Medical Records and the Law

HIPAA Privacy Rule 455quests will be granted and what requests will be denied, and whetherrestrictions will be honored even if HIPAA permits disclosures irrespectiveof those restrictions.The HDN policies and procedures wouldneed to delineate how the HDN would handle those requests.With an EHR in an HDN, the possibility increases for many moredisclosures of ePHI made at the speed of light, but it is not clear thatthe burden of accounting for disclosures in compliance with the PrivacyRule will necessarily increase. The HDN participants may takeadvantage of the HIPAA exceptions to the accounting requirement fordisclosures made for healthcare operations or to other participants fortreatment purposes, and those disclosures for which an accounting isrequired would likely be highly automated in an EHR environment.HDN participants would still need to decide who has the responsibilityfor maintaining the accounting and making it available for individualswho request it.With respect to HIPAA individual rights, therefore, the challengesin an HDN—that is, beyond the current HIPAA requirements withwhich any covered entity has to contend now—are likely to be in theallocation of responsibility for managing those rights among theHDN participants and the HDN itself. In the decentralized HDNmodels, the covered entities themselves are likely to retain control andresponsibility; in the centralized models, the HDN will likely have agreater role.Other Privacy IssuesIn designing HDNs that incorporate EHRs, it is important to rememberthat the Privacy Rule applies only to the healthcare providers,health plans, and clearinghouses—and leaves considerable health informationoutside of its jurisdiction. This information remains subjectto many state laws governing the privacy of health information.Confidentiality obligations vary from state to state. Many states havegeneral health information confidentiality statutes that apply to specificcategories of persons, including healthcare providers, third-party administrators,and employers. Other general confidentiality requirements areimposed on providers in legislation enunciating patients’ rights. For themost part, however, confidentiality provisions are found in statutes andregulations that license or otherwise regulate specific categories ofproviders and their duty to maintain medical records.These requirements