HIPAA Consult

Patients who lie

Q. If a patient misrepresents himself to me-to obtain narcotics, for instance-is our encounter still protected under HIPAA?

Q. A. patient has asked us to send copies of her records to another physician's office. Normally, we charge for this service, but we don't expect her to pay us because she already has unpaid balances. Are we obligated to send these records, even though we anticipate not being paid?

A. Yes. Under HIPAA, patients have the right to obtain copies of their records. And although you have the corresponding right to charge for these copies, you can't withhold them if a patient is legitimately unable to pay.

Disposing of medical records

Q. Under HIPAA, who bears the responsibility (including cost) for discarding old patient records that contain protected health information-the employed physician or the practice he works for?

A. Typically, the practice, since it has the duty to retain the records in the first place. But check your state's law to determine how long they must be retained. In New York, for instance, physicians must maintain patient records for at least six years or, in the case of a minor, for at least one year after the patient turns 18; anyone who doesn't may face professional misconduct charges.

Also at issue is how one discards records containing protected healthcare information. Under HIPAA, anyone disposing of records must do so in a way that minimizes the risk of exposure to unauthorized users-through shredding, for example.

Report an impaired driver

Q. New York doctors have access to forms to alert the DMV when one of their patients needs her driving competency re-evaluated. If a patient protests, as one of my elderly patients did, may I submit this form anyway, without violating her rights under HIPAA or any other patient-confidentiality law?

A. That depends. Under HIPAA, physicians can disclose protected health information to authorized agencies engaged in certain public health activities (typically, preventing or controlling disease, injury, or disability). The case you describe-that of reporting an elderly driver whose impairments may jeopardize her ability to drive safely-seems to fall into the category of public health. But it's uncertain whether the DMV would be considered a "public health authority." And the New York State DMV's website contains no guidance on this issue. One option might be to contact the DMV directly, being sure to get in writing whatever guidance it offers.

Margaret M. Davino (mdavino@kbrny.com
) is a healthcare attorney with Kaufman Borgeest & Ryan, in New York City.

This department answers common HIPAA-related questions. It isn't intended to provide specific legal advice. Please submit questions viae-mail to mehipaa@advanstar.com
, or by regular mail to Medical Economics, 5 Paragon Drive, Montvale, NJ 07645, ATTN: HIPAA CONSULT. If we select your query, we'll address it in an upcoming issue. Your name will not be used.