HIPAA: Compliance is Important
by Melinda Eitzen
HIPAA (Health Insurance Portability and Accountability Act) applies to many of our cases in family law, personal-injury, criminal law and other areas. Recently, judges have sanctioned some lawyers for incorrectly seeking medical information. There a couple of simple rules to remember to avoid this problem.
- Rule 1: secure a HIPPA release before accepting documents.
A lawyer issues a trial subpoena to a "covered entity" (counselor, doctor etc.) under HIPAA. Prior to the hearing, the doctor contacts the serving lawyer to ask if she can avoid appearing at the hearing by sending the medical records. In this example the covered entity does not have a HIPAA release from the patient.
The problem with this scenario is that we are not required to send copies of our trial subpoenas to opposing counsel and opposing counsel likely does not have notice that the records are being sought. The covered entity should not release those records without a HIPAA release; however, the provider may mistakenly believe that the subpoena affords the provider permission to release those records. The lawyer, representing a party in the suit and not the covered entity has no duty to advise them otherwise. Now, the lawyer, by accepting the records prior to the hearing has circumvented the rules and protections provided by the Texas Rules of Civil Procedure. The opposing counsel never had an opportunity to object to his client’s records being released. Remember that the Rules of Civil Procedure are designed to make sure that the opposing party, and the person or entity being subpoenaed, have proper notice and opportunity to object prior to medical records being provided.
- Rule 2: recognize that HIPPA may provide for different notice requirements than those found in our courts’ procedural rules.
A lawyer subpoenas a doctor to a hearing and requests that the doctor provide medical records from the hospital. The lawyer gives the doctor only four days’ notice of the hearing. Texas Administrative Code 165.2 provides the medical doctor a right to 15 days’ notice; four days’ notice is not adequate. Note that this provision does not appear to apply to all covered entities under HIPAA but does apply to physicians.
One possible solution is, instead of issuing a subpoena for the medical records for the hearing, move for an order requiring the party whose records are sought to sign a proper HIPAA release.
- Rule 3: act quickly to prevent the release of records if necessary.
Your client’s medical records are being sought, but your client does not want them to be released. The medical provider has received a subpoena of which you, the lawyer, are aware. The lawyer needs to make the medical provider aware immediately of the client’s objection to the release of the records. Furthermore, the lawyer needs to file a motion to quash the subpoena with the court and force a hearing on the issue. There are several options available to the court, including: 1) Prohibiting release of the medical records; 2) Allowing a release of the records but only to the judge for in-camera inspection; 3) Allowing only a portion of the records to be released; and/or 4) Allowing the records or a portion of the records to be released but only with a confidentiality order in place.
- Rule 4: only share medical information if . . .
If you represent a healthcare provider you should instruct your client, the medical provider, not to speak to anyone about their patient or release records without either 1) a proper HIPAA release signed by the patient or 2) an order signed by a judge ordering the medical provider to release the documents. Typically in this instance, a subpoena is not an order.
- Rule 5: Not all releases are proper releases—make sure yours are.
If you are using a HIPAA release make sure that it is a proper HIPAA release. All releases are not created equal. The law has very specific requirements regarding what should and should not be included in a HIPAA release. For example, it must have a specific end date. It must have a separate paragraph specifically stating that they medical provider can or cannot release information about substance abuse. It must have a separate paragraph stating that the medical provider can or cannot release information regarding the patient’s HIV status. It must specifically state by name of the person to whom the information can be released and for what purpose.
Failure to properly comply with HIPAA can result in fines and in extreme cases, criminal penalties. In addition, no one wants to be sanctioned by a judge. Following the tips above will save you time, money and aggravation.
Melinda Eitzen practices family law at Duffee+Eitzen and can be reached at email@example.com.