No single word, phrase or acronym strikes more fear into a lawyer than HIPAA. I can’t tell you how often I have heard one of our colleagues threaten, warn, lament or otherwise comment that someone or something violated or violates the Health Insurance Portability and Accountability Act, with the implication that the police are soon to follow and that the hapless violator will soon wind up in irons. Thus, when I got the chance to be a part of a CLE at the Connecticut Bar Association the other day on the issue of just what HIPAA is and how it affects lawyers, I jumped at the chance.
The panel (save me) was a group of really smart and experienced lawyers who know HIPAA and did a great job educating the rest of us. Susan Huntington, deputy general counsel at Hartford Hospital, joined Arnold Menchel, formerly of the Attorney General’s Office and now of Halloran & Sage, and Michael Rigg, of O’Brien, Tanski & Young. Each brought a different focus to this interesting topic.
Arnie started out explaining the history of the law, which was designed to simplify the rules concerning the privacy of patient medical records. Like everything else the government does, the whole mess, which now includes HIPAA, implementing rules and regs; something called HITECH, which is a related medical records regulatory regime; and a new, 500-plus-page set of HIPPA regs, too new to have a name, and which, though presently in effect, will not be enforced until September. Apparently, all of this provides lots of work for lawyers who represent health care providers.
The bad news, if you happen to be a health care provider, or a "business associate" of one, is that enforcement is very strict, both by the Connecticut Attorney General and the U.S. Department of Health and Human Services’ Office of Civil Rights. And the penalties for sins can run into the tens or thousands of dollars per file. If your employee loses a laptop with a few hundred thousand patient files, the fines can put you out of business.
As the regs require those covered to make sure their employees follow the law by implementing fairly severe penalties for disobedience, everyone in the system takes the law very seriously. No wonder lawyers have such trouble getting medical records!
The good news is that if you are neither a provider nor a business associate of one (trust me, you already know if you are) the law does not cover you. And there is no private right of action for HIPAA violations. HIPAA requires that patients be given notice of any request for their medical records and the opportunity to object and seek relief. Sue Huntington pointed out that Hartford Hospital, like every other major provider, has their own HIPPA releases to be used to obtain records. If the patient signs the release, the records come. If not, no records. Simple.
The law does allow records to be disclosed without a release with a "court order." Many lawyers think a subpoena is a court order. It is not. A subpoena will not get you what you want. And threats of jail, suit, arrest and worse (all of which our brethren have made) do nothing but inflame passions. They do not change the law. And they will not get you the records.
Some in the audience questioned the process of subpoenaing records to a "records deposition," which would not be held if the records would just be mailed to the lawyer, or subpoenaing the records "to the file" at a courthouse. Remember, under HIPAA, a subpoena is not a court order. A subpoena is simply not sufficient to overrule the mandate of federal law. Thus, subpoenaing records without a release or a court order is not going to get you anywhere but on the receiving end of a grievance.
I reported about one lawyer who resorted to the "records deposition" practice and what happened to him. When the doctor refused to send the records, the lawyer sought a capias. He told the judge that the doctor had failed to attend a deposition. What he did not say was the deposition was never held. It was just one of those phony "medical records depos" that have become part of sloppy practice but which have no basis in our practice rules.
The lawyer wound up with a reprimand and his employer reportedly paid significant money to the doctor who sued for abuse of process and other torts when he was arrested by the capias squad one night when he was watching American Idol with his family.
Bottom line — get a release, get a court order or get a grievance. Forget the subpoena. •