Ohio clarifies doctor role in patient privacy

Patient privilege belongs foremost to the patient. But what is a physician allowed to do to protect that privacy when he or she is whisked into a lawsuit by a court order for medical records?

A December Ohio appeals court ruling affirmed that under the state's law, doctors can defend patients' privacy rights for them as a third party, and that HIPAA does not preempt a more stringent Ohio law protecting medical records.

Doctors and attorneys say the ruling broke a long-held precedent in Ohio that the patient is the exclusive guardian of physician-patient privilege and that doctors could not step in on their behalf. But they also say the issue puts doctors in a predicament. Because of differences in some states' medical records privacy laws compared with the federal rules, physicians risk violating one or the other when determining whether to produce privileged information after receiving a subpoena or court order.

"Our client was being forced into breaching the physician-patient relationship and violating their responsibility to maintain the records as private," said defense attorney Brian Butler, who represents Northeast Ohio Nephrology Associates.

Plaintiff's attorneys had argued that state law allowed only the patient, not her doctors, to intervene to protect her medical records and that federal HIPAA regulations superseded state law to let protected health information be disclosed with a valid court order, according to court documents. The attorneys declined to comment because the case is still in litigation.

The Ohio 9th Judicial District Court of Appeals decision reversed a trial court ruling ordering the specialty group to testify about the treatment of the patient, a third party in the suit. "While we acknowledge that a patient owns the privilege, we cannot see the sense in charging a medical professional with confidentiality, then eviscerating their ability to protect that confidentiality," Judge Beth Whitmore wrote in the opinion.

In this case, the court relied on a HIPAA provision stating that a more restrictive state statute will supersede federal rules. "We think it apparent that the regulations protecting the physician-patient privilege in Ohio are more stringent than those put forward in HIPAA," the court concluded.

"It's not surprising" that the state's strict law prevailed, said Almeta Cooper, general counsel for the Ohio State Medical Assn. Ohio law, she explained, states that without a patient waiver, all medical information is privileged except in a few specific circumstances. Those few situations are even narrower than what HIPAA allows.

"The court is honoring the physician-patient privilege and saying that you can't get at it by bringing in a patient or a doctor in some other way," Cooper said.

The challenge, doctors and attorneys say, is that with so much interplay between the laws, doctors find it difficult to keep up and know exactly what they can and can't do when a court order arrives on their doorstep.

"A lot of times it's a no-win situation for doctors and hospitals, because in a situation like this, they run the risk of violating either HIPAA or state law," said attorney Wendy Bunnell, a HIPAA compliance specialist for the Minneapolis-based firm Halleland Lewis Nilan & Johnson. She explained that HIPAA provides a floor for patient privacy protection.

"Generally," she said, "doctors don't want to assert patient privilege when it's not their duty. But at the same time, it is their duty already because HIPAA applies to the provider and not the individual."

Because HIPAA is mandatory for everyone, when litigation arises involving doctors, so do a number of issues, said William Kose, MD, who has a law degree and practices internal medicine in Findlay, Ohio. "In general, physicians would say federal law would supersede state law," but the line can get blurred, because state law also governs medical liability.

Car crash sparks the legal question

The lawsuit stems from a 2003 auto crash in which Marvin Grove was injured when Carmella Pleli hit him while driving home from dialysis treatment. According to court documents, Grove settled with Pleli's auto insurance company in a separate case. In June 2004, he sued Northeast Ohio Nephrology Associates and Summit Renal Care, where Pleli received care the day of the accident. Grove alleged negligence by the doctors for letting her drive home "in an impaired state," the opinion stated.

Grove's attorneys requested access to Pleli's medical records without a patient waiver. A trial court ruled that the doctors did not have to produce the medical records but instead, ordered them to testify about Pleli's treatment on the day of the accident.

In reversing that decision, the appeals court called the district court order "inconsistent" and stated that Ohio law permits disclosure of medical records only under specific exceptions: The patient waives privilege, a spouse gives consent if the patient is deceased, the patient files a lawsuit or the lawsuit involves court-ordered treatment.

Grove's attorneys argued that a HIPAA provision says it "shall supersede any contrary provision of state law," and under HIPAA, privileged information can be released "in response to a court order."

The appeals court found, however, that under a more relevant HIPAA provision, state law preempts federal law if the state law is stricter.

So, short of wading through the law books, what can doctors do to protect themselves and their patients?

Because Ohio's law is stricter than HIPAA, Cooper said, the medical society advises doctors to first get patient consent, but when they aren't sure, to seek legal counsel.

"We tell doctors that simply because someone sends you a subpoena doesn't mean you should automatically release those documents," she said.

Attorney Butler also advises legal counsel to determine "whether there is a proper waiver of privilege to give up the records, or else [the doctor] may have to assert the patients' rights for them."