Release of Medical Records in Georgia

1. Release of Medical Records in Georgia Presentation to Georgia Society for Clinical & Resource Management Fall Conference September 18-19, 2013 James Lawton Deputy General Counsel HealthPort Technologies, LLC

2. AGENDA • Confidentiality of Records and Exceptions • Access and Authorizations • Special Conditions • Substance abuse/dependency • HIV/AIDS • Mental health • Legal Process – POD, Subpoenas, Court Order • Certification of Records • Georgia Fee Statute • HITECH – Final Rules Finally Here

3. Confidentiality of Medical Records State Constitution affords the patient a right of privacy in medical records. King v. State, 272 Ga. 788, 535 S.E.2d 492 (Ga 2000) No physician or care facility shall be required to disclose “any medical information concerning a patient” except: • With valid authorization, • To State Department of Human Resources, or • Pursuant to subpoena, court order, other legal requirement Additional statutory protection for substance abuse, AIDS, and mental health/psychotherapy

4. Exceptions to Confidentiality Exceptions Based on Federal Law • Disclosures permitted without patient authorization for: - RACs and QIOs - Public Health – exigent circumstances - OSHA with a medical access order

5. Exceptions to Confidentiality • GA Statutory basis for disclosure of medical information without patient authorization: • Certain contagious diseases and STDs • Suspected child abuse/neglect • Non-accidental injuries • Juvenile drug use • Suspected abuse of long-term care patient • Disabled newborn (deaf, blind or serious congenital defect) • Disposal of fetus • Workers’ comp claim • Georgia Professional Licensing Board (subpoena)

6. Exception for Payment, Treatment and Operations • HIPAA has broad exception for PTO, but Georgia limits use or disclosure of medical information without patient consent to: • Providers involved in treatment consented to by patient • Bill patient • Comply with law • Treatment and payment for Medicare/Medicaid/TriCare patients • In Emergency: Required treatment or transfer for care

7. Exception for Payment, Treatment and Operations • Obtain patient’s permission to use and disclose in accordance with provider’s Notice of Privacy Practices • Staff access incidental to treatment • Utilization/quality review • Claims processing

8. Patient Access • When can patient access and who can act for patient • Competent adult patient or emancipated minor patient • Parent, foster parent or court-appointed guardian of minor (DFACS) • Legally appointed guardian of incompetent patient • Person acting under a durable POA for healthcare (Advance Directives) • Deceased patients • Legally appointed personal representative of the estate • Next of kin - surviving spouse, child, parent

9. Patient Access Time - 30 days to make records available • Trumps HIPAA’s longer period Basis for Denial: ─ Mental health records or substance abuse where the treating physician or psychotherapist (or chief medical officer of the facility) determines the release of such records will be detrimental to patient’s physical or mental health

10. Release with Authorization • Facility may release records in accordance with a request and valid authorization • Authorization should be specific when involving sensitive conditions • HIPAA Requirements for a Valid Authorization ─ Name of person/facility authorized to make the disclosure ─ Name or title of person or organization to receive the records ─ Patient name ─ Purpose of disclosure (contrast patient access) ─ Scope/description of records to be released ─ Signature of patient or personal rep ─ That the authorization is subject to revocation ─ Expiration date – whether via fixed date or event ─ Notice of re-disclosure risk

11. Sensitive Conditions - Substance Abuse Patient Access: Right to review and obtain a copy unless treating physician determines the disclosure would be detrimental to the mental or physical well being of the patient Disclosures: • With Patient Authorization - To any person/entity designated in writing by patient • To Other Medical Personnel – To meet the patient’s bona fide medical emergency • To Qualified Personnel – for research/audit/evaluation • Court Order – Except as noted below for criminal investigations, release only pursuant to court order upon finding of “good cause” to release to the court • Do NOT disclose pursuant to Subpoena or POD • Blood Test for Drug/Alcohol • If test is for medical diagnosis, only disclose with court order • If test is for “legal” (e.g., DUI investigation), can also release pursuant to criminal subpoena or to investigating officer

12. Sensitive Conditions – HIV/AIDS AIDS Confidential Information (ACI) Defined by GA Law and has additional protections from disclosure compared with “regular” medical records. A patient's written consent is required to disclose ACI, unless the disclosure is otherwise authorized or required by law. Disclosure via Legal Process: ACI may be disclosed as medical information pursuant to any other law which authorizes or requires the disclosure of medical information (including subpoenas and POD) if: • The person identified by that information: ─ Has specifically consented in writing to that disclosure; or ─ Is given at least ten (10) days’ notice prior to the disclosure and does not timely object; or • A Superior Court Order

13. Sensitive Conditions – HIV/AIDS Permitted Disclosures without Authorization • Notice to State Department of Human Resources • Notice to Other Healthcare Facility – Providing care to the infected patient if risk of further infection or if necessary for the facility to provide appropriate care • Notice to Administrator of Institutional Care Facility with infected Patient Partner Notification When the physician of an HIV infected patient reasonably believes that the spouse/partner or any child is a person at risk of being infected with HIV by that patient, the physician may disclose to that spouse, partner or child . . . after first attempting to notify the patient that such disclosure is going to be made.

14. Sensitive Conditions – Mental Health Patient Access: Right to review unless treating physician determines the disclosure would be detrimental to the mental or physical well being of the patient. Patient of individual psychotherapy providers have right to access and obtain copies. Disclosures: • With Patient Authorization - To any person/entity designated in writing by patient, including attorney • To Subsequent Admitting Facility • To Other Medical Personnel– When chief medical officer of the facility where records kept deems it essential for continued treatment or in a bona fide emergency • At a Hearing about the Patient • To Law Enforcement – In criminal investigation, can disclose whether a person was a patient of a state institution, together with last address. In criminal investigation involving a crime on the premises, can disclosure facts about incident, if person is/was a patient, name, address and whereabouts. • Valid Subpoena or Court Order – Release all except psychotherapy records which are privileged under Georgia law

15. Sensitive Conditions – Psychotherapy Treatment Georgia Recognizes a Mental Health Provider-Patient • Privilege for psychotherapy treatment ─ Comparable to husband-wife and attorney-client privilege • Covers confidential communication made for: ─ Treatment/diagnosis between patient and psychiatrists ─ Licensed psychologists, social worker, marriage/family ─ Therapist employing psychotherapeutic techniques • Only disclose with specific patient authorization or when specifically ordered by court – send to court, not attorneys

16. Legal Process • Request for Production of Documents • Subpoenas - State and Federal • Workers’ Comp • Court Orders • Deposition Subpoenas • Certification of Records

17. Request for Production of Documents • Georgia Law permits a Party in litigation to serve a “Request for Production” on a Non-Party • Not a court order • Must be served on: • All parties • The patient, if not a party, and • The non-party physician or hospital that owns the records • 20 days from date of service to Object • If objection, requesting party must obtain court order • If no objection (but no specific authorization)- provide records Except substance abuse and priveleged psychotherapy notes

18. Subpoena Types • Trial or Testimony - requires personal appearance • Less common • Professional treating patient • DucesTecum – requires company records • Common • Original records need not be provided • Satisfied with certified copies of medical records

19. Subpoenas • Common Sources of Subpoenas • State or federal courts • State Board of Workers’ Compensation • Board of Medical Examiners/State Professional Licensing Board • Department of Human Resources (Public Health) • Service • Personal service, certified or statutory overnight delivery • Out of state or county must be served by law enforcement in the county where subpoena is to be served • If invalid subpoena – Do NOT disclose

20. State Court Subpoena • Process for evaluation/response is similar to POD • Proof of Service • Confirm that patient (or attorney) has been served! • Wait 23 days • If patient (or other party) objects, wait for court order • If patient consents and gives specific authorization(s) = release responsive records • If no objection (but no specific authorization(s) = release responsive records except • Substance abuse and privileged psychotherapist treatment which require a court order

21. Federal Subpoena • Served on patient? ─ If patient is a party - No need to confirm proof of service - FRCP requires subpoenas to be served on all parties ─ If patient is not a party, obtain proof of service • Wait 17 days (FRCP gives 14 days to object) • If patient (or other party) objects, wait for court order • If patient consents and gives specific authorization = release responsive records • If no objection (but no specific authorization(s) = release responsive records Except ─ Substance abuse and privileged psychotherapist treatment which require a court order

22. Criminal Subpoenas King v. State creates some uncertainty • Most certainty when patient is notified of request • Is there adequate assurance the information will be protected? • Protective order? • May want to consult with legal counsel • Require court order? Grand Jury Subpoenas • Treated as court orders • Always return to the court issuing (despite D.A. or U.S. Attorney requesting the records be returned to them)

23. Workers’ Compensation Has the Employee Put His/Her Medical Condition at Issue? • Made a claim for benefits (look for Form WC-207 or WC-14) • Employer has agreed to disability benefits (Form WC-1 or 2) • Employer has agreed to pay for medical expenses from injury If yes to any of the above, the records related to the injury may be released ─ Only release from date of injury forward without broader patient authorization ─ If no to all three, do not release without separate authorization

24. Court Orders Court Orders - Signed by a Judge Always Comply with a Court Order! • Healthcare facility is protected from claims of improper release • Basis for release of substance abuse (if finding of “good cause”) and psychotherapy treatment without patient authorization • Carefully note where order directs the records to be sent ─ If not stated or unclear, deliver records to the court

25. Deposition Subpoenas Subpoenas for Deposition to Hospitals Usually Limited to: • Professional caregiver re: specific questions about care • To Custodian of Records to authenticate medical records ─ Generally unnecessary with certification of records ─ New law effective January 1, 2013

26. Certification of Records for Admissibility New Self-Authentication Law - Effective January 1, 2013 Allows the use of records, in any form, of “acts, events, conditions, opinions, or diagnoses” if: • Made at/near the timeof the described act/event/condition/opinion/diagnoses • Made by a person with personal knowledge and a business duty to report; • Kept in the course of a regularly conducted business activity; and • It was the regular practice of that business activity to make the memorandum/report/record/data compilation. ─ Each of these elements are typically met by healthcare facilities ─ Custodian of Records can execute a “Certificate of Authenticity” that is notarized

27. Duplication Fees – Current August 2013 Certification of Records - $9.70 • Base Fee - $25.88 (never charge on patient request) Per Page Pages: $0.97 – pages 1-20 $0.83 – pages 21-100 $0.66 – pages 101+ *Above Rates Subject to Annual Adjustment for CPI-Med • Non Paper Records (radiology, strips, etc): “Full Reasonable Cost of Reproduction” • Workers Comp – No charge for WC18 or 20A, otherwise: $0.20/page with Minimum $30, plus tax and actual postage $9.50/x-ray, plus tax and actual postage • State Disability & Social Security Determination - $15.00

28. HITECH – Final Rule Finally Here Marketing Sale of PHI Patient Access • Electronic records • Direct provider to send records to 3rd party State rates still deemed reasonable

29. NOT LEGAL ADVICE • The information in this presentation is provided as general informational and educational purposes to accompany a presentation of limited duration. The presentation only covers selected topics and is not a complete discussion of all laws relevant to the release of health information in Georgia. • The information in this presentation is not offered as, and does not constitute legal advice or legal opinion. The provision of this information is not intended to create, and the receipt does not constitute, an attorney-client relationship. You should seek the advice of an attorney for specific legal questions.