As an increasing number of legal professionals must grapple with the complexity of healthcare-related information requests, a clear understanding of the regulations surrounding the Health Insurance Portability and Accountability Act (HIPAA) is ever more crucial. The HIPAA privacy rules (45 CFR § 164.501 et seq.) generally forbid healthcare providers and their business associates from disclosing protected health information (PHI) in response to subpoenas, orders and other government demands, unless certain conditions are met.
In an informative piece published on JD Supra, law firm Holland & Hart LLP provides a comprehensive overview of the specifics of such HIPAA rules (read more here).
For a subpoena, court order, or administrative request to be considered legitimate under HIPAA, the requester must offer adequate assurance to the covered entity that the necessary safeguard requirements protecting the PHI have been met and that all reasonable efforts have been made to notify the individual subject or to secure a protective order.
This outline is not exhaustive; however, it brings into focus the importance of a deep understanding of the privacy protections that exist under HIPAA, as they directly link to the lawful disclosure of PHI under various legal hearing circumstances. As a healthcare provider or business associate, navigating these rules effectively and responsibly not only helps to enhance legal compliance, but it also helps to maintain trust within the patient community, as well as a healthy relationship with government regulators.
In conclusion, when answering to such requests, adequate procedural handling and accurate recording of information are paramount to remaining compliant with HIPAA rules. As the demand for medical information continues to increase in various legal bindings, so too does the need for professionals to stay informed and compliant with these privacy protecting practices.