Client Records Requests through Personal Health Record services
We received an inquiry from our member, Sundown Ranch, asking the following:
I would be interested to know if members have a consensus view on how to treat client medical records requests they receive through third-party personal health records (PHR) services. We recently received one such request asserting the client’s right to access the records in accordance with the latest requirements under HIPAA, the CARES Act, and HITECH Act. It requests information be uploaded directly to the PHRs portal. It is my understanding some of these PHR providers are subject to HIPAA, while others are not. I’ve seen some articles urging providers to use caution in releasing such information. Nevertheless, clients do have a right to their medical records. I am curious to know if other members have received requests of this nature and what, if any, steps they are taking to ensure compliance with the patient’s right to information while also complying with applicable confidentiality requirements. I’d welcome references to any articles, papers or other information providing additional clarity.
I think I started a response and either sent it prematurely or erased it - trying again. We received those records retreival requests and look for an ROI signed by the former client or appropriate court order. If those are not present,we will send a letter to the document service, attorneys for the parties and court stating that 42CFR restricts disclosure except for certain circumstances.