Medical Records and the Law

Summary of Confidentiality Requirements 131where interstate healthcare transactions, telemedicine, and ERISAhealth plans are common. 109Most states have traditionally required physicians and other licensedhealthcare providers to keep their medical records confidential.110 The confidentiality provisions of the Privacy and SecurityRules have established these requirements as federal law applicable toall states. Some states have adopted confidentiality rules that are moreprotective of health information than those provided by the PrivacyRule. For example, in its patient records privacy law, Virginia defines“record” to include any communication made by a patient to aprovider and any other information acquired in confidence by aprovider in the course of treatment. 111 Some states prohibit redisclosureby the individual or entity receiving the patient information withouta new patient authorization. 112 Because these provisions extendprotection to more information than is subject to the protection of thePrivacy and Security Rules, healthcare organizations and providersshould continue to comply with them.As with physicians, most states require healthcare institutions tokeep their medical records confidential. Many states locate these requirementsin a licensing and regulation act. For example, Florida’shospital and licensing act provides that patient records are confidential,and explains that the records may not be released without the patient’sconsent except under a narrow set of circumstances. 113 TheIllinois Nursing Home Care Act provides that a resident’s records areconfidential. 114 Illinois law governing long term care facilities statesthat all information contained in a resident’s record is confidential,109For a survey of law in this area, see L. Gostin, Z. Lazzarini, and K. Flaherty, LegislativeSurvey of State Confidentiality Laws, with Special Emphasis on HIV and Immunization,Final Report (presented to the U.S. Centers for Disease Control and Prevention, theCouncil of State and Territorial Epidemiologists, and the Task Force for Child Survivaland Development—Carter Presidential Center, Georgetown University Law Center,July 1996).110See, e.g., Cal. Civ. Code § 56.05(e) (where the confidentiality requirement extends tomedical doctors, doctors of osteopathy, chiropractors, and anyone else licensed or certifiedunder the state’s Business and Professions Code); Cal. Civ. Code § 56.10; Md. CodeAnn., Health-Gen. § 4-302.111Va. Code § 32.1-127.1:03(B).112See, e.g., Md. Code Ann., Health-Gen. § 4-302(d).113Fla. Stat. Ann. § 395.3025(4).114210 Ill. Comp. Stat. § 45/2-206.