Release of medical records webinar — key takeaways and resources

May 8, 2024

Gracie Awalt

By Gracie Awalt, Marketing Associate

The following is a summary of information presented during the webinar “Release of medical records: Review of hot topics” presented on May 26, 2020. View the full webinar here.

January 2020 updates to the release of medical records

Earlier this year, a federal court heard a case (Ciox Health, LLC v. Azar) that challenged portions of the Omnibus Rule regarding an individual’s right to access protected health information. As a result, the following changes were made:

Fee limitations that apply when covered entities charge patients for their PHI requests do not apply when sending this information to a third party, such as a law firm.
When requested by the patient, covered entities are only required to send PHI in an electronic format to a third party. If PHI exists in a paper format, it does not have to be sent to the third party.

Release of medical records of deceased patients

When releasing medical records of the deceased, keep the following in mind:

Maintain privacy and confidentiality. The exceptions to this rule include court and administrative proceedings and when billing information is needed for health insurance claims.
When releasing medical records, obtain written consent from the patient’s personal representative, who is granted authority by the court. Personal representatives can be the executor of the deceased’s will, a spouse, or whoever the court appoints.
Written consent must detail the information released, the reason, and to whom it will be released.
If a relative requests PHI of the deceased relevant to their own health care, covered entities can provide this to the treating health care provider.
Covered entities have 15 days to release the PHI of the deceased after an acceptable request is made.

Guidelines for reporting and release of PHI to health departments in a pandemic

In February 2020, the OCR released guidelines related to HIPAA privacy and the COVID-19 pandemic. The minimum necessary information must be disclosed during the following situations:

During treatment — If PHI is necessary to treat other patients, coordinate care and consultations between providers, and refer the patient to a different facility.
Public health activities — To aid public health authorities, like the Centers for Disease Control or a local health department, who are attempting to control disease spread. If state law authorizes the release of information to notify people at risk. At the direction of a public health authority to a foreign government agency to help collaboration.
Patient care and notification— To people involved in an individual’s care, such as families, friends and others. To notify relevant people of the patient’s location, general condition, or death.
In the event of a serious and imminent threat to the public —To anyone able to stifle the risk of spread, like family, friends, caregivers and law enforcement, consistent with applicable laws and ethical conduct.
To the media or those uninvolved in care — Only in the circumstances described above can PHI be released in this context. When the patient has not explicitly objected or restricted the release of PHI, or if the patient is incapacitated and it seems to be in the patient’s best interest, information about the patient’s presence at a facility and general condition can be released to the media.