Medical Records and the Law

State Laws Relating to Acquisition and Use of Health Information 531State Laws Relating to Acquisition and Use of HealthInformation in Connection with Medical ResearchThe Privacy Rule preempts all contrary state laws relating to the privacyof health information unless the state laws are more stringent. 57However, the Privacy Rule specifically exempts from preemption statelaws that (a) the secretary of DHHS finds are necessary to preventfraud and abuse, to ensure appropriate regulations of insurance andhealth plans, to engage in state reporting on healthcare delivery or costsor for other compelling public health needs; (b) address controlled substances;(c) provide for reporting of disease or injury, child abuse, birthor death, or for conducting public health surveillance, investigation,and intervention; or (d) relate to management and financial audits,program monitoring or evaluation, or licensure or certification of facilitiesor individuals. 58State HIPAA StatutesSome states have adopted health information privacy laws that generallyhave a broader scope than the Privacy Rule. Ambiguity in suchstate privacy laws often broadens their scope, perhaps unintentionally. 59Many such state privacy laws extend the notice, access, amendment,and safeguard requirements to a broader range of entities, includingpharmaceutical companies. For example, the California Confidentialityof Medical Information Act (CMIA) covers pharmaceutical companiesand requires that they generally preserve the confidentiality ofmedical records, and that they obtain special authorization to disclosemedical information. 60 The CMIA also contains a provision requiringemployers that receive medical information to take steps to maintainthe confidentiality of the information and prevent its unauthorized disclosure.61 Texas’s health privacy statute also contains an expansive definitionof what is deemed a “covered entity”; in Texas, a covered entity5745 C.F.R. § 160.203.58Ibid.59See, e.g., 45 C.F.R. § 181.001(b)(2).60Cal. Civ. Code § 56.05(c).61Cal. Civ. Code § 56.20.