Given that a patient’s health records reveal highly personal and sensitive details, federal and state law protects patients against the unwanted disclosure of their private health information. And for healthcare facilities and physicians, a particular and recurring area of concern in ensuring patient privacy relates to the release of medical records to personal-injury lawyers.
Some healthcare providers ensure patient-privacy compliance by not releasing patient medical records to attorneys of clients treated for motor-vehicle accidents. And if providers do release the records, some providers do not charge for them.
The release of private information must be examined in the context both of state requirements and the overarching federal law under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Under the privacy provisions of HIPAA, disclosure of patient medical records – designated under HIPAA as “protected health information” (PHI) – typically requires securing written authorization from the patient. Yet under certain clearly defined circumstances, this requirement may be waived without the need for a HIPAA-compliant release signed by the patient. These exceptions are rare, however, and lawyers representing personal-injury clients do not fall within HIPAA’s Business Associate exception.
Personal-injury lawyers often charge one-third or more of the settlement or judgment, that collection being a function of “special damages.” Thus, medical bills incurred by the patient for injuries have particular importance to the personal-injury case: They are required for, and form the basis of, the total recovery.
In such cases, providers often ask their legal counsel if medical bills are considered part of a patient’s chart governed under HIPAA as PHI? The answer is yes.
Case in point: A hospital receives a letter from an attorney regarding a client who was in a car accident, asking for her emergency-room records. Besides the clinical chart, the personal-injury lawyer needs the hospital’s itemized statement and the emergency-room doctor’s claim form. But those bills contain PHI revealing the patient’s condition, possibly including incriminating and embarrassing information.
Before acting on the request, the hospital must answer such difficult questions as: Was the patient addicted to any drugs or using alcohol? Did the patient have any mental disorders, HIV or cancer in remission – conditions concealed from family and/or the patient’s employer?
The problem is, deeply personal and sensitive aspects of a person’s private life are revealed not only in the clinical chart but also in the bill, with all its codes and summarized procedures. In some facilities, the patient-accounts office generates the invoice, while the medical-records department maintains the clinical chart. As HIPAA is designed to safeguard the patient, the patient’s bill, which codes all significant health conditions, is part of the protected medical chart.
So how should the hospital respond to the personal-injury lawyer who is vigorously asserting her client’s case to the auto-insurance carrier? To abide by HIPAA regulations, the hospital should ask the attorney’s client to sign a HIPAA-compliant release form approved by the hospital’s legal counsel.
Indeed, a letter written on the attorneys’ letterhead and signed by her client may not be sufficient to authorize the release of the bill, since it is considered PHI under HIPAA. While that letter may comply with state mandates protecting the unauthorized release of medical information, HIPAA is another matter. When in doubt, go with a HIPAA-compliant release that includes an authorization signed by the patient allowing the named attorney to receive a copy both of the clinical chart and the invoice.
Requests for billing statements made for the purpose of a personal-injury claim are not required by law; they are needed for a civil case between the injured patient and at-fault party. The healthcare provider, therefore, is allowed under HIPAA’s Privacy Rule to charge for copying (including the cost of supplies and labor), postage, as well as – if requested – a summary or explanation of the services and fees.
These charges must be reasonable and are often limited by additional state law requirements. The significance, however, is that hospitals, doctors and rehabilitation facilities should not give information to a patient or personal-injury attorney without managing the associated costs. For providers, charging for patient records is a practical way to reduce expenses and recapture costs.
Anderson & Quinn, LLC is a renowned law firm based in Rockville, Maryland, providing individuals, businesses, corporations, and healthcare institutions with the legal and litigation support they need.
