When facing the uncertainties of a personal injury accident, it is important to know that your personal health information is protected by federal law. As a result, your medical care providers and insurers are required to safeguard your personal health information. Thus, anyone requesting your personal medical information must comply with both the Privacy Rule and the Security Rule found in the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
The HIPAA was created to increase the efficiencies of the health care system, by creating national standards which protect “individually identifiable health information”. This information includes your current and/or prior medical history, as well as anything that would specifically identify you, such as a social security number or birth date.
Within HIPAA is the Privacy Rule, which gives you rights over your personal health information in any form, whether verbal, written or electronic. Protected information includes the written information that is in your physical medical chart, as well as electronic data kept on your health care provider‘s computer system. Protected information also includes conversations you‘ve had with these providers and your personal financial information used for billing purposes. It even includes information about you kept by health insurance companies, including Medicare and Medicaid.
The Privacy Rule provides a method for disclosing this protected information to others, but does set limitations. In the case of a personal injury claim, there may be insurance companies, governmental agencies, law firms, medical experts and others enlisted to defend against your claims. Your health care providers can only release your personal medical information to these entities after receiving your signed authorization, which specifies to whom the information will be sent along with the scope and date ranges for the medical records to be released.
Your personal medical information can be released by court order, but the information requested must be specifically identified, and only this information will be released. Subpoenas for your personal medical information are not the same as a court order unless issued by and upon the order of the Court. Subpoenas are typically issued directly by lawyers, who must comply with the Privacy Rule as well. They must either notify you of the request, so that you have an opportunity to object, or they must seek a “qualified protective order” through the court. A subpoena alone without the order of the court is not sufficient for the defense to obtain your medical records.
Though HIPAA laws will protect against unauthorized release of medical information to the defense, the discovery rules are fairly liberal. The defense will typically be able to obtain almost all medical records for seven to ten years prior to any accident or injury claimed in a personal injury lawsuit. Any records beyond that may be protected. And HIPAA will most definitely prevent the release of records without proper legal releases or court orders.
Discovery in a Personal Injury Lawsuit: Often Difficult and Expensive but Always Necessary!
The High Costs of Medical Errors on the Healthcare System
Insurance Company Medical Records Review in Personal Injury Cases