Vol. 76, No. 10, October 2003

Attorney Access to Medical Records

by Elizabeth C. Stone

The August Wisconsin Lawyer featured an article, "Attorney Access to and Use of Medical Records," that addressed the interplay between and impacts of the new privacy regulations (the "Privacy Rule") under the federal Health Insurance Portability and Accountability Act (HIPAA) and Wisconsin's existing patient records statute, found at Wis. Stat. sections 146.81 through 146.84, on attorneys' access to and use of client and third-party medical records.¹ This companion article elaborates on when state law permits health care providers to disclose "patient health care records" (PHCR) to their outside counsel for the purpose of seeking legal representation without obtaining the patient's written informed consent ("authorization") to the disclosure.

Exceptions to the General Authorization Rule

As reported in the August article, the Privacy Rule includes a specific exception that enables covered health care providers to disclose health information to their attorneys for purposes of obtaining legal advice and representation.² While the Wisconsin statute does not include such an express exception for disclosures to one's own counsel,³ such disclosures are appropriate in several circumstances. In addition to the exceptions mentioned in the August article, there are others that also enable providers to share PHCR with their counsel without first having to seek patient authorization or engage in some other process, such as obtaining a court order.

To reiterate a point made in the earlier article, the state law applies only to the release of tangible records and thus does not regulate the exchange of information, for example, via oral communications.⁴ Thus, a provider's conversations with its counsel would not be subject to the state law authorization requirement.

In addition, state law includes an exception for disclosures of records "needed for billing, collection, or payment of claims."⁵ This exception may be construed to cover a range of health care legal matters, including but not limited to billing compliance, collections work, disputes with insurers and other third party payers, and other types of claims, such as those for malpractice or breach of privacy.

Another exception applies to disclosures to "health care facility staff committees ... for the purposes of conducting management audits, financial audits, program monitoring and evaluation, [and] health care services reviews."⁶ When counsel is assisting the staff committee in conducting such activities, as it might in the context of a root cause analysis, medical staff corrective action process, or compliance audit, this exception may be construed to permit disclosures to counsel for those purposes.

Other exceptions to the general authorization rule may be found in statutes other than section 146.82. For example, section 146.38 permits disclosures of records (albeit with patient names redacted) in connection with peer review activities to "any person with the consent of the health care provider or facility whose services are being reviewed or evaluated."⁷ Moreover, disclosures may be made to the facility or individual "requesting the review or evaluation, for use solely for the purpose of improving the quality of health care."⁸ Notably, patients themselves are not given the right to request or authorize release of peer review records. Given the integral role attorneys often play in these activities and the absence of a patient right to authorize release of these records, one may conclude that attorneys are among those contemplated as permissible recipients of these types of records.

PCHR that have been deidentified may be shared with a provider's own attorneys without authorization. Because the HIPAA Privacy Rule permits disclosures of PHCR to one's own attorneys, the much more stringent standard for deidentification imposed at the federal level does not apply to disclosures to counsel. To comply with state law, the provider need only adhere to the more lenient state law deidentification standard.⁹

Also worthy of note is the fact that some providers, such as hospitals, may have the required elements of state law authorization embedded in forms they routinely require patients to sign upon admission. Thus, when an authorization may appear necessary, attorneys should advise their clients to check whether the patient has already signed a form that would constitute valid authorization under state law.¹⁰

As a final point, there is an argument that section 146.82 does not purport to limit a provider's sharing of information with its counsel at all. Although a literal reading of the statute may lead to the conclusion that disclosures to counsel are subject to the statute, the statute cannot have been intended to interfere with providers' ability to obtain legal representation, which would be the result in situations in which authorization is impossible to obtain, an applicable exception cannot be found, and a court order is unattainable without the very records, access to which the court order would seek to obtain.

Conclusion

Because there is very little reported case law examining the scope of the patient records statute, the boundaries of the authorization rule and its exceptions are difficult to ascertain. However, a broad reading of these exceptions to support the disclosure of PHCR to a provider's outside counsel makes practical sense, as the patient records statute was likely not intended to interfere with a provider's communications with its attorneys, particularly given the confidentiality obligations already inherent in the attorney-client relationship. Given attorneys' integral role in many aspects of their provider clients' operational matters - as recognized by the Privacy Rule in its express authorization exception for disclosures to one's own counsel - a broad construction of the state law authorization exceptions comports with both practical reality and the new federal law.

Endnotes

¹Elizabeth C. Stone, Access to and Use of Medical Records, 76 Wis. Law. 18 (August 2003).

²45 C.F.R. §§ 164.501 (definition of "health care operations"), § .502(a)(1)(ii), .506.

³See Wis. Stat. 146.82.

⁴Wis. Stat. § 146.836.

⁵Wis. Stat. § 146.82(2)(a)3.

⁶Wis. Stat. § 146.82(2)(a)1.

⁷Wis. Stat. § 146.38(3)(b).

⁸Wis. Stat. § 146.38(3)(c).

⁹See Wis. Stat. § 146.82(2)(a)20.

¹⁰The required elements of an authorization under state law include the name of the patient; the type of information being disclosed; the types of health care providers making the disclosure; the purpose of the disclosure; the party to whom disclosure is being made; the patient's signature; the date of signature; and the time period within which the authorization is effective. Wis. Stat. § 146.81(2). Admission forms that contain these elements and provide for the disclosure of patient records for purposes of payment and other operational matters may, depending on their specific language, be broad enough to permit disclosures to the providers' attorneys in certain circumstances.

Wisconsin Lawyer