MDS Alert

Question: Who's authorized to make a request to review a resident's medical record? Can a facility get in HIPAA trouble for showing a resident's medical records to an adult child or spouse who may not be authorized to read them?

Answer: "Under HIPAA, only the resident or the resident's personal representative has the right to access and review the medical records," explains attorney Heather Berchem, partner with Murtha Cullina LLP in New Haven, Conn. "A personal representative is defined as anyone authorized by law to act on behalf of a resident in making decisions related to health care. Therefore, a family member or spouse without more [than that] has insufficient authority to look at a resident's record unless you have a written authorization from the resident," she adds.

"This is distinguished from information that may be given to a family member or other person 'involved in the resident's care' or for notification purposes. HIPAA permits a covered entity to disclose PHI without an authorization to a person involved in the resident's health care -- or to notify a family member of the resident's location, general condition or death," Berchem explains.

"Under this exception, you are required to give the resident an opportunity to agree, object or limit the disclosure unless the resident is not capable or if there is an emergency. However, this exception is intended only to provide limited information to those involved in the resident's care," Berchem adds. Therefore, don't use the exception to "justify showing a family member the actual resident record."

In cases "where a resident becomes impaired and cannot make their own decisions, a conservator or similar health care representative must be appointed. Again, HIPAA provides for some limited information to be released to family or others involved in the resident's care where the resident is not capable or in an emergency, if the covered entity determines it is in the resident's best interest," Berchem advises.