[ Tuesday, May 27, 2003 ]
Responding to Subpoenas.
There's also been a lot of talk about responding to subpoenas for medical record information. When a lawyer asks a covered entity for medical record information, the covered entity can produce the information if the request is for treatment, payment or healthcare operations (although the minimum necessary rule applies except for treatment releases). In most cases, lawyers aren't asking for one of these purposes. That leaves the covered entity with three other options for the release.
1. The release can be made if the individual has signed an authorization allowing the release. This is probably the best route for a covered entity to take. The individual would then be aware of the release of the information, and the covered entity would be able to rest assured that its ethical obligations, as well as its legal obligations, are met. There are specific requirements for authorizations, such as the requirement that the authorization not be too general, so you need to make sure the authorization in this case meets those. However, there is some confusion out there now about whether an individual can authorize the release of
all of their records, or records from
all of their caregivers, without running afoul of the authorization requirements for being overbroad. I think that most authorizations asking for "all records" or records from "all caregivers" are not necessarily violations of HIPAA, unless the covered entity reasonably feels that the individual might not have been able to tell the reason for the requested authorization due to the overbroad language of the authorization itself. If the individual is subject to a lawsuit and the medical records related to the lawsuit, the individual probably knows what the authorization is intended to solicit, and a request for "all" records would probably be sufficiently limited (after all, past medical conditions could have an impace on the current injury case).
2. If there is a court order instructing the release of the information, the covered entity can and should release it. You are off the hook if someone judicially orders the release. Just make sure it's a real court order, signed by the judge, and not just something fancy cooked up by the lawyer.
3. If there is a subpoena from a lawyer but no court order, the covered entity can release the information in certain circumstances. Primarily, the lawyer must provide sufficient evidence to the covered entity that the lawyer notified the individual and the individual had an opportunity to quash the subpoena or get a limiting order protecting the information, and the individual either did nothing and the time to object ran out, or objected and the court still allowed the release. State laws differ, so it would be best to rely on either an explicit authorization from the individual or a court order.
Jeff [2:48 PM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
