Medical Records and the Law

170 CHAPTER 6: ACCESS TO HEALTH INFORMATIONvalid authorization was revoked, and its use of PHI in accordance withthat authorization before the revocation does not become invalid whenthe patient revokes the authorization.States have also adopted statutes governing how an individual mayrevoke an authorization. For example, Maine permits an individual torevoke his or her authorization at any time—either in a signed writing;an electronic communication bearing the individual’s unique identifierand the date; or orally, in which case the provider must record receiptof the oral revocation and the date. In addition, the revocation must beretained in the individual’s healthcare information. 291 Maryland requiresa revocation to be written, and makes the revocation effectivewhen the provider receives it. 292 Both states make clear that actionstaken by a provider in reliance on an authorization the patient revokedare not affected by the revocation. These laws will apply to healthcareorganizations and practitioners who are not subject to the Privacy Rule,and will apply to HIPAA covered entities to the extent that the lawshave not been preempted by the rule.Access by Family and FriendsHealthcare providers are frequently asked for health information by thefamily and friends of their patients. Under the general rule of protectinghealth information confidentiality, providers would not be able torelease the information without patient authorization. The PrivacyRule contains an exception to the general rule, however, and permits,under certain circumstances, covered entities to disclose a patient’sPHI to his or her relative, friend, or designated representative (for example,spouse, roommate, boyfriend, colleague, neighbor). However,the PHI must be directly relevant to the recipient’s involvement in thepatient’s health care or payment for health care. 293This includes using PHI to find the patient’s relative, friend, or representative,and to notify the person of the patient’s location, generalcondition, or death. 294 For example, a hospital might use the patient’s291Me. Rev. Stat. tit. 22, § 1711-C.5; see also Wash. Rev. Code § 70.20.040; Cal. Civ. Code§ 56.15.292Md. Code Ann. § 4-303(d).29345 C.F.R. § 164.510(b)(1).29445 C.F.R. § 164.510(b)(1)(ii).