Releasing of Medical Records
Many medical practices receive on occasion a Subpoena from an Attorney requesting patient's medical records. Most likely it will be received via fax, email or mail. Most often included is a signed release from the patient allowing the records to be released to the Attorney that is requesting them. Should your practice take that as the O.K. to send the records?
One Medical Practice did, only to find out it had been duped by someone claiming to be an Attorney to get the patients information. The practice went through a costly legal battle in connection with a HIPAA violation.
If the requestor is not the patient, there appears to be no clear authorization or legal basis for the request, or if the matter does not pertain to treatment or payment, then it is illegal to release the information.
Patients have every right to put restrictions on who can have access to their information. For example, some employers require an employee to have a physical examination. A double-check with the patient as to if the employer should have access to the records and always have a written consent from the patient.
It get's even more serious when the medical information pertains to mental health, substance abuse, reproductive health or genetic issues and also patients that are minors. Legal experts recommend that you should ALWAYS get the patients signed permission for any medical record request.
Some suggestions as to how to streamline and protect your medical practice from any HIPAA violations.
(1) Review your states law concerning medical record disclosures
(2) Have staff members who are familiar with HIPPA guidelines handle all record requests and if they are not familiar, it would be advantageous for them to either be trained or attend a seminar to learn and implement the guidelines
(3) Have EVERY patient, before being seen; sign a HIPAA privacy notice for their file
One recommendation from a medical practice was to have their own "Release of Records Form". Where the patient must come in and sign with a photo ID, then it's witnessed by the person present and followed by the physician's signature. This covers all bases and helps to keep you within compliance of HIPAA guidelines.
Also a seperate filing system just for requests of medical records could be kept seperate from the medical file so it can easily be accessed.
Most medical practices would do well to implement these simple practices in order to avoid any HIPAA violations.
One Medical Practice did, only to find out it had been duped by someone claiming to be an Attorney to get the patients information. The practice went through a costly legal battle in connection with a HIPAA violation.
If the requestor is not the patient, there appears to be no clear authorization or legal basis for the request, or if the matter does not pertain to treatment or payment, then it is illegal to release the information.
Patients have every right to put restrictions on who can have access to their information. For example, some employers require an employee to have a physical examination. A double-check with the patient as to if the employer should have access to the records and always have a written consent from the patient.
It get's even more serious when the medical information pertains to mental health, substance abuse, reproductive health or genetic issues and also patients that are minors. Legal experts recommend that you should ALWAYS get the patients signed permission for any medical record request.
Some suggestions as to how to streamline and protect your medical practice from any HIPAA violations.
(1) Review your states law concerning medical record disclosures
(2) Have staff members who are familiar with HIPPA guidelines handle all record requests and if they are not familiar, it would be advantageous for them to either be trained or attend a seminar to learn and implement the guidelines
(3) Have EVERY patient, before being seen; sign a HIPAA privacy notice for their file
One recommendation from a medical practice was to have their own "Release of Records Form". Where the patient must come in and sign with a photo ID, then it's witnessed by the person present and followed by the physician's signature. This covers all bases and helps to keep you within compliance of HIPAA guidelines.
Also a seperate filing system just for requests of medical records could be kept seperate from the medical file so it can easily be accessed.
Most medical practices would do well to implement these simple practices in order to avoid any HIPAA violations.