Sign In
    Wisconsin Lawyer
    October 01, 2003

    Practice Tips - Attorney Access to Medical Records

    In this follow up to an August article, the author elaborates on when health care providers can give patient health care records to the provider's outside counsel.

    Elizabeth Stone

    Wisconsin Lawyer
    Vol. 76, No. 10, October 2003

    Attorney Access to Medical Records

    In this follow up to an August article, the author elaborates on when health care providers can give patient health care records to the provider's outside counsel.

    by Elizabeth C. Stone illustration: medical file being closed

    The August Wisconsin Lawyer featured an article, "Attorney Access to and Use of Medical Records," that addressed the interplay between and impacts of the new privacy regulations (the "Privacy Rule") under the federal Health Insurance Portability and Accountability Act (HIPAA) and Wisconsin's existing patient records statute, found at Wis. Stat. sections 146.81 through 146.84, on attorneys' access to and use of client and third-party medical records.1 This companion article elaborates on when state law permits health care providers to disclose "patient health care records" (PHCR) to their outside counsel for the purpose of seeking legal representation without obtaining the patient's written informed consent ("authorization") to the disclosure.

    Exceptions to the General Authorization Rule

    As reported in the August article, the Privacy Rule includes a specific exception that enables covered health care providers to disclose health information to their attorneys for purposes of obtaining legal advice and representation.2 While the Wisconsin statute does not include such an express exception for disclosures to one's own counsel,3 such disclosures are appropriate in several circumstances. In addition to the exceptions mentioned in the August article, there are others that also enable providers to share PHCR with their counsel without first having to seek patient authorization or engage in some other process, such as obtaining a court order.

    To reiterate a point made in the earlier article, the state law applies only to the release of tangible records and thus does not regulate the exchange of information, for example, via oral communications.4 Thus, a provider's conversations with its counsel would not be subject to the state law authorization requirement.

    Elizabeth C. Stone Elizabeth C. Stone, Duke 1997, is an associate in the Madison office of von Briesen & Roper s.c. in the firm's Health Care Practice Group. She practices in health care issues, with a focus on regulatory compliance, including HIPAA. She formerly was an attorney in the U.W.-Madison Office of Administrative Legal Services, where she represented the U.W. Medical School, focusing on health care regulatory compliance and physician risk management.

    In addition, state law includes an exception for disclosures of records "needed for billing, collection, or payment of claims."5 This exception may be construed to cover a range of health care legal matters, including but not limited to billing compliance, collections work, disputes with insurers and other third party payers, and other types of claims, such as those for malpractice or breach of privacy.

    Another exception applies to disclosures to "health care facility staff committees ... for the purposes of conducting management audits, financial audits, program monitoring and evaluation, [and] health care services reviews."6 When counsel is assisting the staff committee in conducting such activities, as it might in the context of a root cause analysis, medical staff corrective action process, or compliance audit, this exception may be construed to permit disclosures to counsel for those purposes.

    Other exceptions to the general authorization rule may be found in statutes other than section 146.82. For example, section 146.38 permits disclosures of records (albeit with patient names redacted) in connection with peer review activities to "any person with the consent of the health care provider or facility whose services are being reviewed or evaluated."7 Moreover, disclosures may be made to the facility or individual "requesting the review or evaluation, for use solely for the purpose of improving the quality of health care."8 Notably, patients themselves are not given the right to request or authorize release of peer review records. Given the integral role attorneys often play in these activities and the absence of a patient right to authorize release of these records, one may conclude that attorneys are among those contemplated as permissible recipients of these types of records.

    To Learn More

    To learn more about the HIPAA federal Privacy Rule and Wisconsin medical privacy laws, please see these recent Wisconsin Lawyer articles:

    • Elizabeth C. Stone, Access to and Use of Medical Records, 76 Wis. Law. 18 (August 2003),
    • Timothy A. Hartin, Balancing Federal and Wisconsin Medical Privacy Laws, 76 Wis. Law. 10 (June 2003),
    • Timothy A. Hartin, New Federal Privacy Rules for Health Care Providers, 75 Wis. Law. 14 (April 2002),

    PCHR that have been deidentified may be shared with a provider's own attorneys without authorization. Because the HIPAA Privacy Rule permits disclosures of PHCR to one's own attorneys, the much more stringent standard for deidentification imposed at the federal level does not apply to disclosures to counsel. To comply with state law, the provider need only adhere to the more lenient state law deidentification standard.9

    Also worthy of note is the fact that some providers, such as hospitals, may have the required elements of state law authorization embedded in forms they routinely require patients to sign upon admission. Thus, when an authorization may appear necessary, attorneys should advise their clients to check whether the patient has already signed a form that would constitute valid authorization under state law.10

    As a final point, there is an argument that section 146.82 does not purport to limit a provider's sharing of information with its counsel at all. Although a literal reading of the statute may lead to the conclusion that disclosures to counsel are subject to the statute, the statute cannot have been intended to interfere with providers' ability to obtain legal representation, which would be the result in situations in which authorization is impossible to obtain, an applicable exception cannot be found, and a court order is unattainable without the very records, access to which the court order would seek to obtain.


    Because there is very little reported case law examining the scope of the patient records statute, the boundaries of the authorization rule and its exceptions are difficult to ascertain. However, a broad reading of these exceptions to support the disclosure of PHCR to a provider's outside counsel makes practical sense, as the patient records statute was likely not intended to interfere with a provider's communications with its attorneys, particularly given the confidentiality obligations already inherent in the attorney-client relationship. Given attorneys' integral role in many aspects of their provider clients' operational matters - as recognized by the Privacy Rule in its express authorization exception for disclosures to one's own counsel - a broad construction of the state law authorization exceptions comports with both practical reality and the new federal law.


    1Elizabeth C. Stone, Access to and Use of Medical Records, 76 Wis. Law. 18 (August 2003).

    245 C.F.R. §§ 164.501 (definition of "health care operations"), § .502(a)(1)(ii), .506.

    3See Wis. Stat. 146.82.

    4Wis. Stat. § 146.836.

    5Wis. Stat. § 146.82(2)(a)3.

    6Wis. Stat. § 146.82(2)(a)1.

    7Wis. Stat. § 146.38(3)(b).

    8Wis. Stat. § 146.38(3)(c).

    9See Wis. Stat. § 146.82(2)(a)20.

    10The required elements of an authorization under state law include the name of the patient; the type of information being disclosed; the types of health care providers making the disclosure; the purpose of the disclosure; the party to whom disclosure is being made; the patient's signature; the date of signature; and the time period within which the authorization is effective. Wis. Stat. § 146.81(2). Admission forms that contain these elements and provide for the disclosure of patient records for purposes of payment and other operational matters may, depending on their specific language, be broad enough to permit disclosures to the providers' attorneys in certain circumstances.

Join the conversation! Log in to comment.

News & Pubs Search

Format: MM/DD/YYYY