HHS advises how to handle patient info for lawsuits

Washington -- Recently published federal guidance helps clarify when and how physicians should release patient information when it is requested for litigation.

The information spelled out in this new advice from the Health and Human Services Dept. falls under the Health Insurance Portability and Accountability Act's patient privacy protections.

For example, a physician who is not party to a lawsuit should know before giving up records that HIPAA requires that a good-faith effort be made to inform the patient that his or her medical records have been requested. The request could come via subpoena, discovery, board of medicine inquiry or other legal process. The patient also must be given sufficient time to respond, object or try to limit the scope of the request.

In many cases, a copy of the subpoena or request can serve as adequate notice.

But the privacy regulation left open the question of whether it is OK to release protected health information even if the notification was sent to the patient's lawyer and not directly to the patient, said Sharon Lee Johnson, an attorney at Stearns, Weaver, Miller, Weissler, Alhadeff & Sitterson in Miami.

The answer is yes, notification to the lawyer will suffice, according to the new guidance, which was published as an addition to HIPAA frequently-asked-questions materials.

Doctors still can try to get signed authorization from the patient before releasing the information, but the law does not specifically require that.

But these requirements are suspended if the physician is a party to the litigation. Examples include a doctor suing for reimbursement or being sued for medical liability. At this point, the disclosure of patient health information would fall within the purview of the privacy regulation's health care operations provisions, which apply to day-to-day business activities rather than its litigation rules.

Physicians responding to a court order also can ignore the notification requirements under HIPAA.

But it is always a good idea when releasing patient information for any reason to fully document the disclosure in patient records, Johnson said.

As is true with any disclosure of patient health information, the law requires physicians to strive to ensure that they are providing only the most relevant information, the minimum necessary, as detailed in the request. In some cases, that could include the entire record if justified by the request.

Physicians also should know that HIPAA provides a regulatory floor, not a ceiling. If state laws provide more privacy rights to the patient, they trump the federal statute, Johnson said.