By Sonia Teas, U.W. Law School

Dec. 2, 2009 – This article addresses frequently asked questions concerning the privacy of health information when a patient or provider is involved in an investigation or legal proceeding. This article was originally published in the November 2009 Wisconsin Health Law News, published by the State Bar’s Health Law Section.

Question

In the course of an investigation into a legal claim or inquiry, can a health care provider disclose a patient’s personal health information (PHI) to its own legal counsel for review without patient authorization?

Answer

Wisconsin law allows covered health care entities to release PHI without patient authorization for purposes of “health care operations,”¹ which includes medical review and legal services. PHI used by a covered entity for these purposes is, in effect, not subject to statutory restrictions.²

Under Wisconsin state law, the release of PHI “made for purposes of health care operations, as defined in 45 CFR 164.501, and as authorized under 45 CFR 164, subpart E,” is not prohibited by the state statute governing confidentiality of health care records.³ HIPAA, in part, defines health care operations as “conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs,” to the extent such activities are related to the entity’s covered functions.⁴

The Wisconsin Mental Health Act does not indicate an exception for the release of mental health treatment records for the purpose of “health care operations.”⁵ Confidential information about a patient within a treatment facility may be disclosed to employees of the facility “when and to the extent that performance of their duties requires that they have access to such information.”⁶ Under Wis. Stat. 51.30, “treatment records” has been expanded to include all records created during registration and treatment by licensed psychologists or licensed mental health professionals who are not affiliated with a county department or treatment facility.⁷

Question

When can a covered entity disclose PHI to opposing counsel in the course of a judicial or administrative proceeding?

Answer

Wisconsin law permits the disclosure of PHI for judicial or administrative proceedings only “under a lawful order of a court of record.”⁸ HIPAA allows disclosure of PHI in response to a court order, but also in response to a “subpoena, discovery request, or other lawful process” that complies with the protocols laid out in 45 CFR § 164.512(e)(1)(ii).⁹ However, since Wisconsin law is the more stringent requirement, it preempts HIPAA for disclosures of PHI in judicial and administrative proceedings,¹⁰ and a court order is always required unless the patient/plaintiff authorizes the disclosure.¹¹ In addition, only the specific health information authorized by the court order can be released.¹² Wisconsin law has the same standard for the release of mental health records.¹³

Question

What is the scope of government agencies’ access to PHI without the patient authorization?

Answer

Both HIPAA and Wisconsin law allow disclosure of PHI without patient authorization for government health oversight activities.¹⁴ Presumably, releases of PHI to government agencies for compliance and review purposes would be included in the Wisconsin statute’s exception for “releases made for purposes of health care operations.”¹⁵ However, Wisconsin law also specifically stipulates that PHI can be released without patient consent to accreditation or health care services review organizations for management audits, financial audits, program monitoring and evaluation, and health care services reviews or accreditation.¹⁶ In addition, the Wisconsin statute provides a non-exhaustive list of functions for which a covered entity may disclose PHI in response to a written request from a federal or state agency.¹⁷ These functions include management audits, financial audits, program monitoring and evaluation, and licensure and certification.¹⁸

HIPAA allows the disclosure of PHI for public health and health oversight activities to agencies authorized by law to collect such information.¹⁹ Public health activities are related to preventing or controlling disease, injury, and disability, and include public health reporting, surveillance, investigation, and interventions by a public health authority.²⁰ HIPAA’s definition of a public health authority includes individuals or agencies acting on behalf of the government.²¹ Health oversight agencies also have access to PHI for use in audits, legal investigations and proceedings, inspections, licensure or disciplinary actions, and other necessary health oversight activities.²²

Wisconsin law is much more stringent for government agencies’ access to mental health treatment records. The Wisconsin statute restricts disclosure of confidential information to “an individual, organization or agency designated by the department or as required by law for the purposes of management audits, financial audits, or program monitoring and evaluation.”²³

This article is published courtesy of the November 2009 edition of Wisconsin Health Law News, published by the State Bar’s Health Law Section. The State Bar offers its members the opportunity to network with other lawyers who share a common interest through its 26 sections. Section membership includes access to newsletters, email lists to facilitate information sharing, and other resources.

Endnotes

¹Wis. Stat. § 146.82(1) (2007-08).
²45 C.F.R. § 164.501(?)(4) (2009).
³Wis. Stat. § 146.82(1).
⁴45 C.F.R. § 164.501(?)(4).
⁵Wis. Stat. § 51.30(4).
⁶ Id. § 51.30(4)(b)(6).
⁷2009 Wis. Act 28. sec. 1427r, (to be codified at Wis. Stat. § 51.30(1)(b)).
⁸Wis. Stat. § 146.82(2)(4) (2007-08); see also 8 Wis. Prac., Civil Discovery § 16:4 (2d ed.). (explaining that a court order would “presumably include a subpoena signed by a judge,” and that the Supreme Court of Wisconsin has held that “a ‛lawful order’ includes an order compelling a party to answer interrogatories, even if the answer includes health care information about a non-party”).
⁹45 C.F.R. § 164.512(e) (2009).
¹⁰8 Wis. Prac., Civil Discovery § 16:4 (2d ed.).
¹¹Wis. Stat. § 146.82(1).
¹²45 C.F.R. § 146.512 (e)(i).
¹³Wis. Stat. § 51.30(4)(b)(4); see also8 Wis. Prac., Civil Discovery § 16:4 (2d ed.). (explaining that the Supreme Court of Wisconsin views “lawful order” more narrowly in relation to mental health records).
¹⁴ Id. § 146.82(2); 45 C.F.R. § 164.512(d) (2009).
¹⁵Wis. Stat. § 146.82(1).
¹⁶Wis. Stat. § 146.82(2)(1).
¹⁷Id. § 146.82(2)(5).
¹⁸Id.
¹⁹45 C.F.R. §§ 164.512(b), 164.512(d).
²⁰Id. § 164.512(b)
²¹Id. § 164.501
²²Id. § 164.512(d)
²³Wis. Stat. § 51.30(4)(b)(1).