Release of Medical Records in Georgia

James Lawton

Deputy General Counsel

HealthPort Technologies, LLC

Presentation to Georgia Society for Clinical & Resource Management

Fall Conference September 18-19, 2013

AGENDA

• Confidentiality of Records and Exceptions• Access and Authorizations• Special Conditions

– Substance abuse/dependency– HIV/AIDS– Mental health

• Legal Process – POD, Subpoenas, Court Order• Certification of Records• Georgia Fee Statute• HITECH – Final Rules Finally Here

Confidentiality of Medical Records

State Constitution affords the patient a right of privacy in

medical records.

King v. State, 272 Ga. 788, 535 S.E.2d 492 (Ga 2000)

No physician or care facility shall be required to disclose “any medical

information concerning a patient” except:– With valid authorization, – To State Department of Human Resources, or– Pursuant to subpoena, court order, other legal requirement

Additional statutory protection for substance abuse, AIDS, and mental

health/psychotherapy

Exceptions to Confidentiality

Exceptions Based on Federal Law

• Disclosures permitted without patient authorization for:

- RACs and QIOs

- Public Health – exigent circumstances

- OSHA with a medical access order

Exceptions to Confidentiality

• GA Statutory basis for disclosure of medical information without patient authorization:

– Certain contagious diseases and STDs– Suspected child abuse/neglect– Non-accidental injuries– Juvenile drug use– Suspected abuse of long-term care patient– Disabled newborn (deaf, blind or serious congenital defect)– Disposal of fetus– Workers’ comp claim – Georgia Professional Licensing Board (subpoena)

Exception for Payment, Treatment and Operations

• HIPAA has broad exception for PTO, but Georgia limits

use or disclosure of medical information without patient

consent to:

– Providers involved in treatment consented to by patient– Bill patient– Comply with law– Treatment and payment for Medicare/Medicaid/TriCare patients– In Emergency: Required treatment or transfer for care

Exception for Payment, Treatment and Operations

• Obtain patient’s permission to use and disclose in

accordance with provider’s Notice of Privacy Practices

– Staff access incidental to treatment– Utilization/quality review– Claims processing

Patient Access

• When can patient access and who can act for patient

– Competent adult patient or emancipated minor patient– Parent, foster parent or court-appointed guardian of minor

(DFACS)– Legally appointed guardian of incompetent patient– Person acting under a durable POA for healthcare (Advance

Directives)– Deceased patients

• Legally appointed personal representative of the estate• Next of kin - surviving spouse, child, parent

Patient Access

Time - 30 days to make records available – Trumps HIPAA’s longer period

Basis for Denial:─ Mental health records or substance abuse where the treating

physician or psychotherapist (or chief medical officer of the facility) determines the release of such records will be detrimental to patient’s physical or mental health

Release with Authorization

• Facility may release records in accordance with a request and valid

authorization– Authorization should be specific when involving sensitive conditions

• HIPAA Requirements for a Valid Authorization─ Name of person/facility authorized to make the disclosure

─ Name or title of person or organization to receive the records

─ Patient name

─ Purpose of disclosure (contrast patient access)

─ Scope/description of records to be released

─ Signature of patient or personal rep

─ That the authorization is subject to revocation

─ Expiration date – whether via fixed date or event

─ Notice of re-disclosure risk

Sensitive Conditions - Substance Abuse

Patient Access: Right to review and obtain a copy unless treating physician determines the disclosure would be detrimental to the mental or physical well being of the patient

Disclosures:• With Patient Authorization - To any person/entity designated in writing by patient• To Other Medical Personnel – To meet the patient’s bona fide medical emergency• To Qualified Personnel – for research/audit/evaluation• Court Order – Except as noted below for criminal investigations, release only

pursuant to court order upon finding of “good cause” to release to the court– Do NOT disclose pursuant to Subpoena or POD

• Blood Test for Drug/Alcohol – If test is for medical diagnosis, only disclose with court order– If test is for “legal” (e.g., DUI investigation), can also release pursuant to criminal

subpoena or to investigating officer

Sensitive Conditions – HIV/AIDS

AIDS Confidential Information (ACI)

Defined by GA Law and has additional protections from disclosure compared with “regular” medical records. A patient's written consent is required to disclose ACI, unless the disclosure is otherwise authorized or required by law.

Disclosure via Legal Process: ACI may be disclosed as medical information pursuant to any other law which authorizes or requires the disclosure of medical information (including subpoenas and POD) if:

• The person identified by that information:

─ Has specifically consented in writing to that disclosure; or

─ Is given at least ten (10) days’ notice prior to the disclosure and does not timely object; or

• A Superior Court Order

Sensitive Conditions – HIV/AIDS

Permitted Disclosures without Authorization

• Notice to State Department of Human Resources• Notice to Other Healthcare Facility – Providing care to the infected patient if risk of

further infection or if necessary for the facility to provide appropriate care• Notice to Administrator of Institutional Care Facility with infected Patient

Partner Notification

When the physician of an HIV infected patient reasonably believes that the spouse/partner or any child is a person at risk of being infected with HIV by that patient, the physician may disclose to that spouse, partner or child . . . after first attempting to notify the patient that such disclosure is going to be made.

Sensitive Conditions – Mental Health

Patient Access: Right to review unless treating physician determines the disclosure would be detrimental to the mental or physical well being of the patient. Patient of individual psychotherapy providers have right to access and obtain copies.

Disclosures:• With Patient Authorization - To any person/entity designated in writing by patient,

including attorney• To Subsequent Admitting Facility • To Other Medical Personnel – When chief medical officer of the facility where

records kept deems it essential for continued treatment or in a bona fide emergency• At a Hearing about the Patient• To Law Enforcement – In criminal investigation, can disclose whether a person was

a patient of a state institution, together with last address. In criminal investigation involving a crime on the premises, can disclosure facts about incident, if person is/was a patient, name, address and whereabouts.

• Valid Subpoena or Court Order – Release all except psychotherapy records which are privileged under Georgia law

Sensitive Conditions – Psychotherapy Treatment

Georgia Recognizes a Mental Health Provider-Patient

• Privilege for psychotherapy treatment

─ Comparable to husband-wife and attorney-client privilege

• Covers confidential communication made for:

─ Treatment/diagnosis between patient and psychiatrists

─ Licensed psychologists, social worker, marriage/family

─ Therapist employing psychotherapeutic techniques

• Only disclose with specific patient authorization or when

specifically ordered by court – send to court, not attorneys

Legal Process

• Request for Production of Documents• Subpoenas - State and Federal• Workers’ Comp • Court Orders• Deposition Subpoenas• Certification of Records

Request for Production of Documents

• Georgia Law permits a Party in litigation to serve a “Request for Production” on a Non-Party– Not a court order

• Must be served on:– All parties– The patient, if not a party, and– The non-party physician or hospital that owns the records

• 20 days from date of service to Object• If objection, requesting party must obtain court order• If no objection (but no specific authorization)- provide records

Except substance abuse and priveleged psychotherapy notes

Subpoena Types

• Trial or Testimony - requires personal appearance– Less common– Professional treating patient

• Duces Tecum – requires company records– Common– Original records need not be provided– Satisfied with certified copies of medical records

Subpoenas

• Common Sources of Subpoenas– State or federal courts– State Board of Workers’ Compensation– Board of Medical Examiners/State Professional Licensing Board– Department of Human Resources (Public Health)

• Service– Personal service, certified or statutory overnight delivery– Out of state or county must be served by law enforcement in the

county where subpoena is to be served– If invalid subpoena – Do NOT disclose

State Court Subpoena

• Process for evaluation/response is similar to POD• Proof of Service

– Confirm that patient (or attorney) has been served!

• Wait 23 days • If patient (or other party) objects, wait for court order• If patient consents and gives specific authorization(s) =

release responsive records • If no objection (but no specific authorization(s) = release

responsive records except– Substance abuse and privileged psychotherapist treatment

which require a court order

Federal Subpoena

• Served on patient?─ If patient is a party - No need to confirm proof of service - FRCP

requires subpoenas to be served on all parties

─ If patient is not a party, obtain proof of service• Wait 17 days (FRCP gives 14 days to object)• If patient (or other party) objects, wait for court order• If patient consents and gives specific authorization = release

responsive records• If no objection (but no specific authorization(s) = release responsive

records Except

─ Substance abuse and privileged psychotherapist treatment which require a court order

Criminal Subpoenas

King v. State creates some uncertainty

• Most certainty when patient is notified of request

• Is there adequate assurance the information will be protected?

• Protective order?• May want to consult with legal counsel• Require court order?

Grand Jury Subpoenas • Treated as court orders• Always return to the court issuing (despite D.A. or U.S. Attorney

requesting the records be returned to them)

Workers’ Compensation

Has the Employee Put His/Her Medical Condition at Issue?

• Made a claim for benefits (look for Form WC-207 or WC-14)• Employer has agreed to disability benefits (Form WC-1 or 2)• Employer has agreed to pay for medical expenses from injury

If yes to any of the above, the records related to the injury may be released

─ Only release from date of injury forward without broader patient authorization

─ If no to all three, do not release without separate authorization

Court Orders

Court Orders - Signed by a Judge

Always Comply with a Court Order!

• Healthcare facility is protected from claims of improper release

• Basis for release of substance abuse (if finding of “good cause”) and psychotherapy treatment without patient authorization

• Carefully note where order directs the records to be sent

─ If not stated or unclear, deliver records to the court

Deposition Subpoenas

Subpoenas for Deposition to Hospitals Usually Limited to:

• Professional caregiver re: specific questions about care

• To Custodian of Records to authenticate medical records

─ Generally unnecessary with certification of records

─ New law effective January 1, 2013

Certification of Records for Admissibility

New Self-Authentication Law - Effective January 1, 2013

Allows the use of records, in any form, of “acts, events, conditions, opinions, or

diagnoses” if:

• Made at/near the time of the described act/event/condition/opinion/diagnoses• Made by a person with personal knowledge and a business duty to report;• Kept in the course of a regularly conducted business activity; and • It was the regular practice of that business activity to make the

memorandum/report/record/data compilation.

─ Each of these elements are typically met by healthcare facilities

─ Custodian of Records can execute a “Certificate of Authenticity” that is notarized

Duplication Fees – Current August 2013

Certification of Records - $9.70• Base Fee - $25.88 (never charge on patient request)

Per Page Pages:

$0.97 – pages 1-20

$0.83 – pages 21-100

$0.66 – pages 101+

*Above Rates Subject to Annual Adjustment for CPI-Med

• Non Paper Records (radiology, strips, etc): “Full Reasonable Cost of Reproduction”

• Workers Comp – No charge for WC18 or 20A, otherwise:

$0.20/page with Minimum $30, plus tax and actual postage

$9.50/x-ray, plus tax and actual postage

• State Disability & Social Security Determination - $15.00

HITECH – Final Rule Finally Here

Marketing

Sale of PHI

Patient Access• Electronic records• Direct provider to send records to 3rd party

State rates still deemed reasonable

NOT LEGAL ADVICE

• The information in this presentation is provided as general informational and educational purposes to accompany a presentation of limited duration. The presentation only covers selected topics and is not a complete discussion of all laws relevant to the release of health information in Georgia.

• The information in this presentation is not offered as, and does not constitute legal advice or legal opinion. The provision of this information is not intended to create, and the receipt does not constitute, an attorney-client relationship. You should seek the advice of an attorney for specific legal questions.