May 13, 2016
Is there a specific written authorization to authorize the release?
Need authorization from the patient or the patient’s legal representative.
- If yes, release the records.
Is the request from a health care provider involved in treating the patient?
- If yes, release the records.
Is the request from a party involved in payment or reimbursement for the patient’s care?
- If yes, release the records necessary for payment/reimbursement – so long as the Consent to Treat form (or other similar form) includes an authorization to release for this purpose.
o HIPAA permits this type of disclosure without authorization, but not Florida.
o Florida requires the patient authorize the release of records for payment of health care.
Is the request in the form of a Court Order?
- If yes, release the records requested in the order.
Is the request in the form of a HIPAA compliant Subpoena?
- If yes, release the records requested. There are two ways for subpoena’s to be HIPAA compliant; by providing notice to the patient, or pursuant to a protective order.
1. A subpoena that is HIPAA compliant by providing notice to the patient must include the following:
- A certified statement from the attorney issuing the subpoena that reasonable efforts have been made to ensure that the notice has
been given to the patient who’s records are requested,
And,
- That the patient has not objected within a reasonable time. Decision tree regarding the release of medical records
Or
2. A Subpoena that is HIPAA compliant pursuant to a Protective Order must include the following:
- A copy of the HIPAA protective Order,
Or,
- A certified statement from the attorney issuing the subpoena that reasonable efforts have been made to secure a qualified HIPAA
protective order.
Is the request in the form of a Subpoena from the Agency for Health Care Administration or Department of Health for the purpose of investigating the facility or one of the medical providers?
- If yes, release the records requested.
Is the request in the form of a Worker’s Compensation Subpoena (State of Florida Division of Administrative Hearings, Office of the Judges of Compensation Claims) from an attorney for the employer, insurance carrier, or the injured worker?
- If yes, you may release the records requested without authorization if:
o The records requested are relevant to the worker’s compensation claim.1
o The records do not contain HIV test results.2 Timeliness of response to request:
- Medical Malpractice requests = 10 days. If the request mentions a potential medical malpractice claim against the facility or one of the health care providers, the records must be provided to the requestor within ten (10) days.
- Other requests = 30 days. If the request does not mention medical malpractice litigation, Florida requires the records be released in a “timely manner.” HIPAA states that the covered entity must act on a request within thirty (30) days of the request. But, if needed, HIPAA permits an additional, one-time, thirty (30) day extension following written notice to the patient.
Mental health psychotherapy notes, substance abuse treatment records, and HIV test results are considered super-confidential and require specific written authorization.
1 Fla. Stat. §440.13(4)(c) Upon the request of the employer, the carrier, or their attorneys, the medical records, reports, “relevant to the particular injury or illness for which compensation is sought must be furnished…”
2 Fla. Stat. §381.004(2)(e). There must be a court order to release HIV test results for worker’s compensation claims.