[ Monday, February 14, 2005 ]
Mississippi joins Texas and Kentucky:
the Mississippi Attorney General has ruled
that where public freedom of information laws require the release of information that might contain PHI, the FOI laws rule. It seems that some local governmental EMS providers in Mississippi were refusing to disclose required information based on the fact that it might contain protected health information. The AG's unpublished letter did not determine whether state and local governmental EMS operators are actually covered entities, but said that regardless of whether the ambulance service is a covered entity, state law requiring disclosure should be followed.
I think this is consistent with HIPAA, not contrary to it (and therefore preemptable). 45 CFR 164.512 lists the times when disclosure can be made without consent, authorization, or the opportunity to object, and subsection (a) includes an allowance for disclosures that are requried by law. Your mileage may vary in your state, but if the state law requires disclosure (most FOI Acts have internal controls on personal or confidential information), HIPAA is no bar to the disclosure. If the state law merely allows disclosure, rather than requiring it, that is another story.
As previously noted, the AGs in Texas and Kentucky have adopted similar common-sense stances.
Hat tip: Marc Goldstone.
Jeff [9:02 AM]
Blogger: HIPAA Blog - Edit your Template