Public Health Law Map - Beta 5 - Medical and Public Health Law Site

services to the medical care providers have to agree to protect the patient's
information in the same way that the provider must protect it. This agreement is
documented in a HIPAA business association agreement. Determining which outside
businesses and consultants may share information under a business associate
agreement and how to enforce these agreements has occupied the time of countless
medical care attorneys.
HIPAA does not preempt state laws that provide for access to medical records in
legal proceedings and for public health and safety. HIPAA allows reporting of
communicable diseases, child abuse, violent injuries, and other mandatory public
health reports, as well as to prevent crimes by the patient. [HIPAA Privacy Rule and
Public Health - Guidance from CDC and the U.S. Department of Health and Human
Services, MMWR 2003;52(Supl) It also allows the discovery of information in legal
trials when ordered by the court. Thus a hospital defending a medical malpractice
lawsuit would have access to the patient's medical records as ordered by the court or
as available under other state laws.
Not surprisingly, HHS excepts its own access to medical information from both the
patient authorization requirement and the minimal necessary requirement. This
allows the federal government access to medical records to audit for billing fraud,
compliance with the Medicare/Medicaid quality assurance rules, and so it assure
audit compliance with the HIPAA privacy rule.
HIPAA allows medical information to be released when necessary to identify
patients. In one case, a woman without identification was struck by a car and brought
into the hospital in a coma. Her picture and medical condition were released to the
press to try to find any relatives or others who could identify her. More generally,
HIPAA allows the release of information without the patient's authorization when, in
the medical care providers' best judgment, it is in the patient's interest. Despite this
language, medical care providers are very reluctant to release information unless it is
clearly allowed by HIPAA. In some cases, hospitals have refused to tell relatives if a
patient is in the hospital because the hospital believed that it would violate HIPAA.
While this was never the intent of HIPAA, this confusion will continue until HHS
gives more detailed information about what the regulations mean in specific
situations.
5. Limits on What Information is Released
The core of the HIPAA privacy rule is limiting disclosure to the minimum amount
necessary for the purpose of the disclosure.[45 CFR 164.502(b), 164.514(d)] With
traditional paper medical records, when someone needed information from the record
they would either be given the entire record, or copies of relevant pages, which
would have information about other aspects of the care that were not necessary for
the request. Anyone writing an entry in the record would have access to the entire
record.
HIPAA requires that the medical care provider only supply the needed information,
356