Medical Records and the Law

Summary of Confidentiality Requirements 129other federal laws that created protections for, or required disclosuresof, PHI. 106 When apparent conflicts exist, DHHS believes that coveredentities should attempt to comply with both laws. For example,the Privacy Rule permits, but does not require, certain uses and disclosuresof PHI. If another federal law prohibits such a use or disclosure,a covered entity would simply exercise its discretion whether or not toengage in that use or permit that disclosure. In doing so, it would violateneither the Privacy Rule, which does not require it to make that useor disclosure, nor the other federal law, which prohibits the use or disclosure.Nevertheless, covered entities should exercise caution in howthey use, disclose, maintain, and transmit PHI that is subject to boththe Privacy and Security Rules and to other federal laws. They shoulddetermine what other federal laws apply to their operations, whetherconflicts between those laws and the Privacy or Security Rules exist,and, if so, whether these conflicts are irreconcilable. 107 This is a processthat will require the assistance of their health law counsel, particularlyif conflicts between federal laws appear irreconcilable.State LawTo date, the Privacy and Security Rules are the broadest source of authoritygoverning uses and disclosures of PHI.These rules set a federalfloor or minimum standard governing how covered entities use, disclose,maintain, and transmit PHI. States also regulate health informationprivacy, and their laws generally survive federal preemption unlessthey are directly contrary to the Privacy or Security Rule, or stand as anobstacle to the rules’ implementation. 108 A healthcare provider or organizationshould not rely upon a state law until it has determined thatthe law has not been preempted by HIPAA. (See the discussion of preemptionlater in this chapter.)106See 65 Fed. Reg. 82481 through 82487.107Other federal laws to consider include the Americans with Disabilities Act, 42 U.S.C.§§ 12101 et seq.; appropriation laws; the Children’s Online Privacy Protection Act, 15U.S.C. §§ 6.501 et seq.; the Developmental Disabilities Assistance and Bill of RightsAct, 42 U.S.C. §§ 15001 et seq.; the Fair Credit Reporting Act, 15 U.S.C. §§ 16.01 etseq.; the Fair Debt Collection Practices Act, 15 U.S.C. §§ 16.01 et seq.; the Family andMedical Leave Act, 29 U.S.C. §§ 2601 et seq.; the Controlled Substances Act, 21 U.S.C.§§ 801 et seq.; Medicare, 42 U.S.C. §§ 1301 et seq. and 1395 et seq.; Medicaid, 42U.S.C. §§ 1396 et seq.; the Indian Self-Determination and Education Assistance Act, 25U.S.C. §§ 450 et seq.; and federal common law.108See 45 C.F.R. §§ 160.201 through 205 regarding preemption of state law.