Medical Records and the Law

266 CHAPTER 7: REPORTING AND DISCLOSURE REQUIREMENTSwith overseeing health care in those states. These include state insurancecommissions, state health professional licensure and professionaldisciplinary boards, and state Medicaid fraud control units, each ofwhich often is authorized by statute to conduct investigations and toobtain information in the furtherance of their regulatory duties. 110The Privacy Rule defines a “health oversight agency” as a governmentor Indian tribal agency or authority or its agent that is authorizedby law to oversee the healthcare system (whether public or private) orgovernment programs in which health information is necessary to determineeligibility or compliance, or to enforce civil rights laws forwhich health information is relevant. 111 The rule permits a covered entityto disclose PHI to health oversight agencies for their oversight ofthe healthcare system, government benefit programs, entities subject togovernment regulation, and entities subject to civil rights laws if thoseoversight activities are authorized by law and if health information isrelevant to those activities. 112 These disclosures are limited to the informationthat health oversight agencies are authorized by law to receive.The Privacy Rule creates no new rights in the agencies to obtainhealth information or to conduct investigations, however. 113The Privacy Rule also attempts to provide guidance concerningwhen a covered entity may disclose PHI under the health oversightagency provisions, and when it should disclose under the law enforcementprovisions. If the individual is the subject of an agency investigation,and the investigation does not arise from alleged healthcare fraud,a covered entity should follow the rules governing disclosures to lawenforcement officials. 114 (See the discussion of disclosures to law enforcementofficials in Chapter 8.) Notwithstanding this distinction,however, covered entities may also disclose PHI to a health oversightagency that, in conjunction with another governmental agency, is conductinga joint investigation that is not related to health. 115110Fla. Stat. Ann 395.3025.11145 C.F.R. § 164.501.11245 C.F.R. § 164.512(d).11365 Fed. Reg. 82528 (Dec. 28, 2000).11445 C.F.R. § 164.512(d)(2).11545 C.F.R. § 164.512(d)(3).