Medical Records and the Law

Other Health Related Reporting Requirements 265abuse. 107 Depending upon the structure of the MCO, employees or officersof the MCO may be required to make a report.In many states, statutory language may be broad enough to encompassMCOs. Many reporting statutes require or allow “any” person toreport suspected abuse or neglect. For example, Arizona law providesthat any person other than one required to report may report suspectedchild abuse and will received immunity for making such a report. 108Other states, such as Florida, require “any” person who has reasonablecause to suspect that a child is abused or neglected to make a report. 109Statutes requiring or allowing “any” person to report suspected abusecan allow or require MCO employees to make such a report.MCOs should carefully examine the laws in the states in which theyoperate to determine whether the statutes in these states are writtenbroadly enough to require or allow disclosure of otherwise confidentialpatient information. Research may reveal that MCOs and their employeeshave a duty to disclose patient information. Although somestates may permit but not require MCOs to disclose medical recordsinformation under certain circumstances, MCOs should determinewhether they would be immune from liability for disclosing this informationbefore developing a workplace policy concerning this issue.The Privacy Rule will not apply to an MCO’s use or disclosure ofhealth information unless the MCO is a covered entity as defined bythe rule. However, an MCO may be subject to the rule if the MCOfunctions as a business associate of a covered entity and has agreed bycontract to abide by the provisions of the rule. If the MCO is subject tothe Privacy Rule, the MCO must also determine whether the particularstate laws governing its use or disclosure of PHI have been preemptedby HIPAA, and then design its privacy policies and proceduresaccordingly. (For a discussion of HIPAA’s preemption provisions, seeChapter 6.)Health OversightHospitals and healthcare practitioners in some states may be requiredto disclose health information to government agencies that are charged107Haw. Rev. Stat. § 350-1.1.108Ariz. Rev. Stat. § 13-3620.109Fla. Stat. Ann. § 415.504; see also Md. Code Ann., Fam. Law, § 5-705.