What you need to know about HIPPA | Atlanta lawyer

As part of the health insurance portability and accountability act of 1996 HIPPA, Congress authorized United States Department of Health and Human Services to promulgate regulations establishing strict privacy protection for health care information and medical records. These records are codified at 45 CFR 160 and 164 and are known collectively as the HIPPA privacy rule. The rule generally precludes a health care provider from using or disclosing protected health information except as permitted by the privacy regulations. The rule generally precludes a health care provider from using or disclosing protected health information except as permitted by the privacy regulations. As a practical matter, the HIPPA privacy rule does create new barriers for attorney seeking to obtain an individual’s medical records or other protected health information for use in litigation. Moreover, any less restrictive state laws, including rules of procedure, or any state laws contrary to the requirements of the HIPPA privacy regulations are preempted by the federal regulations. Knowledge of the HIPPA regulations is therefore important for lawyer seeking to serve subpoenas and make other formal or informal discovery requests during litigation. As a practical matter, the HIPPA privacy rule does create new barriers for attorneys and you will as well as will is seeking to obtain individuals medical records or other protected health information for use in litigation. Under HIPPA, discovery of individuals medical records may generally occur in one of 3 ways  1) through a signed authorization 2) through subpoena or other appropriate discovery request 3) pursuant to a court order.

As always, the easiest and most direct way to receive protected health information is through a valid patient authorization. After HIPPA, however, patient authorizations must be more detailed than those accepted before the rule became effective. The HIPPA privacy regulations dictate exactly what information a valid authorization must contain, and these regulations should be consulted if counsel intends upon drafting the authorization for a client or another patient.

A valid authorization that is one that includes:

1)      a description of the information to be used or disclosed that identifies information in a specific and meaningful fashion.

2)      The name or other specific identification of the person, or class of persons, authorized to make the requested disclosure.

3)      The name or other specific identification of the person or class of persons, to whom the health care provider may make the disclosure.

4)      A description of each purpose of the requested use or disclosure. The statement at the request of the individual is a sufficient description the purpose and individual initiates the authorization and does not, or elects not to, provide a statement of the purpose.

5)      An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure.

6)      Signature of the individual and date. If the authorization is signed by personal representative of the individual, a description of such representative’s authority to act for the individual must also be provided.

In addition to these core elements of the authorization must also contain statements adequate to place the patient on notice of certain rights, including his right to revoke the authorization at any time, and of the potential for the protected health information to be redisclosed by the recipient. HIPPA regulations further mandate that the authorizations be written in plain language and that a copy of the signed authorization be provided to the individual whose protected health information is sought. In practice health care providers found upon an authorization drafted by counsel and will usually prefer their own authorization form. In which case, practitioners need to ensure that the authorization includes a complete list of people authorized to receive a copy of the protected health information including the court, experts, witnesses, attorneys, and support staff.

Subpoena or other discovery request

In the absence of a valid patient authorization, the HIPPA privacy rule also permits a health care provider to disclose a patient’s protected health information in response to a subpoena, discovery request or other lawful process provided such requests are accompanied by specific assurances from the requesting party. The need for these additional privacy assurances term satisfactory assurances under HIPPA is sometimes referred to as a subpoena plus requirement. Satisfactory assurances provided with a subpoena should be attached via a written statement and accompanying documentation stating :

1) that reasonable efforts were made to ensure that the individual who is the subject of the protected health information has been given notice of the request.

2) that the notice include sufficient information and time period so the individual could object to disclosure.

3) that no objection has been filed, or if filed, was resolved by the court or administrative tribunal, and the disclosures sought are consistent with that resolution.

Satisfactory assurances may alternatively be provided by serving the health care provider with written statements and documentation demonstrating that reasonable efforts have been made by the requesting party to enter or obtain a qualified protective order. A qualified protective order is one that prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation or proceeding for which it was requested and requires the return or destruction of the protected health information at the end of the litigation or proceeding.

If the party seeking to discover the HII attaches documentation providing that satisfactory assurances by either method, the health care provider may disclose the patient’s medical records without having a signed authorization from the patient himself.

The practical effect of the HIPPA privacy rule has been an increase in the notice to the patients or their representatives that protected health information is being sought and potentially disclosed. Most third-party discovery requests under OCGA 9-11-34 are preceded by a letter from defense counsel to the patient’s counsel that protected health information will be sought from a specific provider within 10 days via a 3^rd party request. Patient’s counsel can acquiesce by silence, consent affirmatively, or object to the provider. If privileged materials may be contained within the requested materials the best practice is to object in writing to the disclosure of the privileged materials only. This procedure will adhere to HIPPA and allow for discovery and investigation of the claim.

HIPPA prohibits ex parte communication among defense counsel and the patient’s providers without the patient’s consent concerning protected health information. This is HIPPAs most significant impact on medical negligent litigation in Georgia. The net effect of this change is to require more mutual interviews or depositions with providers and to eliminate secret communications. While defense counsel’s unilateral access to providers has been limited access through discovery tools, which provides notice to all parties, is available. The Georgia civil practice act intent was for all parties to have notice of discovery tools and HIPPA simply requires that the disclosure protected health information is done with proper notice also. The Court of Appeals has held that a surviving wife who brings a wrongful death claim against medical providers for her husband’s death is authorized to have the medical records of her deceased husband. Because she brought the action under the Georgia wrongful death statute, and because under the statute she has the authority to act for the deceased person, HIPPA does not bar her from obtaining the records.

The Georgia Supreme Court has ruled that HIPPA does not allow defense attorneys to informally interview plaintiff’s treating physicians. Such ex parte contacts are not allowed under the act, and the act takes precedence over Georgia law  related to the discovery of a plaintiff’s medical records.Contact in Atlanta lawyer about your case today.