HIPAA and Patient Objections

Question: What is my legal position in the state of California if the patient says she doesn’t want me to send her records to a psychiatrist? What if the psychiatrist calls me to ask questions? Are we required to comply with the patient’s request?

Answer: Alas, you ask about a gray area. The HIPAA privacy rules allow physicians to share health information for treatment purposes without patient authorization, but they don’t say anything about what to do if the patient actively prohibits the information sharing, according to Abner Weintraub, who’s with The HIPAA Group.

Under HIPAA “A covered entity must permit an individual to request that the covered entity restrict uses or disclosures of protected health information about the individual to carry out treatment, payment, or health care operations; and disclosures permitted under § 164.510(b).”

However, while you have to allow individuals to request restrictions, you don’t actually have to agree with the request. The HIPAA regulation continues: “A covered entity is not required to agree to a restriction.”

State laws in California also seem to vet this issue insufficiently. Here is a summary of state rules.

But you’re in a real quandary, aren’t you? Clearly, you are not taking good care of the patient if you do not share the info. But sharing it without the patient’s consent may not be the best choice either, whatever the legalities.

I suggest you call the risk department at your malpractice insurer and ask their opinion. They’ll need to defend you should something go wrong with either decision you might make, so their guidance is necessary.