HIPAA Authorization and Production of Entire Medical File

Recently, one of our health care provider clients called with a question about what type of information may be disclosed pursuant to a HIPAA release. The client had inquired about whether there is any law which prevents a physician or a physician’s office from disclosing a patient’s entire file in response to a HIPAA Authorization to Release Information. Specifically, the client was concerned about producing records that were created or obtained from other doctors.

As one of our valued physician clients, we thought you might be interested in the answer as it relates to your practice. The short answer is, yes, pursuant to a valid HIPAA Authorization, a health care provider may indeed produce a patient’s entire medical file, regardless of whether some of the records were created or obtained from other physicians.

The U.S. Department of Health & Human Services (HHS) has issued a statement on this very question. While the HHS statement clearly explains such disclosure is acceptable, please note the following two important caveats.

  • Caveat #1. The Authorization must describe the requested information in a specific and meaningful fashion. A request for the patient’s “entire medical record” or “complete patient file” would be sufficient. However, requests for “all protected health information” would be too vague. Accordingly, we suggest that you require, as a part of your standard office policy, that one of the two bold phrases listed above be included in the Authorization if the request seeks a patient’s entire file.
  • Caveat #2. The Authorization must meet the requirements of 45 CFR 164.508(b)(1) and 164.508(c)(1). To assure compliance in this regard, we recommend our clients utilize the official form produced by the Iowa State Bar Association. This Form, in PDF or other format, can be obtained from LaMarca Law Group, P.C. by contacting Barbara Bray.
  • With regard to any general HIPAA Authorization signed by new patients, we would be happy to review your current HIPAA form to ensure it complies with the regulations. As a general rule, however, we would suggest that any person or entity requesting a patient’s entire medical record should sign a new and separate Authorization specifically for that purpose, as opposed to relying on a general release signed by the patient at an earlier date.

In summary, as long as you take special care to comply with the above recommendations, you can adopt an office policy that allows for the production of a patient’s entire medical record in response to a HIPAA Authorization.

The Search Engine Guys