Medical Records and the Law

532 CHAPTER 14: HEALTH INFORMATION IN MEDICAL RESEARCHincludes any person who “comes into the possession of protected healthinformation,” or “obtains or stores protected health information. . . .” 62Pharmaceutical companies and medical device companies are coveredby the Texas medical records privacy statute. 63 In addition, unlike thePrivacy Rule, many state privacy laws also regulate data recipients. Forexample the CMIA requires authorization for secondary disclosures ofany identifying health information. In addition, as noted,Texas law includesdata recipients as covered entities, and that state’s law alsospecifically prohibits any efforts to reidentify the subject of PHI withoutobtaining the data subject’s consent or authorization. 64 Finally,many state privacy laws, unlike the Privacy Rule, create private rightsof action to enforce their provisions. 65State Common LawState common law and other statutes provide additional protections forthe medical records of research subjects. In particular, informed consentforms must be guided by cases such as Moore v. Regents of Universityof California, 66 which held that patients have a right to discover anyfinancial interests that their healthcare providers may have in a givencourse of treatment before the patient gives true “informed consent” tothe course of treatment. In addition, those involved in medical researchshould be cognizant of state common law causes of action for invasionof privacy as they relate to medical records. State employee privacy lawsmay provide additional protections. 67 Finally, as previously mentioned,many state privacy laws provide additional protection for particularlysensitive health information, such as mental health records and informationrelating to HIV/AIDS or genetic diseases. 6862Tex. Health & Safety Code ch. 181, § 181.001(b)(2).63See Tex. Health & Safety Code ch. 181, §§ 181.001(b)(4) and (b)(5).64See Cal. Civ. Code §§ 56.05(g), 56.13, and 56.245. The Texas Insurance Code requiresthat health insurers obtain authorization to disclose nonpublic personal health informationexcept to the extent that disclosure is necessary to perform certain specified insurancefunctions. See Tex. Ins. Code. arts. 28B.02 and 28B.04.65See, e.g., Tex. Health & Safety Code § 241.156.66793 P. 2d 479 (Cal. 1990).67See Cal. Civ. Code § 56.20.68See Chapters 5 and 8.