in Fact or person otherwise having authority to act on behalf of another as a "Personal Representative" (PR).

The regulation is very detailed. The information below can be a starting point, but not a substitute for looking at the rule itself HIPAA privacy rules are mostly about transfers of information within and among large medical institutions, medical providers, insurance companies, clearinghouses, government entities and the like, and was largely intended to prevent the abuse of privacy rights in these transfers. This page does not address these issues much, but is focused on informing individuals and PRs as to their rights to receive information.. 

For the most part, HIPAA presents almost no new obstacles to access to information by PRs (at least this is so in Washington State) but there are many obstacles created by misinterpretations of HIPAA, or just plain paranoia, on the part of medical providers. The purpose of this page is to allow advocates to cite chapter and verse in such situations.

All statutes and regulations are subject to periodic change. The rules cited below are those that were effective on August 14, 2002. Users should check current versions of the rule, using this link: HIPAA.
Health Information Defined HIPAA
45CFR164.501 Definitions: ... Individually identifiable health information is information that is a subset of health information, including demographic information collected from an individual, and: (1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; (i) That identifies the individual; or (ii) With respect to which there is a reasonable basis to believe the information can be used to identify the individual.
General Rule of Patient Access Health Information HIPAA
45CFR164.524 Access of individuals to protected health information. (a) Standard: access to protected health information. 1) Right of access. Except as otherwise provided in paragraph (a)(2) or (a)(3) of this section, an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set, except for: (i) Psychotherapy notes; (ii) Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding; and (iii) Protected health information maintained by a covered entity that is: [special, and excluded for one reason or another.]  
Psychotherapy Notes Defined HIPAA
45CFR164.501 Definitions: ... Psychotherapy notes means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual’s medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date
Access to Records by Personal Representative HIPAA
45CFR164.502(g)(1) Standard: personal representatives. As specified in this paragraph, a covered entity must, except as provided in paragraphs (g)(3) and (g)(5) of this section, treat a personal representative as the individual for purposes of this subchapter. (2) Implementation specification: adults and emancipated minors. If under applicable law a person has authority to act on behalf of an individual who is an adult or an emancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation;
[Paragraph (g)(3) refers to some situations re: unemancipated minors. Paragraph (g)(5) refers to abuse or neglect situations. Paragraph (g)(4) refers to deceased people]
Washington Law 
RCW 7.70.065    Informed consent -- Persons authorized to provide for patients who are not competent — Priority. (1) Informed consent for health care for a patient who is not competent, as defined in *RCW 11.88.010(1)(b), to consent may be obtained from a person authorized to consent on behalf of such patient. Persons authorized to provide informed consent to health care on behalf of a patient who is not competent to consent shall be a member of one of the following classes of persons in the following order of priority: (a) The appointed guardian of the patient, if any; (b) The individual, if any, to whom the patient has given a durable power of attorney that encompasses the authority to make health care decisions; (c) The patient's spouse; (d) Children of the patient who are at least eighteen years of age; (e) Parents of the patient; and (f) Adult brothers and sisters of the patient.
Washington Law:  Medical Records
RCW 70.02.050 Releases without prior consent of patient
Washington Law Psychiatric Records 
RCW 71.05.390 Confidential information and records -- Disclosure. Except as provided in this section, the fact of admission and all information and records compiled, obtained, or maintained in the course of providing services to either voluntary or involuntary recipients of services at public or private agencies shall be confidential. Information and records may be disclosed only: ... (3) When the person receiving services, or his or her guardian, designates persons to whom information or records may be released, or if the person is a minor, when his or her parents make such designation.
Releases of Information Required by Law HIPAA
45CFR164.512 (a)(1) A covered entity may use or disclose protected health information to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law.
"Required by Law" Defined HIPAA
45CFR164.501 Definitions: ... Required by law means a mandate contained in law that compels a covered entity to make a use or disclosure of protected health information and that is enforceable in a court of law. Required by law includes, but is not limited to, court orders and court- ordered warrants; subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information; a civil or an authorized investigative demand; Medicare conditions of participation with respect to health care providers participating in the program; and statutes or regulations that require the production of information, including statutes or regulations that require such information if payment is sought under a government program providing public benefits
Court Ordered Release of Information HIPAA
45CFR164.512(e)(1) Permitted disclosures. A covered entity may disclose protected health information in the course of any judicial or administrative proceeding: (i) In response to an order of a court or administrative tribunal, provided that the covered entity discloses only the protected health information expressly authorized by such order; or (ii) In response to a subpoena, discovery request, or other lawful process, that is not accompanied by an order of a court or administrative tribunal, if: [long list of conditions re: subpoenae]
Circumstances In Which Health Care Providers Get To Use Common Sense HIPAA
Emergencies
45CFR164.510(a)(3) Emergency circumstances. (i) If the opportunity to object to uses or disclosures required by paragraph (a)(2) of this section cannot practicably be provided because of the individual’s incapacity or an emergency treatment circumstance, a covered health care provider may use or disclose some or all of the protected health information permitted by paragraph (a)(1) of this section for the facility’s directory, if such disclosure is: (A) Consistent with a prior expressed preference of the individual, if any, that is known to the covered health care provider; and (B) In the individual’s best interest as determined by the covered health care provider, in the exercise of professional judgment.

Notifying Family
45CFR164.510(b)(1)(ii) A covered entity may use or disclose protected health information to notify, or assist in the notification of (including identifying or locating), a family member, a personal representative of the individual, or another person responsible for the care of the individual of the individual’s location, general condition, or death. Any such use or disclosure of protected health information for such notification purposes must be in accordance with paragraphs (b)(2), (3), or (4) of this section, as applicable.

When In The Best Interests of the Patient
45CFR164.510 (b)(3) Limited uses and disclosures when the individual is not present. If the individual is not present for, or the opportunity to agree or object to the use or disclosure cannot practicably be provided because of the individual’s incapacity or an emergency circumstance, the covered entity may, in the exercise of professional judgment, determine whether the disclosure is in the best interests of the individual and, if so, disclose only the protected health information that is directly relevant to the person’s involvement with the individual’s health care. A covered entity may use professional judgment and its experience with common practice to make reasonable inferences of the individual’s best interest in allowing a person to act on behalf of the individual to pick up filled prescriptions, medical supplies, X-rays, or other similar forms of protected health information
Allowable Copying Fees HIPAA
45CFR164.524(c)(4) Fees. If the individual requests a copy of the protected health information or agrees to a summary or explanation of such information, the covered entity may impose a reasonable, cost-based fee, provided that the fee includes only the cost of: (i) Copying, including the cost of supplies for and labor of copying, the protected health information requested by the individual; (ii) Postage, when the individual has requested the copy, or the summary or explanation, be mailed; and (iii) Preparing an explanation or summary of the protected health information, if agreed to by the individual as required by paragraph (c)(2)(ii) of this section
WASHINGTON LAW
WAC 246-08-400 How much can a medical provider charge for searching and duplicating medical records? RCW 70.02.010(12) allows medical providers to charge fees for searching and duplicating medical records. The fees a provider may charge cannot exceed the fees listed below: (1) Copying charge per page: (a) No more than eighty-eight cents per page for the first thirty pages; (b) No more than sixty-seven cents per page for all other pages. (2) Additional charges: (a) The provider can charge a twenty dollar clerical fee for searching and handling records; (b) If the provider personally edits confidential information from the record, as required by statute, the provider can charge the usual fee for a basic office visit. (3) This section is effective July 1, 2003, through June 30, 2005. (4) This section does not restrict a health care provider, a third-party payor, or an insurer regulated under Title 48 RCW from complying with obligations imposed by federal or state health care payment programs or federal or state law.

 

_________________________________________________________________________________________

Printer Friendly Version of Site                                                

For more information about trust and guardian issues, powers of attorney, public entitlements, care & assistance to people with special needs, and other issues see:   PROGUARD.ORG

Copyright 1999-2010 Guardianship Services of Seattle, 200 1st Ave. W. Suite 308, Seattle, Washington, 98119.  The content of this site is exclusively owned by Guardianship Services of Seattle ( GSS ).