Release of Medical Records in Ohio OHIMA March, 2010 Ann Hubbuch, JD, RHIA Vice President Corporate Compliance Licking Memorial Health Systems Ohio Revised Code (ORC) One part of the puzzle What controls.hipaa or ORC? HIPAA, as a federal law, preempts State law Unless the State Law is more stringent. HIPAA 45 CFR section 160.203 provides: A standard, requirement or implementation specification adopted under this subchapter that is contrary to a provision of State law preempts the provision of State Law. Note: Pre-emption is a doctrine applied by the Supreme Court that says certain matters are of such a national, as opposed to local, character that federal laws preempt or take precedence over state laws. 1
HIPAA and preemption cont. This regulation (160.203) also provides that a state law that affords more protection than the federal regulations (i.e. more stringent) remains valid and is not preempted HIPAA preemption cont. Thus, whichever law is more stringent controls as defined in 45 CFR sec 160.22 More stringent means a State law that meets one or more of the following criteria: (1) With respect to a use or disclosure, the law prohibits or restricts a use or disclosure in circumstances under which such use or disclosure otherwise would be permitted under the subchapter Analysis of Ohio Laws Ohio Revised Code (ORC) All statutes of a permanent and general nature of the state as revised and consolidated into general provisions, titles, chapters, and sections including all bills passed and filed through March 1, 2010 Ohio Administrative Code (OAC) A codification of the rules of the administrative agencies of the state including all rules filed by or with an effective date of December 1, 2009 http://codes.ohio.gov Ohio Rules Civil Procedure (ORCP) http://www.supremecourt.ohio.gov/legalresources/rules/civil/civilprocedure.pdf 2
Patient Access to Medical Records under ORC 3701.74 Patient or patient's representative to submit request to examine or obtain copy of medical record. http://codes.ohio.gov/orc/3701.74 (8) Medical record means data in any form that pertains to a patient s medical history, diagnosis, prognosis, or medical condition and that is generated and maintained by a health care provider in the process of the patient s health care treatment. ORC 3701.74 cont.. (B) A patient, a patient s personal representative or an authorized person who wishes to examine or obtain a copy of part or all of a medical record shall submit to the health care provider a written request signed by the patient, personal representative, or authorized person dated not more than one year before the date on which it is submitted. The request shall indicate whether the copy is to be sent to the requestor, physician or chiropractor, or held for the requestor at the office of the health care provider. Within a reasonable time after receiving a request that meets the requirements of this division and includes sufficient information to identify the record requested, a health h care provider that has the patient s medical records shall permit the patient to examine the record during regular business hours without charge or, on request, shall provide a copy of the record in accordance with section 3701.741 of the Revised Code, except that if a physician or chiropractor who has treated the patient determines for clearly stated treatment reasons that disclosure of the requested record is likely to have an adverse effect on the patient, the health care provider shall provide the record to a physician or chiropractor designated by the patient. The health care provider shall take reasonable steps to establish the identity of the person making the request to examine or obtain a copy of the patient s record. ORC 3701.74 cont (parsed) Who: A patient, a patient s personal representative or an authorized person What: who wishes to examine or obtain a copy of part or all of a medical record Must: 1. shall submit to the health care provider a written request signed by: the patient, personal representative, or authorized person 2. dated not more than one year before the date on which it is submitted. 3. The request shall indicate whether the copy is to be sent to: the requestor, physician or chiropractor, or held for the requestor at the office of the health care provider. 3
3701.74 cont... Provider Must: 1. Within a reasonable time after receiving a request that meets the requirements of this division and includes sufficient information to identify the record requested, a health care provider that has the patient s medical records 2. Shall permit the patient to examine the record during regular business hours without charge or, on request, shall provide a copy of the record in accordance with section 3701.741 of the Revised Code, Unless: 1. except that if a physician or chiropractor who has treated the patient determines for clearly stated treatment reasons that disclosure of the requested record is likely to have an adverse effect on the patient, the health care provider shall provide the record to a physician or chiropractor designated by the patient. Identification: The health care provider shall take reasonable steps to establish the identity of the person making the request to examine or obtain a copy of the patient s record. Don t skip the definitions section (10) Patient means either of the following: (a) An individual who received health care treatment from a health care provider; (b) A guardian, as defined in section 1337.11 of the Revised Code, of an individual described in division (A)(10)(a) of this section. Definitions 11) Patient s personal representative means: a minor patient s parent or other person acting in loco parentis, a court-appointed guardian, or a person with durable power of attorney for health care for a patient, (when patient in a condition where unable to speak for themselves) the executor or administrator of the patient s estate, or the person responsible for the patient s estate if it is not to be probated. 4
1337.11 Guardian means a person appointed by a probate court pursuant to Chapter 2111. of the Revised Code to have the care and management of the person of an incompetent. 1337.13 Authority...a durable power of attorney for health care. (A)(1) An attorney in fact under a durable power of attorney for health care shall make health care decisions for the principal only if the instrument substantially complies with section 1337.12 of the Revised Code and specifically authorizes the attorney in fact to make health care decisions for the principal, and only if the attending physician of the principal determines that the principal has lost the capacity to make informed health care decisions for the principal... Definitions (14) Authorized person means a person to whom a patient has given written authorization to act on the patient s behalf regarding the patient s medical record. 5
3701.74 (C) Penalty for non-compliance (C) If a health care provider fails to furnish a medical record as required by division (B) of this section, the patient, personal representative, or authorized person who requested the record may bring a civil action to enforce the patient s right of access to the record. Others.. 5122 Mental Health / Psychiatric Records 42 CFR Part 2 (Confidentiality of Alcohol and Drug Abuse Patient Records) Tort for Breach of Confidentiality The Biddle Case Biddle v. Warren General Hospital. (1999), 86 Ohio St.3d 395 (syllabus). Establishes a tort and allows civil suits for improper release of medical information to be brought. Ohio Supreme Court has held that both a health care provider and a lawyer can be held liable for obtaining a nonpublic medical information without the patient s consent. 6
Practical Effect of Biddle Tort a wrong or injury for which the court will provide a remedy in the form of an action for damages. In the absence of patient consent.get a court order (subpoena alone insufficient ) How about Minors? 18 and under generally only parent s serve as the patient s authorized representative. ORC 2317.54, 2151.011 & 3109.01 What if the parents are divorced or separated? ORC 3194.04 either parent or both may be given custody of the child including the ability to make decisions about the child s care. Regardless of who has custody, both parents are given the same right to access any record that is related to the child ORC 3109.051. Only IF a court has decided this would not be in the best interest of the child will a specific court order be issued restricting the terms for access to records by the non-custodial parent. The parent holding the restriction has the responsibility to make you aware of the order. I m emancipated Ohio does not have a statute specifically outlining what makes a minor emancipated. Each case evaluated on own merits. However, relying on ORC 2919.12 (parental notification of abortion) MAY make the evaluation on the standards set forth: Married Serving in armed forces Employed and self-subsisting Otherwise not under the care and control of his or her parents or guardians.. Physician should make or confirm this designation. 7
Mature Minor The mature minor doctrine is a judicial term to describe minors who have the capacity to consent Lacey v. Laird Requires a physician make determinations on a case-by-case basis. Should not be applied to minors under 15 years of age. In best interest of child, physician determines the minor has capacity to provide own consent. Often used by physicians treating minors who do not want their parents to know. Most often for young women seeking birth control. Key in release of information because need to respect status physician held minor. If promised confidentiality, then that should extend to the release of information. Other reasons minor can request / release records Absent a court order to the contrary, generally, a minor parent can make medical care decisions for own children Testing for venereal diseases ORC 3709.241 Testing for HIV ORC 3701.242 Testing or treatment of alcohol or drug related conditions. ORC 3719.012 Treatment outpatient mental health services if 14 or older. ORC 5122.04 Can the parent s know? Key in release of information because need to respect status physician held / promised minor. If promised confidentiality, then that should extend to the release of information. The parents or guardian of a minor giving consent under this division (HIV, alcohol, venereal diseases) are not liable for payment and shall not be charged for. given to the minor without the consent of a parent or the guardian. parents shall not be informed of the services (mental health treatment). without the minor s consent unless the mental health professional treating the minor determines that there is a compelling need for disclosure based on a substantial probability of harm to the minor or to other persons, and if the minor is notified of the mental health professional s intent to inform the minor s parent, or guardian 8
Mental Health Records ORC 5122.31 A (5) A patient shall be granted access to the patient s own psychiatric and medical records, unless access is specifically restricted in a patient s treatment plan for clear treatment reasons; 5122.31 cont B) Before records are disclosed pursuant to divisions (A)(3), (6), (7), and (9) of this section, the custodian of the records shall attempt to obtain the patient s consent for the disclosure. No person shall reveal the contents of a medical record of a patient except as authorized by law. (3) That hospitals, boards of alcohol, drug addiction, and mental health services, and community mental health agencies may release necessary medical information to insurers and other third-party payers, including government entities responsible for processing and authorizing payment, to obtain payment for goods and services furnished to the patient; (6) That hospitals and other institutions and facilities within the department of mental health may exchange psychiatric records and other pertinent information with other hospitals, institutions, and facilities of the department, and with community mental health agencies and boards of alcohol, drug addiction, and mental health services with which the department has a current agreement for patient care or services. Records and information that may be released pursuant to this division shall be limited to medication history, physical health status and history, financial status, summary of course of treatment in the hospital, summary of treatment needs, and a discharge summary, if any. 5122.31 cont. (7) That hospitals within the department, other institutions and facilities within the department, and community mental health agencies may exchange psychiatric records and other pertinent information with other providers of treatment and health services if the purpose of the exchange is to facilitate continuity of care for a patient; (9) That community mental health agencies may exchange psychiatric records and certain other information with the board of alcohol, l drug addiction, and mental health services and other agencies in order to provide services to a person involuntarily committed to a board. Release of records under this division shall be limited to medication history, physical health status and history, financial status, summary of course of treatment, summary of treatment needs, and discharge summary, if any. 9
Psychotherapy Notes afforded extra protections... Psychotherapy notes have additional restrictions. They are the process notes that capture the therapists impressions, details of the therapy conversation that contain dreams, thoughts, etc. To meet the standard must be kept separate from the medical record. Psychotherapy Notes cont. Do not include: Medication prescription and monitoring Counseling session start and stop times Modalities and frequency enc of treatment furnished Results of Clinical Tests Any summary of dx, functional status, treatment plan, symptoms, prognosis, and progress to date. Alcohol and Drug Records Federal Laws...related to release of information is 42 CFR Part 2 which restricts the dissemination of medical information to third parties without prior written consent except in the case of emergency, court order or for anonymous research purposes. 10
Alcohol and Drug cont. What records are included? Of any program which receives federal funding.... A program is one holding itself out as providing...alcohol,or drug abuse diagnosis, treatment, or referral for treatment. 42 CFR 2.11 A facility offering general medical care will not be considered a program unless the facility has: An identified unit which provides alcohol or drug abuse dx, tx, or referral for treatment, or Medical personnel or other staff whose primary function is the provision of alcohol or drug abuse dx, referral for tx and who are identified as such providers. Hospital emergency rooms and medical-surgical units are not included 2.12(e)(1) ORC 3793.13 (A) Drug / Alcohol 3793.13(A) Records or information,... pertaining to the identity, diagnosis, or treatment of any patient that are maintained in connection with the performance of any drug treatment program licensed by, or certified by, the director of alcohol and drug addiction services, under section 3793.11 of the Revised Code, shall be kept confidential, may be disclosed only for the purposes and under the circumstances expressly authorized under this section, and may not otherwise be divulged in any civil, criminal, administrative, or legislative proceeding. ORC Drug Alcohol cont. consent in the form of a written release signed by the patient, the content of the record or information may be disclosed if the written release: (1) Specifically identifies the person, official, or entity to whom the information is to be provided; (2) Describes with reasonable specificity the record, records, or information to be disclosed; and (3) Describes with reasonable specificity the purposes of the disclosure and the intended use of the disclosed information. 11
HIV records NEW!! A patient s informed consent to be tested for HIV is no longer necessary. However the section of ORC 3701.243 still contains the language : (b) A person to whom disclosure is authorized by a written release, executed by the individual tested or by the individual s legal guardian and specifying to whom disclosure of the test results or diagnosis is authorized and the time period during which the release is to be effective; 3701.243 Disclosure 2) The results of an HIV test or a diagnosis of AIDS or an AIDS-related condition may be disclosed to a health care provider, or an authorized agent or employee of a health care facility or a health care provider, if the provider, agent, or employee has a medical need to know the information and is participating p in the diagnosis, care, or treatment of the individual on whom the test was performed or who has been diagnosed as having AIDS or an AIDS-related condition. This division does not impose a standard of disclosure different from the standard for disclosure of all other specific information about a patient to health care providers and facilities. Disclosure may not be requested or made solely for the purpose of identifying an individual who has a positive HIV test result or has been diagnosed as having AIDS or an AIDS-related condition in order to refuse to treat the individual. When releasing the records remember... (E) Any disclosure pursuant to this section shall be in writing and accompanied by a written statement that includes the following or substantially similar language: This information has been disclosed to you from confidential records protected from disclosure by state law. You shall make no further disclosure of this information without the specific, written, and informed release of the individual to whom it pertains, or as otherwise permitted by state law. A general authorization for the release of medical or other information is not sufficient for the purpose of the release of HIV test results or diagnoses. 12
HIPAA... Notice of Privacy Practices... Read it carefully. Outlines a wide variety reasons way a patient s health information may be used and released. TPO.. Treatment Payment Operations HIPAA Elements of a Valid Consent 164.508(c) If not TPO, then need a valid authorization. Required elements include: Description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion; Name of the person(s) or class of persons authorized to use or disclose the PHI; Name of the person(s) or class of persons to whom the CE is authorized to make the use or disclosure; Description of each purpose of the requested use/disclosure. Statement "at the request of the individual" id is sufficient i when an individual id initiates i i the authorization i and does not, or elects not to, provide a statement of purpose Expiration date or an expiration event that relates to the individual or the purpose of the use/disclosure. Statement "end of research study," "none," or similar language is sufficient if the authorization is for research, including the creation and maintenance of a research database or research repository. Signature of individual and date; If signed by personal representative, a description of the representative's authority to act for the individual; HIPAA 164.508(c)(2) Required Statements In addition to the required elements, the authorization must contain statements adequate enough to place individual on notice of all of the following: Individual's right to revoke authorization in writing and either: 1) exceptions to the right to revoke and a description of how the individual may revoke; or 2) reference to the CE's privacy notice if it contains the exceptions and description of how to revoke. The ability or inability to condition treatment, payment, enrollment or eligibility for benefits on the authorization by stating either 1) CE may not condition treatment, payment, enrollment or eligibility for benefits on whether individual signs authorization when the prohibition on conditioning authorizations applies ; or 2) the consequences to the individual of a refusal to sign when the CE can condition on failure to obtain such authorization. The potential for information disclosed pursuant to the authorization to be subject to redisclosure by recipient and no longer protected by the HIPAA privacy rules. 13
Subpoena s ORCP Rule 45 Reasons to object: Unreasonable notice Seeking records subject to privilege Provide written objections Try as a standard response need a court order or the patient s written consent... Can file a motion to quash if can t meet Rule 45 timeframe. HIPAA says to take steps to assure patient has notice and opportunity to object Duces Tecum... bring with... ORC allows certified copy of medical records to be offered into evidence without custodian needing to appear in court. Attorneys must agree to stipulate that records can be offered as evidence. 2317.422 in lieu of the testimony in open court of their custodian, person who made them, or person under whose supervision they were made, may be qualified as authentic evidence if any such person endorses thereon the person s verified certification identifying such records, giving the mode and time of their preparation, and stating that they were prepared in the usual course of the business of the institution. Such records, copies, or photographs may not be qualified by certification as provided in this section unless the party intending to offer them delivers a copy of them, or of their relevant portions, to the attorney of record for each adverse party not less than five days before trial. Nothing in this section shall be construed to limit the right of any party to call the custodian, person who made such records, or person under whose supervision they were made, as a witness. 14