Vol. 76, No. 10, October
Attorney Access to Medical Records
In this follow up to an August article, the
author elaborates on when health care providers can give patient health
care records to the provider's outside counsel.
by Elizabeth C. Stone
The August Wisconsin Lawyer featured an article, "Attorney
Access to and Use of Medical Records," that addressed the interplay
between and impacts of the new privacy regulations (the "Privacy Rule")
under the federal Health Insurance Portability and Accountability Act
(HIPAA) and Wisconsin's existing patient records statute, found at Wis.
Stat. sections 146.81 through 146.84, on attorneys' access to and use of
client and third-party medical records.1
This companion article elaborates on when state law permits health care
providers to disclose "patient health care records" (PHCR) to their
outside counsel for the purpose of seeking legal representation without
obtaining the patient's written informed consent ("authorization") to
Exceptions to the General Authorization Rule
As reported in the August article, the Privacy Rule includes a
specific exception that enables covered health care providers to
disclose health information to their attorneys for purposes of obtaining
legal advice and representation.2 While the
Wisconsin statute does not include such an express exception for
disclosures to one's own counsel,3 such
disclosures are appropriate in several circumstances. In addition to the
exceptions mentioned in the August article, there are others that also
enable providers to share PHCR with their counsel without first having
to seek patient authorization or engage in some other process, such as
obtaining a court order.
To reiterate a point made in the earlier article, the state law
applies only to the release of tangible records and thus does not
regulate the exchange of information, for example, via oral
communications.4 Thus, a provider's
conversations with its counsel would not be subject to the state law
Stone, Duke 1997, is an associate in the Madison office of von
Briesen & Roper s.c. in the firm's Health Care Practice Group. She
practices in health care issues, with a focus on regulatory compliance,
including HIPAA. She formerly was an attorney in the U.W.-Madison Office
of Administrative Legal Services, where she represented the U.W. Medical
School, focusing on health care regulatory compliance and physician risk
In addition, state law includes an exception for disclosures of
records "needed for billing, collection, or payment of claims."5 This exception may be construed to cover a range
of health care legal matters, including but not limited to billing
compliance, collections work, disputes with insurers and other third
party payers, and other types of claims, such as those for malpractice
or breach of privacy.
Another exception applies to disclosures to "health care facility
staff committees ... for the purposes of conducting management audits,
financial audits, program monitoring and evaluation, [and] health care
services reviews."6 When counsel is
assisting the staff committee in conducting such activities, as it might
in the context of a root cause analysis, medical staff corrective action
process, or compliance audit, this exception may be construed to permit
disclosures to counsel for those purposes.
Other exceptions to the general authorization rule may be found in
statutes other than section 146.82. For example, section 146.38 permits
disclosures of records (albeit with patient names redacted) in
connection with peer review activities to "any person with the consent
of the health care provider or facility whose services are being
reviewed or evaluated."7 Moreover,
disclosures may be made to the facility or individual "requesting the
review or evaluation, for use solely for the purpose of improving the
quality of health care."8 Notably, patients
themselves are not given the right to request or authorize release of
peer review records. Given the integral role attorneys often play in
these activities and the absence of a patient right to authorize release
of these records, one may conclude that attorneys are among those
contemplated as permissible recipients of these types of records.
To Learn More
To learn more about the HIPAA federal Privacy Rule and Wisconsin
medical privacy laws, please see these recent Wisconsin Lawyer
- Elizabeth C. Stone, Access to and Use of Medical Records,
76 Wis. Law. 18 (August 2003), www.wisbar.org/wislawmag.
- Timothy A. Hartin, Balancing Federal and Wisconsin Medical
Privacy Laws, 76 Wis. Law. 10 (June 2003), www.wisbar.org/wislawmag.
- Timothy A. Hartin, New Federal Privacy Rules for Health Care
Providers, 75 Wis. Law. 14 (April 2002), www.wisbar.org/wislawmag.
PCHR that have been deidentified may be shared with a provider's own
attorneys without authorization. Because the HIPAA Privacy Rule permits
disclosures of PHCR to one's own attorneys, the much more stringent
standard for deidentification imposed at the federal level does not
apply to disclosures to counsel. To comply with state law, the provider
need only adhere to the more lenient state law deidentification
Also worthy of note is the fact that some providers, such as
hospitals, may have the required elements of state law authorization
embedded in forms they routinely require patients to sign upon
admission. Thus, when an authorization may appear necessary, attorneys
should advise their clients to check whether the patient has already
signed a form that would constitute valid authorization under state
As a final point, there is an argument that section 146.82 does not
purport to limit a provider's sharing of information with its counsel at
all. Although a literal reading of the statute may lead to the
conclusion that disclosures to counsel are subject to the statute, the
statute cannot have been intended to interfere with providers' ability
to obtain legal representation, which would be the result in situations
in which authorization is impossible to obtain, an applicable exception
cannot be found, and a court order is unattainable without the very
records, access to which the court order would seek to obtain.
Because there is very little reported case law examining the scope of
the patient records statute, the boundaries of the authorization rule
and its exceptions are difficult to ascertain. However, a broad reading
of these exceptions to support the disclosure of PHCR to a provider's
outside counsel makes practical sense, as the patient records statute
was likely not intended to interfere with a provider's communications
with its attorneys, particularly given the confidentiality obligations
already inherent in the attorney-client relationship. Given attorneys'
integral role in many aspects of their provider clients' operational
matters - as recognized by the Privacy Rule in its express authorization
exception for disclosures to one's own counsel - a broad construction of
the state law authorization exceptions comports with both practical
reality and the new federal law.
1Elizabeth C. Stone, Access to
and Use of Medical Records, 76 Wis. Law. 18 (August 2003).
245 C.F.R. §§ 164.501
(definition of "health care operations"), § .502(a)(1)(ii),
3See Wis. Stat.
4Wis. Stat. § 146.836.
5Wis. Stat. §
6Wis. Stat. §
7Wis. Stat. §
8Wis. Stat. §
9See Wis. Stat. §
10The required elements of an
authorization under state law include the name of the patient; the type
of information being disclosed; the types of health care providers
making the disclosure; the purpose of the disclosure; the party to whom
disclosure is being made; the patient's signature; the date of
signature; and the time period within which the authorization is
effective. Wis. Stat. § 146.81(2). Admission forms that contain
these elements and provide for the disclosure of patient records for
purposes of payment and other operational matters may, depending on
their specific language, be broad enough to permit disclosures to the
providers' attorneys in certain circumstances.