The Real Talk article series includes real customer questions and our answers. Since these are questions directly from actual clinics, practices, hospitals, and businesses, we thought you might have these questions too. We hope that you find this format helpful. Stay tuned for more Real Talk - your question might even be featured!
Scenario: A patient signed a Release of Information (ROI) for her previous medical records that we have now received at our clinic.
Question 1: She would like a copy of those records for herself and has had trouble obtaining them. It is my understanding we cannot provide them to her – she needs to get them from the source. Correct?
Answer: Not quite – the HIPAA Privacy Rule permits individuals to request PHI that is maintained by a covered entity regardless of where the PHI originated (even if from another provider). In this case, since you maintain those records, if she requests them from you, you can and should provide them to her. Reference 45 CFR § 164.524.
Question 2: She has an appointment to see a Surgical Specialist who will need to access these records. Can she sign a ROI for us to fax them to the specialist OR does the specialist have to obtain them directly from the source?
Answer: Similar to the above, she is permitted to direct you to share those records with the specialist. Fax is an acceptable way of communicating this information per HIPAA but we’d recommend you take reasonable steps to ensure no unauthorized disclosure of information like A) confirming the fax number belongs to the specialist; and B) including a cover sheet.