HIPAA Consult

EHRs and patient photos

Q. I've started incorporating digital pictures of my patients into their electronic health records for identification purposes. Does this require their authorization?

Q. I'm about to open a family practice. Can you outline the elements of a HIPAA patient authorization form?

A. Forms used to authorize record releases and other protected medical information must contain the following elements: (1) a description of the information to be released; (2) names of the people authorized to release it; (3) names of the recipients; (4) reasons for the disclosure (or, if your patient herself has initiated it, the phrase "at the request of the individual"); (5) an expiration date or terminating event (at the end of a research study, for example); (6) your patient's signature (or that of her personal representative, if so authorized); (7) the date the form was signed; (8) a statement that makes clear your patient's right to revoke her authorization at any time, and steps to accomplish this; (9) a statement noting that the information may be subject to redisclosure by the recipient, and thus no longer protected; and (10) depending upon the situation, a statement that makes clear that any treatment, payment, or benefits your patient receives aren't contingent on her signing the authorization.

Additionally, the authorization must be written in plain language and a patient copy provided, if she wasn't the one initiating the authorization.

Responding to subpoenas

Q. Under what circumstances may I release a patient's records in response to a subpoena?

A. This is a question that's frequently asked-but the answer bears repeating. You may do so if the requesting party has given you "satisfactory assurances" that (1) he has notified the patient and she has had enough time to object and (2) that he agrees to maintain the confidentiality of the information sought. You may also release protected information in response to a subpoena issued by a judicial officer, a grand jury, certain administrative officers, or court order.

Some states have additional rules you should be aware of. New York, for instance, requires that attorney-issued subpoenas for medical records must be accompanied by a patient authorization.

Margaret M. Davino (mdavino@kbrny.com
) is a healthcare attorney with Kaufman Borgeest & Ryan, in New York City.

This department answers common HIPAA-related questions. It isn't intended to provide specific legal advice. Please submit questions via e-mail to mehipaa@advanstar.com
, or by regular mail to Medical Economics, 5 Paragon Drive, Montvale, NJ 07645, ATTN: HIPAA CONSULT. If we select your query, we'll address it in an upcoming issue. Your name will not be used.