HIPAA Consult

Answers to your questions about . . .

By Sofia R. Plotzker, JD

Another doctor's record

Q: May I disclose, for treatment purposes, parts of a medical record that were created by another doctor?

A: Yes. Once a record becomes part of your patient chart, you should treat it like any other information in the chart. Thus, you may disclose parts of the medical record that were created by another doctor, but, in so doing, you must comply with the privacy rule.

If a patient requests a copy of her entire medical record, you're generally required to include portions that were created by other providers. But you can deny a patient's request to amend a portion of the medical record created by someone else, unless that doctor is no longer available to make the amendment himself.

Consults and charts

Q: Must I obtain authorization to send a medical record to another doctor who's treating the same patient?

A: No. You needn't obtain an authorization for the purpose of treatment. Although HIPAA has certainly been a headache to implement, the intent of the law isn't to impede patient care. Information can continue to flow freely between providers involved in a patient's treatment.

The "minimum necessary" rule

Q:Under what conditions may I use, disclose, or request an entire medical record?

A: The privacy rules don't prohibit you from using, disclosing, or requesting an entire medical record. But, in so doing, you are bound by the "minimum necessary" rule, which mandates that you disclose or request the minimum information necessary to get the job done.

There are a number of exceptions to this rule, however. First, you are permitted to share a patient's entire medical record with any provider participating in that patient's care.

Second, you can provide the entire record to a patient who is the subject of that record. For example, if she requests a copy of her record for the purpose of obtaining life insurance, you aren't required to determine what exactly in the file is applicable to the life insurance application and what's not.

The other exceptions to the minimum necessary rule are:

• when a patient has authorized it

• to comply with the HIPAA administrative simplification rules

• when the Department of Health and Human Services requires disclosure for enforcement purposes under the privacy rule

• when it's required by other laws

Your privacy compliance plan should include written policies and procedures that spell out which employees are authorized to see the entire record. Since all employees in a small medical practice typically need such access, you should be sure to document this fact. For all other circumstances, determination of whether disclosure of the entire record is necessary should be conducted on a case-by-case basis.

Sofia R. Plotzker is an attorney with The Health Care Group in Plymouth Meeting, PA. She can be reached at splotzker@healthcare group.com. This department answers common HIPAA-related questions. It isn't intended to provide specific legal advice. If you have a question, please submit it via e-mail to mehipaa@medec.com, or by regular mail to Medical Economics, 5 Paragon Drive, Montvale, NJ 07645. ATTN: HIPAA CONSULT. If we select your query, we'll address it in an upcoming issue. Your name will not be used.

Sofia Plotzker. HIPAA Consult: Answers to your questions about . . ..

Medical Economics

Aug. 8, 2003;80:27.