As part of the health insurance portability and
accountability act of 1996 HIPPA, Congress authorized United States Department
of Health and Human Services to promulgate regulations establishing strict
privacy protection for health care information and medical records. These
records are codified at 45 CFR 160 and 164 and are known collectively as the
HIPPA privacy rule. The rule generally precludes a health care provider from
using or disclosing protected health information except as permitted by the privacy
regulations. The rule generally precludes a health care provider from using or
disclosing protected health information except as permitted by the privacy
regulations. As a practical matter, the HIPPA privacy rule does create new
barriers for attorney seeking to obtain an individual’s medical records or
other protected health information for use in litigation. Moreover, any less
restrictive state laws, including rules of procedure, or any state laws
contrary to the requirements of the HIPPA privacy regulations are preempted by
the federal regulations. Knowledge of the HIPPA regulations is therefore
important for lawyer seeking to serve subpoenas and make other formal or
informal discovery requests during litigation. As a practical matter, the HIPPA
privacy rule does create new barriers for attorneys and you will as well as
will is seeking to obtain individuals medical records or other protected health
information for use in litigation. Under HIPPA, discovery of individuals
medical records may generally occur in one of 3 ways 1) through a signed authorization 2) through
subpoena or other appropriate discovery request 3) pursuant to a court order.
As always, the easiest and most direct way to receive
protected health information is through a valid patient authorization. After
HIPPA, however, patient authorizations must be more detailed than those
accepted before the rule became effective. The HIPPA privacy regulations
dictate exactly what information a valid authorization must contain, and these
regulations should be consulted if counsel intends upon drafting the
authorization for a client or another patient.
A valid authorization that is one that includes:
1)
a description of the information to be used or
disclosed that identifies information in a specific and meaningful fashion.
2)
The name or other specific identification of the
person, or class of persons, authorized to make the requested disclosure.
3)
The name or other specific identification of the
person or class of persons, to whom the health care provider may make the
disclosure.
4)
A description of each purpose of the requested
use or disclosure. The statement at the request of the individual is a
sufficient description the purpose and individual initiates the authorization
and does not, or elects not to, provide a statement of the purpose.
5)
An expiration date or an expiration event that
relates to the individual or the purpose of the use or disclosure.
6)
Signature of the individual and date. If the
authorization is signed by personal representative of the individual, a
description of such representative’s authority to act for the individual must
also be provided.
In addition to these core elements
of the authorization must also contain statements adequate to place the patient
on notice of certain rights, including his right to revoke the authorization at
any time, and of the potential for the protected health information to be
redisclosed by the recipient. HIPPA regulations further mandate that the
authorizations be written in plain language and that a copy of the signed
authorization be provided to the individual whose protected health information is
sought. In practice health care providers found upon an authorization drafted
by counsel and will usually prefer their own authorization form. In which case,
practitioners need to ensure that the authorization includes a complete list of
people authorized to receive a copy of the protected health information
including the court, experts, witnesses, attorneys, and support staff.
Subpoena or other discovery request
In the absence of a valid patient
authorization, the HIPPA privacy rule also permits a health care provider to
disclose a patient’s protected health information in response to a subpoena,
discovery request or other lawful process provided such requests are
accompanied by specific assurances from the requesting party. The need for
these additional privacy assurances term satisfactory assurances under HIPPA is
sometimes referred to as a subpoena plus requirement. Satisfactory assurances
provided with a subpoena should be attached via a written statement and accompanying
documentation stating :
1) that reasonable efforts were
made to ensure that the individual who is the subject of the protected health
information has been given notice of the request.
2) that the notice include sufficient
information and time period so the individual could object to disclosure.
3) that no objection has been
filed, or if filed, was resolved by the court or administrative tribunal, and
the disclosures sought are consistent with that resolution.
Satisfactory assurances may
alternatively be provided by serving the health care provider with written
statements and documentation demonstrating that reasonable efforts have been
made by the requesting party to enter or obtain a qualified protective order. A
qualified protective order is one that prohibits the parties from using or
disclosing the protected health information for any purpose other than the
litigation or proceeding for which it was requested and requires the return or
destruction of the protected health information at the end of the litigation or
proceeding.
If the party seeking to discover
the HII attaches documentation providing that satisfactory assurances by either
method, the health care provider may disclose the patient’s medical records
without having a signed authorization from the patient himself.
The practical effect of the HIPPA
privacy rule has been an increase in the notice to the patients or their
representatives that protected health information is being sought and
potentially disclosed. Most third-party discovery requests under OCGA 9-11-34
are preceded by a letter from defense counsel to the patient’s counsel that
protected health information will be sought from a specific provider within 10
days via a 3rd party request. Patient’s counsel can acquiesce by
silence, consent affirmatively, or object to the provider. If privileged
materials may be contained within the requested materials the best practice is
to object in writing to the disclosure of the privileged materials only. This
procedure will adhere to HIPPA and allow for discovery and investigation of the
claim.
HIPPA prohibits ex parte
communication among defense counsel and the patient’s providers without the
patient’s consent concerning protected health information. This is HIPPAs most
significant impact on medical negligent litigation in Georgia. The net effect
of this change is to require more mutual interviews or depositions with providers
and to eliminate secret communications. While defense counsel’s unilateral
access to providers has been limited access through discovery tools, which
provides notice to all parties, is available. The Georgia civil practice act
intent was for all parties to have notice of discovery tools and HIPPA simply
requires that the disclosure protected health information is done with proper
notice also. The Court of Appeals has held that a surviving wife who brings a
wrongful death claim against medical providers for her husband’s death is
authorized to have the medical records of her deceased husband. Because she
brought the action under the Georgia wrongful death statute, and because under
the statute she has the authority to act for the deceased person, HIPPA does
not bar her from obtaining the records.
The Georgia Supreme Court has
ruled that HIPPA does not allow defense attorneys to informally interview
plaintiff’s treating physicians. Such ex parte contacts are not allowed under
the act, and the act takes precedence over Georgia law related to the discovery of a plaintiff’s
medical records.Contact in
Atlanta lawyer about your case today.