Health Information Compliance Alert

Question: What should we do when our state law requires restriction or withholding of patient records but HIPAA requires patient access?

Answer:  “This is a true dilemma,” stated Bruce Borkosky, Psy.D., in a February 2014 whitepaper, “HIPAA’s Patient Access Rights,” for MalvernGroup Incorporated. And this can occur in many different circumstances, such as when there is potential harm to the patient or when the law restricts release of psychological test data to psychologists only.

If you withhold protected health information (PHI), you would be in compliance with state law but may be subject to a HIPAA complaint, Borkosky lamented. And vice versa — if you release the PHI, you’ll be in compliance with HIPAA but may be subject to a state licensing complaint.

Solution: You would be wise to seek legal counsel on the matter, Borkosky advised. “Some state boards might be willing to offer guidance personally or via a declaratory statement (public guidance provided at an official meeting of the board).” You might be protected from legal liability “under the color of law,” if you have an opinion from an attorney.

Another strategy: You also could confer with the patient, explaining the dilemma, and discuss whether there might be some way to meet the patient’s needs and comply with both laws, Borkosky said. Yet another solution would be to seek a judicial opinion from a federal court, if you and the patient cannot reach a resolution. But remember that “taking a case to court is often very expensive, both in time and money,” he added.