Pierce & Mandell, P.C.

11 Beacon Street, Suite 800
Boston, Massachusetts 02108-3002

Phone: (617) 720-2444
Fax: (617) 720-3693

Pierce and Mandell PC Blog

RSS Grab PAM RSS

Guidance to Massachusetts Health Care Providers Regarding the Release of Protected Health Information

Friday, May 04, 2018

By Curt Dooling, Matt Lauring and Bill Mandell

Hospitals and health care facilities, medical and other group practices, and individual clinicians regularly receive requests for patient records and information. It is often confusing for providers to determine when and under what circumstances they are permitted to disclose such records. Discovering parties can use the legal process to compel a response but cannot necessarily override applicable state privacy, confidentiality and privilege laws, as well as privacy rights under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), with a subpoena alone. HIPAA establishes minimum standards for the protection of protected health information (“PHI”) that do not preempt more protective state privacy laws and privileges. The following provides a brief overview on the differences between a court order, a subpoena, and an authorization for Massachusetts providers.

Subpoenas

Mass. R. Civ. P. 45 allows parties in civil lawsuits to subpoena records from non-parties. These subpoenas are often called keeper of records, or KOR, subpoenas. They are also sometimes referred to as a subpoena duces tecum.

Parties receiving a subpoena must respond to the subpoena within a certain referenced time frame. However, as a general rule, medical records should not be automatically produced in response to a subpoena, without first confirming if there is sufficient authority to release the PHI under both Massachusetts law and HIPAA. Such authority could be (i) under statutory authority on the subpoena alone if certain conditions are met, or (ii) with an executed HIPAA compliant patient authorization, or (ii) upon the issuance of a proper court order.

Subpoenas are not court orders. Subpoenas are issued by attorneys to obtain documents. Attorneys do not need a court’s permission to issue a subpoena. Medical providers can mistake subpoenas for court orders given that subpoenas are often served by a sheriff or constable, are notarized and look like an official court document. Thus, while a timely response must be sent back by the provider to the discovering party, that response may have to be in the form of an objection letter seeking the additional needed authority to disclose the PHI.

Massachusetts licensed hospitals and clinics (but not unlicensed practices) may produce medical records in response to a subpoena alone pursuant to G. L. c 111, § 70, but only if the patient is a named party in the case.

Similarly, under HIPAA’s privacy rule, 45 CFR 164.512(e)(1)(ii), a covered entity that is not a party to the litigation may disclose protected health information in response to a subpoena, discovery request, or other lawful process if the covered entity receives certain satisfactory assurances from the party seeking the information. Specifically, the covered entity must receive a written statement and accompanying documentation that the requesting party has made reasonable efforts either (1) to ensure that the individual who is the subject of the information has been given sufficient notice of the request, or (2) to secure a qualified protective order.

Thus, when viewing G. L. 111, § 70 in combination with 45 CFR 164.512(e)(1)(ii), a hospital or clinic may release confidential medical records in response to a subpoena alone if the patient is named in the caption and the provider receives assurance that the patient has been given notice that the records have been requested and has not objected. However, G. L. 111, § 70 only applies to hospitals or clinics licensed by the Massachusetts Department of Public Health. Therefore, medical practices and other groups may not release PHI in response to a subpoena without first securing a HIPAA compliant authorization from the patient, or a proper judicial order.

Additionally Protected Information

HIPAA provides a minimum level of protection for the disclosure and protection of an individual’s PHI. However, HIPAA expressly permits states to enact laws and regulations that provide more safeguards for the protection of patient information and records

Massachusetts has several statutes that provide additional protections for certain health information. For example:

  • General Laws c. 112, § 135B provides for the confidentiality of patient/social worker communications. Pursuant to G. L. c. 112, § 135B, social worker communications and records are privileged and may only be disclosed under certain circumstances.
  • General Laws c. 233, § 20B provides for the confidentiality of patient/psychotherapist communications. Pursuant to G. L. c. 233, § 20B, psychotherapist communications and records are privileged and may only be disclosed under certain circumstances.
  • General Laws c. 111, § 70F provides for the confidentiality of a patient’s HIV testing records. Pursuant to G. L. c. 111, § 70F, HIV testing records may only be disclosed with a patient’s express consent.
  • General Laws c. 233, § 20J provides for the confidentiality of sexual assault counselor communications. Pursuant to G. L. c. 233, § 20J, sexual assault counselor communications are privileged and may only be disclosed under certain circumstances.

These are only some examples of Massachusetts statutes that provide additional protection to certain medical records. There are other additionally protected categories of information under both federal and state law for substance treatment records, alcohol blood test results and minor records, to name others.

Authorizations

If a patient signs a HIPAA-compliant written authorization, a medical provider may release protected health information, as well as additionally protected areas that are explicitly referenced and designated by the patient for release. A HIPAA-compliant authorization form must include the following elements:

  • A description of the information to be disclosed;
  • The name of the individual or the name of the person authorized to make the requested disclosure;
  • The name or other identification of the recipient of the information;
  • A description of each purpose of the disclosure;
  • An expiration date or an expiration event that relates to the individual;
  • A signature of the individual or their personal representative (someone authorized to make health care decisions on behalf of the individual) and the date.

A disclosure for the release of additionally protected information should specifically state which additionally protected records are to be released.

Court Orders

A court order is a mandate issued by a court, a judge, magistrate or a clerk of the court requiring or forbidding someone to do something pursuant to the order. If privileged, additionally protected information is contained in the medical record, in lieu of an authorization, the court order is to be reviewed carefully and only that information which it orders produced is to be produced. It is not necessary to explain that other documents are not being produced in response to a court order if you are following the terms of the order. The judicial order must specify the type of record that is ordered to be released.

Medical providers should adopt health information policies and protocols to follow when a subpoena is served seeking production of a patient’s medical records. Navigating the requirements for the protection of PHI and the authorized release of PHI is difficult and complex. Pierce & Mandell’s health law attorneys have extensive experiencing advising medical providers on HIPAA compliance issues and medical record issues.

PIERCE and DOOLING WIN PRODUCT LIABILITY TRIAL ON MARTHA’S VINEYARD

Wednesday, December 14, 2016

Pierce & Mandell, Robert Pierce, Boston, MAPierce & Mandell, Curtis Dooling, Boston, MABob Pierce and Curt Dooling recently obtained a defense verdict on behalf of their client in a jury trial in Dukes County Superior Court on Martha’s Vineyard.

The plaintiff in the case sustained a serious eye injury, which eventually led to the loss of the plaintiff’s eye, when he was struck with a golf disc designed and manufactured by Pierce & Mandell’s client. The plaintiff claimed that the golf disc that struck and injured him was dangerously defective because of its design and because it lacked proper warnings alerting users to its dangers. The firm challenged the plaintiff’s credibility by showing that the plaintiff’s version of how he was injured was not credible based on witness testimony and relevant medical records. The firm also successfully argued that the golf disc was not dangerously defective.

The case was challenging due to the very serious injury that the plaintiff suffered, and the fact that the individual who threw the disc that struck the plaintiff was no longer living in the United States and was unable to testify at trial.  Rather, his deposition testimony was read to the jury.

The case was tried over 6 days, and the jury deliberated for approximately 7 hours. The jury determined that Pierce & Mandell’s client did not breach the warranty of merchantability and that the golf disc was not dangerously defective.

Bob Pierce has now achieved complete victory for his clients in the last eight jury cases that went to verdict.

Curt Dooling Begins Sixth Year as Adjunct Professor at New England Law | Boston

Monday, September 15, 2014

Curt Dooling recently began his sixth year as an Adjunct Professor of Legal Research and Writing at New England Law | Boston. As an Adjunct Professor, Curt instructs second year law students on effective appellate writing and oral advocacy. Curt graduated cum laude from New England Law | Boston in 2006. When he began his tenure as an Adjunct Professor in 2009, he was the youngest ever Adjunct Professor hired by the law school.


Enter your e-mail address below to receive updates on new blog posts!


Recent Posts


Archive


Tags