Medical Records

• Author: Richard Leiter
• Pages: 603-618

Page 603

Federal, state, and local governments are responsible for protecting and safeguarding the public health and welfare. Accordingly, during terms of various epidemics the state has required the registration of infected persons in order to treat and/or quarantine them and to study the spread of the disease to ultimately control and eradicate it. Thus, although access to medical records is highly guarded, the reporting of diseases is widely practiced at all levels of government. The Center for Disease Control, for example, publishes The Morbidity and Mortality Weekly Report, containing a comprehensive list of all reported illnesses by both state and region that benefits the family practice doctor as well as the epidemiologist. The reports of cases that are reported, from the flu to various venereal diseases to AIDS (acquired immunodeficiency syndrome), are given in confidence, and access to the records is forbidden for most other purposes.

The outbreak of AIDS has sparked controversy over the confidentiality of medical records and diagnoses. Some employers and insurance companies have sought to have individuals tested for the HIV virus, which can lead to AIDS, before hiring in order to prevent considerable expenses in the future as the employee’s health fails. Often these same parties argue for access to medical records for background checks as part of the interview process. The great tension regarding the rights of individuals with the HIV virus or AIDS, the public’s interest in controlling and fighting the epidemic, and the interest of employers, insurers, and health officials in providing adequate and affordable medical care has created a very dynamic ethical and legal dilemma that will not soon be resolved.

The laws controlling and regulating access to medical records vary greatly from state to state, although the basic protection is always there: a person’s medical records are personal and private. As is historically the case, the federal government has gotten increasingly involved in the area of individual rights and has enacted a number of pieces of privacy legislation. For example, the Federal Privacy Act of 1974 requires the release of information in federal files to the subject individual upon request, although some government agencies have established regulations allowing the release of information to a physician chosen by the requesting individual (5 U.S.C. 552a(f)(3)). Federally funded community mental health and mental retardation centers must maintain safeguards to preserve confidentiality and protect the rights of patients (52 U.S.C. 2689(d)(2)), and the Department of Defense may not use for any adverse personnel decision any personal information obtained in interviews with members of the service who are HIV positive (PL 49-661 §705(c)).

The most significant change to these laws regards certain federal laws. In 1996, Congress passed the Health Insurance Portability and Accountability Act, PL 104-191 (HIPAA). In 2006 the Secretary of Health & Human Services adopted rules to enforce provisions in that act. Essentially, the rules clarify penalties and responsibility for investigating violations of privacy laws. Everyone who has been to a doctor in 2005– 2006 has, no doubt, been asked to sign HIPAA forms.

This chapter treats all state statutes that could be found concerning privacy and medical records. It must be noted, however, that this emerging field is increasingly subject to revision and new legislative attention. In addition, in certain areas such as AIDS information, the courts may have construed other statutes as protecting or not protecting AIDS victims. In these cases the courts may be awaiting or inviting legislative action. Spaces on the chart that are left blank are those situations where specific laws cannot be found; this does not necessarily mean that an individual is without protection in these areas.

Page 604

Table 40: Medical Records
State	Who Has Access	Privilege	MandatoryReporting	Patient Waiver	InsurancePurposes	AIDS
ALABAMA	Notifiable disease records confidential (§22-11A-2)		Tuberculosis, STDs, and notifiable disease cases must be reported to state Board of Health (§22-11A-1 et seq.)	Waiver of medical record of persons infected with sexually transmitted disease by written consent of patient (§22-11A-22)		An individual must be notified of a positive test result including face-to-face counseling, information on health care services and services related to locating and testing persons who have been in contact with infected individual. Otherwise confidentiality must be maintained §22-11A-53 & §22-11A-54
ALASKA	Parent or guardian (§25.20.130); Dept. of Social Services for financial records of medical assistance beneficiaries (§47.07.074); Patient (§18.23.005); Medical Review Organization (§18.23.010 et seq.)	In the case of emergency medical services, records of those treated may be disclosed to EMTs for emergency purposes (§18.08.087)	Physicians must report tuberculosis cases to state medical officer (§18.15.131)	Mental health records may be disclosed only with patient or an individual to whom the patient has given written consent to have information disclosed (§47.30.845(2))

Page 605

State	Who Has Access	Privilege	MandatoryReporting	Patient Waiver	InsurancePurposes	AIDS
ARIZONA	Communicable disease related information confidential; release of information by consent or according to §36-664(A)(1)-(12)	Physicians and surgeons in most cases (§12-2235)	Nonaccidental injuries, malnourishment, physical neglect, sexual abuse, or other deprivation with intent to cause or allow injury or death of minor child must be reported to peace officer or child protective services. Such reports are confidential and may be used only in authorized judicial or administrative proceedings(§13 -3620); reports and records about abused or incapacitated adult may only be used in authorized judicial or administrative proceedings (§46-454).	A health provider may disclose medical records and/or payment records with written authorization by patient (§12-2292)		Any release of information must specifically authorize HIV-related information. Person with confidential HIV-related information may not be compelled to disclose information by subpoena, search warrant, or other judicial process, but may report if there is an identifiable third party at risk; no prohibition from listing in death certificate (§36-664)
ARKANSAS	Not open to public (§25-19-105); available to patient (§23-76-129); or through patient’s attorney (§16-46-106)	Physician or psychotherapist (Rules Ev. 503)	Physicians must report cases of HIV, Reye’s syndrome, and cancer (§20-15-201 et seq.)	Express consent (§23-76-129)		Reporting required to Arkansas Dept. of Health by physicians and other medical and lab directors (§20-15-906); all information and reporting confidential (§20-15-904)

Page 606

State	Who Has Access	Privilege	MandatoryReporting	Patient Waiver	InsurancePurposes	AIDS
CALIFORNIA	May not be disclosed without authorization except for court order, insurance, HMO (Civ. Code §56 et seq.)	Doctors, including psychotherapists and psychiatrists (Ev. §1010); patient must waive doctor-patient confidentiality when plaintiff in civil suit (Ev. §1016)		Patient must waive doctor-patient confidentiality when plaintiff in civil suit (Ev. §1016); other: Civ. Code §56.07	Insurer may obtain to the extent noted in (Civ. Code §56.10(c)(2)) Information disclosed to the extent necessary to allow responsibility for payment to be determined and made	Blood testing must be anonymous and test results may not disclose identities of persons tested even through subpoena (H&S 120975 and 121025)
COLORADO	Patient or designated representative with written authority, except for psychiatric records that would have significant negative psychological impact, in which case patient is entitled to summary (§25-1-801)	Physician, nurse, or psychologist (§13-90-107)	Physicians must report venereal disease, tuberculosis, rabies, and HIV to State Dept. of Public Health (§25-4-401 et seq.)			Confidential counseling and testing preferred; anonymous testing conducted for persons with high risk (§25-4-1405.5)
CONNECTICUT	Patient may see and copy (§4-105); state law limits disclosure of mental health data about a patient by name or other identifier (§52-146h); state departments may receive information on patients only to the extent necessary to obtain support or payment for care of patient; all information is confidential (§17b-225)	Physician (§52-146O)	Physician must report tuberculosis to Dept. of Public Health (§19a-262)			Results confidential except to exposed health care workers, or to mental health or prison facilities (§19a-583)
DELAWARE	All information and records of known or suspected cases of sexually transmitted disease (STD), including HIV infections, shall be strictly confidential; released only under certain circumstances (Tit.16 §711)	Physicians and psychotherapists (R. Ev. 503).Immunity from liability for reporting, in good faith, child abuse (Tit. 16 §908)	Sexually transmitted diseases reported to division of Public Health, some reported in number and manner only (Tit. 16 §702)			Strictly confidential with exceptions made under certain circumstances (Tit. 16 §711)

Page 607

State	Who Has Access	Privilege	MandatoryReporting	Patient Waiver	InsurancePurposes	AIDS
DISTRICT OF COLUMBIA	Medical records generally confidential, but may be transmitted for peer-review or anonymous use in publications (§32-501 et seq.). Public mental health facility must make patient records available to patient’s attorney or personal physician upon that person’s written authorization (§21-562)	Physician and mental health professionals

...