Anesthesia Coding Alert

Question: Who’s authorized to make a request to review a patient’s medical record? Would you be in violation of the Heath Information Portability and Accountability Act (HIPAA) for showing the medical records to an adult child or spouse who may not be authorized to view them?

New York Subscriber

Answer: “Under HIPAA, only the patient or the patient’s personal representative has the right to access and review the medical records,” explains attorney Heather Berchem, partner with Murtha Cullina LLP in New Haven, Conn.

A personal representative is defined as anyone authorized by law to act on behalf of a resident in making decisions related to health care. Therefore, “a family member or spouse without more [than that] has insufficient authority to look at a resident’s record unless you have a written authorization from the patient,” Berchem adds.

“This is distinguished from information that may be given to a family member or other person ‘involved in the patient’s care’ or for notification purposes. HIPAA permits a covered entity to disclose PHI without an authorization to a person involved in the patient’s health care — or to notify a family member of the resident’s location, general condition or death,” Berchem explains.

“Under this exception, you are required to give the client an opportunity to agree, object or limit the disclosure unless the patient is not capable or if there is an emergency. However, this exception is intended only to provide limited information to those involved in the patient’s care,” Berchem adds. Therefore, don’t use the exception to “justify showing a family member the actual patient record.”

In cases “where a patient becomes impaired and cannot make their own decisions, a conservator or similar health care representative must be appointed,” Berchem advises. Again, HIPAA provides for some limited information to be released to family or others involved in the client’s care where he or she is not capable or in an emergency, if the covered entity determines it is in the client’s best interest, she adds.

Operationally, some practices allow the patient to designate those in their family to which the disclosure of PHI is allowed as part of the notice of patient privacy (NPP). The patient fills in who may be given PHI and signs this form as part of the HIPAA package. With this, the practice is then given permission to disclose information to those such as a spouse or adult children of a patient. Similarly, patients can specify people that they want to never have access to their PHI as part of the NPP. You will often find this comes from parents in a divorce situation or divorcées excluding their ex-spouse from any PHI.