Medical Records and the Law

202 CHAPTER 6: ACCESS TO HEALTH INFORMATIONDHHS to assure adequate protection of the rights and interests of patients,practitioners, or providers of health care. 460QIOs are required to provide reasonable physical security measuresto prevent unauthorized access to the information and to ensure the integrityof the data. 461 The QIO must instruct its officers and employees,as well as employees of healthcare institutions participating in itsactivities, of their responsibility to maintain confidentiality. No individualparticipating in the QIO review process on a regular basis shallhave authorized access to confidential QIO information unless thatperson has been properly trained and has signed a statement indicatingan awareness of the legal penalties for unauthorized disclosure. 462 QIOinformation may be stored in a shared health data system unless suchstorage would prevent the QIO from complying with the regulations.463 QIO information may not be disclosed by the shared healthdata system unless the source of the information consents or the QIOrequests disclosure as permitted by the regulations. 464The regulatory provisions governing disclosure of QIO informationdistinguish “confidential” from “nonconfidential.” “Confidential information”is defined as any of the following:• Information that explicitly or implicitly identifies an individualpatient, practitioner, or reviewer• Sanction reports and recommendations• Quality review studies that identify patients, practitioners, or institutions465The phrase “implicitly identifies” is defined to mean “data so unique ornumbers so small that identification of an individual patient, practitioner,or reviewer would be obvious.” 466 Nonconfidential informationis not defined by the regulations, but the term presumably refers to informationfalling outside the definition of “confidential information.”A QIO is required to disclose nonconfidential information to anyperson upon request. Such information may relate to the norms, crite-46042 U.S.C. § 1320c-9(a)(2).46142 C.F.R. § 480.115(a).46242 C.F.R. § 480.115(d).46342 C.F.R. §§ 480.143(a) and (b).46442 C.F.R. § 480.143(c).46542 C.F.R. § 480.101(b).466Ibid.