This article provides a general overview of the federal and state laws governing medical privacy, including 2024 updates to the Confidentiality of Substance Use Disorder Patient Records regulations (42 C.F.R. pt. 2), and discusses some of the practical applications of these laws, especially in litigation.
Medical Privacy Laws (Re)introduced
Both federal and state laws protect patient health information and records. Federal law sets a minimum standard for privacy protections and usually preempts any state laws that do not meet that standard. But when state law provides greater protection for patient privacy – which is the situation in Wisconsin – then state law applies.1
Although they are not the focus of this article, the rules of evidence afford additional protections to patient health records. Attorneys should familiarize themselves with the privilege between health care providers and patients, which is defined along with its many exceptions at Wis. Stat. section 905.04.
Medical Records
Federal Law: HIPAA. The term “medical privacy laws” probably brings to mind the Health Insurance Portability and Accountability Act, also known as HIPAA.2 First passed in 1996, HIPAA requires covered entities – including health care providers, insurers, and health care clearinghouses – to protect the privacy, confidentiality, and security of electronically stored health information. HIPAA also applies to the business associates of covered entities, including law firms that represent covered entities or other business associates that have access to protected health information.3
Diane Welsh, Washington College of Law – American Univ. 1998, is a partner in Pines Bach LLP, Madison, and a member of the litigation and transactional practice groups. She has more than 25 years’ experience in government, administrative, and health law. Her experience advising top-level state officials allows her to evaluate regulatory and legal problems and recommend and implement strategic, pragmatic solutions for her clients, including health care providers, organizations, and individuals.
Elizabeth Pierson, Yale 2018, is an attorney in the litigation practice group at Pines Bach LLP, Madison. Her practice includes labor and employment, elections and democracy, environmental, and health care law. She previously worked at two nonprofit law firms and clerked for a federal district court judge.
Rosemary Reniero, U.W. 2024, is an attorney in the family law practice group at Pines Bach LLP, Madison. Her practice includes divorce and legal separation, child custody and placement, and paternity adjudication, among other areas of family law.
Broadly speaking, HIPAA’s Privacy Rule forbids covered entities and business associates from using or disclosing patients’ protected health information (not only documents) without patient authorization, except under specific exceptional circumstances. “Protected health information” includes information that “[r]elates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.”4 When information can be shared, the Privacy Rule generally requires covered entities to release only the minimum required health information (a provision also known as the “Minimum Necessary Rule”) and to inform patients of how their information might be or has been used or disclosed. Patients, meanwhile, have the right to access and correct their health records and to consent or refuse consent to certain uses of their health information.5
In 2009, Congress passed the Health Information Technology for Economic and Clinical Health Act (HITECH Act), which strengthened and extended HIPAA protections and created obligations for reporting breaches.
State Law: Wis. Stat. Section 146.82. Wisconsin law provides even stronger protections for the confidentiality of patient health records, codified at Wis. Stat. section 146.82. The statute establishes a strong presumption of confidentiality: “All patient health care records shall remain confidential. Patient health care records may be released only to the persons designated in this section or to other persons with the informed consent of the patient or of a person authorized by the patient.”6
Subsection (2) of the statute lays out the limited, specific circumstances in which health care records can be released without the informed consent of the patient. These circumstances generally arise in the contexts of health care, medical research, billing, certain lawful requests from governmental agencies or courts, investigations into abuse of children or older adults, schools, foster care, and prisons and jails.7 In litigation, absent informed consent of the patient, a subpoena is insufficient. Rather, “a lawful order of a court of record” is required.8
Mental Health and Substance Abuse Disorder Treatment Records
Federal Law: 42 C.F.R. Part 2. Health rec-ords concerning treatment for substance use disorders enjoy additional protections under 42 U.S.C. § 290dd-2 and its implementing regulation, 42 C.F.R. part 2. These privacy protections encourage patients to seek treatment for addictions.
The federal statute and regulations provide broad protections for records related to treatment for substance use, covering even the simple fact that a specific person has received or is receiving such treatment.9 The statute includes a specific provision for court-ordered disclosure of records (discussed below).10 Absent such an order – or the informed consent of the client – the records are generally confidential. There is no special exception for law enforcement or all court proceedings, except as authorized by court order and consistent with the federal law.11
Violating these privacy provisions may subject a person to criminal liability.12
State Law: Wis. Stat. Section 51.30.Wisconsin statutes also protect the confidentiality of registration and treatment records “that are created in the course of providing services to individuals for mental illness, developmental disabilities, alcoholism, or drug dependence.”13 The statute sets out very specific requirements for informed consent for record disclosure. As in the more general state medical privacy statute, this statute carves out some exceptions in which confidential records may be disclosed without consent, including “[p]ursuant to a lawful order of a court of record.”14 Regulations at Wis. Admin. Code chapter DHS 92 further govern confidential treatment records.
State law privacy protections for mental health records are more stringent than the HIPAA Privacy Rule, but not necessarily more stringent than the protections for substance use disorder treatment records, which are subject to 42 C.F.R. part 2, as discussed above.
Real-life Applications and Practice Tips: When Health Records May Be Needed in Litigation
There are countless scenarios in which an attorney might want to access and introduce health records belonging to a client, an opposing party, or another relevant party.
Family Law. Medical information can be relevant to family law proceedings at nearly every step and over extended periods of time. For example, protected medical information of parents, children, and third parties may be directly relevant to four of the “best interest” factors a court considers when establishing or modifying a custody or placement order.15 (See sidebar for special considerations surrounding the medical records of children.)
Medical information may also be relevant to the financial aspects of a family court case. Medical information is directly relevant to the maintenance analysis in divorce and support proceedings.16 Furthermore, arguments over earning capacity and the court’s ability to impute income to a party shirking a support obligation may result in the court considering the economic effects of the parties’ physical health, mental health, or both.
Juvenile and Adult Guardianship. Juvenile and adult guardianship proceedings may also implicate medical records both at the appointment phase and throughout the term of the guardianship. Covered entities engage often with guardians who, by law, may access and consent to release of confidential information of their wards.
Probate. Medical records of recently deceased persons may be relevant to probate proceedings. Privacy laws provide certain protections to the records of deceased persons who died within the past 50 years.17
Other Civil Proceedings. Plaintiffs in worker’s compensation or personal injury lawsuits generally must introduce some medical records to prove their case. Civil rights attorneys bringing cases based on disability discrimination may need to include proof of the client’s medical status. Attorneys assisting medical professionals with licensure defense may need to review and submit the medical records of complainants against those professionals. Immigration attorneys may need to access medical records to support applications for humanitarian relief, such as asylum, U-Visas, or deportation defense. Near the intersection of family law and criminal law, termination-of-parental-rights cases can involve the state seeking to introduce records of a parent’s history of substance use disorder or mental illness. And the list goes on.
Criminal Practice. Medical privacy issues can also arise in criminal practice. Prosecutors may need to introduce a victim’s medical records to prove an element of a crime, such as battery. Criminal defense attorneys may wish to introduce records of a client’s mental health treatment at the sentencing stage, for mitigation. In the past, defense attorneys could seek to introduce victims’ mental health records as part of a client’s defense, as a judicially created exception to the victim’s health care provider privilege, but the Wisconsin Supreme Court recently eliminated this right.18
Limitations On the Use of Health Records in Litigation
Authorizations: Proceed with Caution. Authorizations to disclose protected health information are a standard part of certain legal matters. The authorization must comply with specific federal and state requirements, set out in 45 C.F.R. § 164.508(c), as well as Wis. Stat. section 252.15(3m)(b) (restricting disclosure of HIV status records). A release of mental health records must comply with Wis. Stat. section 51.30(2). Authorizations for substance use treatment are governed by 42 C.F.R. § 2.31. Covered entities often have their own required forms for the release of protected health information.
Attorneys representing clients who are expected to consent to the disclosure of some of their own medical records should be wary of authorizing more disclosure than necessary. In personal injury and worker’s compensation cases, defense counsel often send a blanket release form that is far broader than necessary or appropriate. Signing an overbroad authorization can be a big mistake, resulting in the release of years’ worth of sensitive – and irrelevant – medical and mental health records to an adverse party.
Attorneys should always include a time limit on the release form, and covered entities should not release multiple rounds of records under the same authorization if the applicable time limit has passed.
Exceptions to Authorized Release. Without patient authorization, there are limited exceptions to the prohibition on releasing protected health information. The HIPAA Privacy Rule permits covered entities to use protected health information for treatment, payment, or health-care-operations purposes without patient authorization.19 This exception extends to litigation and administrative proceedings only when the covered entity is a party to legal proceedings (judicial or administrative), such as licensure defense.20
Under Wisconsin law, confidential patient health records, including mental health records, can only be introduced in court (without patient consent) pursuant to a lawful order of the court.21 This is a stricter protection than that afforded by HIPAA, which, in the absence of the Wisconsin law, would permit the records to be released in response to a subpoena that meets certain criteria.22
A simple discovery request generally does not suffice to compel disclosure of protected information, because of federal and state protections and the patient’s privilege. Privilege does not apply in some proceedings where the medical condition is an element of the claim, such as guardianships, worker’s compensation, personal injury, or matters concerning child abuse reports.23
Additional Limitations on the Release of Substance Use Disorder Treatment Records. Under the revised 42 C.F.R. part 2, the protections for substance use disorder treatment records are significantly more stringent than those for other medical records.
In the absence of an authorization form demonstrating the patient’s informed consent, a provider cannot be compelled to provide testimony or records about a patient’s protected substance use disorder treatment information without two things: a subpoena and a court order. Absent patient consent, a provider cannot even answer a simple question about whether the person was in treatment without an authorizing court order.24
To obtain a court order authorizing the disclosure of protected substance use disorder treatment, the requesting party must show “good cause therefor, including the need to avert a substantial risk of death or serious bodily harm. In assessing good cause, the court shall weigh the public interest and the need for disclosure against the injury to the patient, to the physician-patient relationship, and to the treatment services.”25 The standards for showing good cause are high in civil cases and even higher in criminal cases.26
Any party seeking a court order authorizing the disclosure of protected substance use disorder treatment records or information must submit an application to the court, and both the patient and the holder of the records must receive notice of the application and have the opportunity to respond.27 If the court holds a hearing on the application, the hearing must be conducted confidentially, unless the patient requests otherwise.28
When a court does authorize the disclosure of protected substance use disorder treatment information, the court must limit the use or disclosure of the patient’s record, or testimony about the record, to that which is “essential to fulfill the objective of the order.”29 In addition, the court must “[l]imit use or disclosure to those persons whose need for information is the basis for the order”; and take steps to protect the information from any unnecessary exposure or scrutiny, such as by sealing the parts of the court record where it appears.30
Redisclosure. After an attorney has received protected health information, whether through patient authorization, court order, or otherwise, the attorney must be careful to use that information only for the authorized purpose.31 Both federal and state law restrict redisclosures.32
Protecting Health Information in Court Records
Attorneys who submit protected health information to the court must take steps to protect that information, even after obtaining authorization to access and submit the records. Courts will not automatically seal or otherwise protect records including protected health information.33 Wisconsin Circuit Court form GF-244, the Cover Sheet for Confidential Records, should be submitted with records that include protected health information with the appropriate box checked. In the alternative, attorneys can request permission from the court to redact all unnecessary information from the records, move to seal the records so that non-parties cannot access them, or do both. Attorneys should always use restraint and submit only the type and amount of health information that is necessary.
Conclusion
Medical privacy laws can seem overly complicated at first, but learning the landscape will help attorneys protect clients’ and their own interests. Clients appreciate knowing – and deserve to know – that their lawyers are protecting their health information to the utmost extent of the law.
Medical Records and Children
The Child Patient
Generally, minors cannot give informed consent for the inspection or copying of their medical records,34 but there are several key exceptions to this rule:
Mental Health. Minors age 14 and above can access and consent to the release of their mental health records.35
Alcohol and Drugs. Minors age 12 and above can receive treatment for alcohol and drug abuse without parental involvement, and records of such treatment can, with limited exceptions, be released only with the minor’s consent.36
Reproductive Health. Minors have the right to access confidential reproductive health care services – including, by judicial waiver, abortion37 – and to access and consent to the release of records of such treatment.38
HIV Test Results. Minors age 14 and above, and their authorized representatives, have the exclusive right to disclose or authorize disclosure of their HIV test results.39
Parents and Guardians
Parents and guardians generally have access to their children’s medical records. The main exception to this rule is when a parent is denied placement.40 Conversely, courts can authorize third parties with visitation to access children’s medical records.41
As discussed above, minors can also restrict disclosure to their parents of medical records of care for which they were not required to obtain prior parental permission, such as HIV testing and some alcohol and drug abuse treatment.42
Guardians ad Litem
Guardians ad litem (GALs) – lawyers appointed to represent the best interest of minor children – can only access medical records upon informed consent of the minor’s parent(s) or legal guardian(s) or the minor (in the above-mentioned limited circumstances), by statute, or by order of the court.43 That being said, often the order appointing a GAL to a family court case will indiscriminately allow the GAL to access medical records as part of the GAL’s duty to investigate the matter and make a recommendation to the court regarding the best interests of the child.
Courts should set appropriate limits on the disclosure of a minor’s medical records to GALs and should consider whether a protective order is appropriate on a case-by-case basis. Attorneys concerned about limiting disclosure of protected information may consider submitting a proposed order appointing a GAL (Wisconsin Circuit Court form GF-131A(1)) with language limiting what information the GAL can access. If the physical or mental health of the minor child(ren) is not at issue, attorneys should consider whether any authorization at the time of appointment is warranted. If circumstances change, a GAL may request a subsequent order if needed.
By the time a GAL is appointed, the court should be able to ascertain whether a complete authorization for the release of the minor’s medical records is necessary.
Endnotes
1 U.S. Dep’t of Health & Hum. Servs., Does the HIPAA Privacy Law Preempt State Laws? (Dec. 28, 2022), https://www.hhs.gov/hipaa/for-professionals/faq/399/does-hipaa-preempt-state-laws/index.html.
2 Pub. L. No. 104-191 (1996).
3 For an in-depth treatment of HIPAA compliance for law firms as business associates, see Meghan C. O’Connor & Diane M. Welsh, Casting a Wider Net: Health Information Privacy Is Not Just for Health Lawyers (Sept. 1, 2013), https://www.wisbar.org/NewsPublications/WisconsinLawyer/Pages/Article.aspx?Volume=86&Issue=7&ArticleID=11017.
4 45 C.F.R. § 160.103.
5 U.S. Dep’t of Health & Hum. Servs., What Does the HIPAA Privacy Rule Do? (last reviewed Feb. 6, 2023), https://www.hhs.gov/hipaa/for-individuals/faq/187/what-does-the-hipaa-privacy-rule-do/index.html.
6 Wis. Stat. § 146.82(1).
7 Wis. Stat. § 146.82(2).
8 Wis Stat. § 146.82(2)(a)4.
9 42 U.S.C. § 290dd-2(a).
10 42 U.S.C. § 290dd-2(b)(2)(C).
11 42 U.S.C. § 290dd-2(c).
12 42 C.F.R. § 2.3(a).
13 Wis. Stat. § 51.30(1)(am),(b), (4)(a).
14 Wis. Stat. § 51.30(4)(b)4.
15 Wis. Stat. § 767.41(5)(am): “7. Whether any of the following has or had a significant problem with alcohol or drug abuse: a. A party; b. A person with whom a parent of the child has a dating relationship, as defined in s. 813.12(ag); c. A person who resides, has resided, or will reside regularly or intermittently in a proposed custodial household. … 10. Whether the mental or physical health of a party, minor child, or other person living in proposed custodial household negatively affects the child’s intellectual, physical, or emotional well-being. … 13. The reports of appropriate professionals if admitted into evidence. 14. Any other factor that the court determines to be relevant.”
16 Wis. Stat. § 767.56(b).
17 45 C.F.R. § 160.103 (paragraph (2)(iv) of the definition of “protected health information”).
18 State v. Johnson, 2023 WI 39, 407 Wis. 2d 195, 990 N.W.2d 174.
19 45 C.F.R. § 164.500; see 45 C.F.R. §§ 164.502(a)(1)(ii), 164.506.
20 45 C.F.R. § 164.506(1); U.S. Dep’t of Health & Hum. Servs., May a Covered Entity Use or Disclose Protected Health Information for Litigation? (last reviewed Dec. 28, 2022), https://www.hhs.gov/hipaa/for-professionals/faq/704/may-a-covered-entity-use-protected-health-information-for-litigation/index.html.
21 Wis. Stat. §§ 146.82(2)(a)4., 51.30(4)(b)4.
22 45 C.F.R. § 164.512(e).
23 Wis. Stat. § 905.04(4).
24 42 U.S.C. § 290dd-2(b)(2)(C); 42 C.F.R. § 2.64(a); 42 C.F.R. § 2.65(a).
25 42 U.S.C. § 290dd-2(b)(2)(C).
26 42 C.F.R. § 2.64(d); 42 C.F.R. § 2.65(d).
27 42 C.F.R. § 2.64(b); 42 C.F.R. § 2.65(b).
28 42 C.F.R. § 2.64(c); 42 C.F.R. § 2.65(c).
29 42 C.F.R. § 2.64(e)(1); 42 C.F.R. § 2.65(e)(1).
30 42 C.F.R. § 2.64(e)(2), (3); 42 C.F.R. § 2.65(e)(2), (3).
31 See, e.g., Wis. Stat. § 146.82(5)(c)3.
32 Wis. Stat. § 146.82(5); 42 C.F.R. § 2.12(c)(5)-(6); 42 C.F.R. § 2.32; 42 C.F.R. § 2.33; 42 C.F.R. § 2.51; 42 C.F.R. § 2.52(b); 42 C.F.R. § 2.53(c)(d), 42 C.F.R. §§ 2.61-.67. See Substance Abuse & Mental Health Servs. Admin., Substance Use Confidentiality Regulations (last updated Oct. 27, 2023), https://www.samhsa.gov/about-us/who-we-are/laws-regulations/confidentiality-regulations-faqs.
33 Frequently Asked Questions about Protecting Information in Court Records, WI Courts, https://www.wicourts.gov/services/attorney/docs/faq_flyer.pdf.
34 Wis. Legis. Council, Health Care and Confidentiality of Records for Minors, June 2023, https://docs.legis.wisconsin.gov/misc/lc/issue_briefs/2023/health/ib_confidentiality_minors_health_records_2023_06_30.
35 Wis. Stat. § 51.30(5).
36 Wis. Stat. §§ 51.45(2m)(b), (10)(am), 51.47(1), (2); Wis. Admin. Code §§ DHS 92.05(1)(c), 92.06(2).
37 Wis. Stat. § 48.375(6)-(7); see also Planned Parenthood of Cent. Mo. v. Danforth, 428 U.S. 52, 74-75 (1976).
38 Wis. Stat. §§ 253.07(3)(c), 905.04(1)(c), (2), (3).
39 Wis. Stat. § 252.15(3m)(c).
40 Wis. Stat. §§ 146.835, 767.41(7)(b), 51.30(5)(bm).
41 F.R. v. T.B. (In re Visitation of Z.E.R.), 225 Wis. 2d 628, 652, 593 N.W.2d 840 (Ct. App. 1999).
42 See generally Wis. Legis. Council, supra note 34; see also sources cited notes 36, 39.
43 See Wis. Stat. § 767.407(4) (GALs have no rights of a general guardian);see also Wis. Stat § 146.82(2)(a)11m. (GALs have statutory authority to access medical records without informed consent of the patient in termination of parental rights cases for specific purposes).
» Cite this article: 97 Wis. Law. 18-23 (November 2024).
