Medical Records and the Law

Uses and Disclosures of Medical Records Information 193under state law, federal law should not be interpreted to authorize a violationof the state law. On the other hand, the regulations provide thatstate law may not authorize or compel any disclosure prohibited by thefederal regulations. In other words, if the federal law permits disclosureprohibited by state law, the disclosure is not to be made; and if federallaw prohibits disclosure, disclosure should not be made, regardless ofthe state law governing the issue. Nevertheless, a program subject toboth sets of rules must be careful to release only the particular informationrequired by state law. Any release of information beyond thatrequired by state law constitutes a breach of the federal substance abuseregulations.Several states have enacted their own provisions for access anddisclosure of alcohol and drug abuse patient records. 415 Thesestatutes typically impose a general ban on disclosure of records bycovered programs except as provided in the law. Exceptions to confidentialitygenerally are created for disclosures relating to financialand compliance audits and program evaluations, between qualifiedpersonnel involved in the patient’s treatment, and to qualified personsresponding to a medical emergency. Alcohol and drug abusetreatment programs in each state must be aware of the particularstate laws applicable to them in addition to the federal laws governingtheir patient records, and must determine whether the PrivacyRule preempts relevant state laws.Treatment programs that also qualify as covered entities under thePrivacy Rule also will be subject to the privacy requirements of the rule.This means that the programs must determine whether a particular useor disclosure of alcohol and drug abuse patient records is permitted byboth the substance abuse regulations and the Privacy Rule. DHHS hastaken the position that the Privacy Rule does not conflict with thePublic Health Service Act or the substance abuse regulations. 416 ThePrivacy Rule is for the most part a set of permissive regulations thatpermit, but do not require, disclosure of PHI. Where other laws, suchas the substance abuse regulations, are more restrictive, it is possible foran organization that is subject to both laws to comply with the more restrictive(that is, more protective) law without violating either law. Forexample, the substance abuse regulations permit disclosure of patient415See, e.g., Md. Code Ann., Health-Gen., § 8-601(c); Wis. Stat. Ann. § 51.30(4).41665 Fed. Reg. 82482 (Dec. 28, 2000).