[ Wednesday, March 28, 2007 ]
Oklahoma state law and HIPAA:
The Oklahoma Supreme Court has ruled
that a trial court's permissive court order for the disclosure of PHI met HIPAA requirements, but not state law requirements. The trial court in a med mal case issued a court order allowing (but not requiring) oral communications by a deceased patient's physicians was sufficient to allow the disclosure of PHI pursuant to the standards of 45 CFR 164.512(e)(1)(i) (disclosures in a judicial proceeding pursuant to a court order).
The problem is that while the court order was sufficient under HIPAA (if a judge orders it, OCR won't slap you for doing it), there's a more stringent Oklahoma state statute that's applicable. As you know, more-stringent state statutes are not preempted by HIPAA, but rather you gotta meet both. The state statute (Title 12, Sections 19 and 2503(D)(3)) requires that the discovery be limited to medical information relevant to the particulars of the case at hand. In this case, the trial judge's order would allow the deceased patient's physicians to discuss any matter related to the physician with the lawyers seeking discovery, not just patient information relevant to the particulars of this medical malpractice case.
The lesson is that you have to meet HIPAA, but you have to meet state laws as well.
Jeff [11:17 AM]
Blogger: HIPAA Blog - Edit your Template