Health Information Compliance Alert

Question: I work in a small, state-funded clinic that sees many patients (adult) with mental retardation. How does the Privacy Rule affect these patients' rights when it comes to disclosures to them and/or another party or patient representative?

Answer: An individual is allowed to control his or her own personal health information (PHI) to the extent allowable under State or other law Ð or, in other words, to the extent that the law has permitted that individual to act on his or her own behalf, says HHS. That said, HHS reminds that, even if patients have been deemed incompetent to act on their own behalf, covered entities are allowed to decline a personal representative's request for PHI for any reason (including the patient's personal objection), as long as the disclosure is permitted but not required under the Privacy Rule.

However, covered entities are required to make certain disclosures required under the Rule, e.g., what HHS describes as disclosures "to the individual under 45 CFR 164.524 and 164.528 with respect to the individual's right of access to his or her protected health information and an accounting of disclosures, respectively."

Covered entities must make such disclosures unless the covered entity has reasonable proof that to make the disclosure would not be in the patient's best interest (for example, if there were evidence that the representative was abusing and/or neglecting the patient, or if the information could somehow endanger the patient.)