At first glance, medical records appear to be one of the few truly confidential areas in our lives. Laws in many states, including California, and the age-old tradition of doctor-patient privilege seem to make it difficult for others to gain access to medical records. But the laws contain exemptions. And the right to confidentiality is often lost in return for insurance coverage. In short, you may have a false sense of security.

http://www.medical-record.blogspot.com/

What do my medical records contain?

Medical records are created when you receive treatment from a health professional such as a physician, nurse, dentist, chiropractor or psychiatrist. Records may include your medical history, details about your lifestyle (such as smoking or involvement in high risk sports), and family medical history. In addition, your records contain laboratory test results, medications prescribed, and other reports which indicate the results of operations and other medical procedures.

Who has access to my medical records?

Your medical information is shared by a wide range of people both in and out of the health care industry. Generally, access to your records is obtained when you agree to let others see them. You have probably signed "blanket waivers" or "general consent forms" when you have obtained medical care. When you sign such a waiver, you allow the health care provider to release your medical information to insurance companies, government agencies and others.

1. Insurance companies require you to release your records before they will issue a policy or make payment under an existing policy. Medical information gathered by one insurance company may be shared with others through the Medical Information Bureau (see below).

2. Government agencies may request your medical records to verify claims made through Medicare, MediCal, Social Security Disability and Workers Compensation.

3. The Medical Information Bureau (MIB) is a central database of medical information. Approximately 15 million Americans and Canadians are on file in the MIB's computers. Over 750 insurance firms use the services of the MIB primarily to obtain information about life insurance and individual health insurance policy applicants. A decision on whether to insure you is not supposed to be based solely on the MIB report. Visit the MIB web site at www.mib.com

The MIB does not have a file on everyone. But if your medical information is on file, you will want to be sure it is correct. You can obtain a copy ($8) by writing to:

Medical Information Bureau
P.O. Box 105, Essex Station
Boston, MA 02112
or call (617) 426-3660.

4. Employers usually obtain medical information about their employees by asking employees to authorize disclosure of medical records. This can occur in several ways.

• When medical insurance is paid by employers, they may require insurance companies to provide them with copies of employees' medical records.
• Self-insured businesses establish a fund to cover the insurance claims of employees. Since no third party is involved, the medical records that would normally be open for inspection by an insurance company are accessible to the employer. Most large corporations are self-insured.

Unfortunately, the laws in only a few states require employers to establish procedures to keep employee medical records confidential. (For example, California Civil Code §56.)

According to the federal Americans with Disabilities Act (ADA, 42 USC §12101 et seq.), in workplaces with more than 25 employees: ADA text at Web, www.independentliving.org/LibArt/ada.html

• Employers may not ask job applicants about medical information or require a physical examination prior to offering employment.
• After employment is offered, an employer can only ask for a medical examination if it is required of all employees holding similar jobs.
• If you are turned down for work based on the results of a medical examination, the employer must prove that it is physically impossible for you to do the work required.

Violations of the ADA should be brought to the attention of the U.S. Equal Employment Opportunity Commission (EEOC). The EEOC's phone number is listed in the U.S. Government section in the white pages of the phone book.
Web: www.eeoc.gov/laws/ada.html

5. Your medical records may be subpoenaed for court cases. If you are involved in litigation, an administrative hearing or worker's compensation hearing and your medical condition is an issue, the relevant parts of your medical record may be copied and introduced in court.

6. Other disclosures of medical information occur when medical institutions such as hospitals or individual physicians are evaluated for quality of service. This evaluation is required for most hospitals to receive their licenses. Your identity is generally not disclosed when medical practices are evaluated. Occasionally, your medical information is used for health research and is sometimes disclosed to public health agencies like the Centers for Disease Control. Specific names are usually not included with the information.

7. Medical information may be passed on to direct marketers when you participate in informal health screenings. Tests for cholesterol levels, blood pressure, weight and physical fitness are examples of free or low-cost screenings offered to the public. Screenings are often conducted at pharmacies, health fairs, shopping malls or other nonmedical settings. The information collected may end up in the data banks of businesses which have products to sell related to the test. Use caution when participating in such screenings. Ask what will be done with the information and who will have access to the test results.

8. A tremendous amount of health-related information is found on the Internet. Many Usenet news groups and "chat" rooms are available for individuals to share information on specific diseases and health conditions. Web sites dispense a wide variety of information. There is no guarantee that information you disclose in any of these forums is confidential. Use a pseudonym and a non-name specific electronic mail address. Avoid registering your name on web sites.

Is there any way to protect the privacy of my medical records?

Currently, there are no comprehensive laws regarding medical records privacy. Here are some methods which may limit others' access to your medical records:

1. When you are asked to sign a waiver for the release of your medical records, try to limit the amount of information released. Instead of signing the "blanket waiver," cross it out and write in more specific terms.

• Example of blanket waiver: I authorize any physician, hospital or other medical provider to release to [insurer] any information regarding my medical history, symptoms, treatment, exam results or diagnosis.
• Edited waiver: I authorize my records to be released from [X hospital, clinic or doctor] for the [date of treatment] as relates to [the condition treated].
•  

2. If you want a specific condition to be held in confidence by your personal physician, bring a written request to the appointment that revokes your consent to release medical information to the insurance company and/or to your employer for that visit; you must also pay for the visit yourself rather than obtain reimbursement from the insurance company. To be especially certain of confidentiality, you may need to see a different physician altogether and pay the bill yourself, forgoing reimbursement from the insurance company.

3. Use caution when filling out medical questionnaires. Find out if you must complete it, what its purpose is, and who will have access to the information that is compiled. Also, before participating in informal health screenings, find out what uses will be made of the medical information that is collected. Use the same caution when visiting Web sites and when participating in online discussion groups.

4. Ask your health care provider to use caution when photocopying portions of your medical records for others. Sometimes more of your medical record is copied than is necessary.

5. If your records are subpoenaed for a legal proceeding, they become a public record. Ask the court to allow only a specific portion of your medical record to be seen or not to be open at all. A judge will decide what parts, if any, of your medical record should be considered private. After the case is decided, you can also ask the judge to "seal" the court records containing your medical information.

6. Find out if your health care provider has a policy on the use of cordless and cellular phones and fax machines when discussing and transmitting medical information. Cordless and cellular telephones are not as private as standard "wired" telephones. Because they transmit by radio wave, phone conversations can be overheard on various electronic devices. (See the Privacy Rights Clearinghouse Fact Sheet No. 3, "Wireless Communications.")

Fax machines offer far less privacy than the mail. Frequently many people in an office have access to fax transmissions. Staff members at all levels of the organization should take precautions to preserve confidentiality when sending and receiving medical documents by fax machine. (See PRC Fact Sheet No. 12, "Checklist of Responsible Information-Handling Practices.")

How do I get access to my own medical records?

In California and about half the states, health care providers must allow patients (or their representatives) to access and obtain copies of their own medical records. (California Health and Safety Code §123100). This includes doctors' offices, hospitals, mental health facilities and clinics. Generally the health facility must charge a "reasonable" fee for copying records. If you received care in a federal medical facility, you have a right to obtain your records under the federal Privacy Act of 1974 (5 USC §552a. Web access at www.usdoj.gov/foia/privstat.htm).

Most medical offices ask that you make your request in writing. If the health care provider will not release your records, ask for a written letter of denial. Then contact a patients' rights group, the local medical society, the state medical board or an attorney for further assistance. Generally, a request for disclosure may be denied if the health care provider believes the information will be harmful to the patient. In that case, the health care provider is usually required to disclose the record to a physician of the patient's choice. Denial of health records most often occurs with mental health records.

The future of medical records privacy

There is much debate over the future of the health care industry. Instead of your doctors each keeping their own records, there is likely to be a central computer file with your complete medical history stored in a regional or national database. Some say this will make the system more efficient, help you keep track of your personal information, and allow you to monitor your records for mistakes. However, privacy advocates are concerned about secondary uses of this medical information, employer access and unauthorized access.

The 1996 federal Health Insurance Portability and Accountability Act mandates a national healthcare ID number for all citizens. (Web: http://aspe.os.dhhs.gov/admnsimp/pl104191.htm) It also calls for the development of a federal privacy protection law by August 21, 1999, or in its absence, regulations adopted by the U.S. Department of Health and Human Services. There is considerable debate surrounding these and other issues. If you have an opinion or concern, contact your state and federal legislators.

For more information

A leader in fighting for patients’ privacy rights is the National Coalition for Patient Rights
405 Waltham St., Suite 218
Lexington, MA 02173
Phone: (781) 861-0635
Web: www.nationalcpr.org

The Web site of the American Health Information Management Association includes a white paper on medical records privacy and other useful information, www.ahima.org.
Contact AHIMA at 919 N. Michigan Ave.
Chicago IL 60611-1683.
Phone: (800) 335-5535.

For help with the Americans with Disabilities Act, call the nearest Technical Assistance Center, (800) 949-4232.
Web: www.pacdbtac.org or www.adata.org

Contact the Privacy Advocate of the U.S. Dept. of Health and Human Services regarding privacy-related programs of the DHHS: 200 Independence Ave., SW, Washington, D.C. 20201.
Phone: (202) 690-5896.
Web: www.dhhs.gov

The Health Privacy Project of Georgetown University is a resource for public policy information, especially federally-mandated privacy protection due by August 21, 1999.
Web: www.healthprivacy.org
The Web site includes information on federal privacy legislation.

For health privacy-related disputes in California, contact the county medical society or the Medical Board of California at (800) 633-2322.
Web: www.medbd.ca.gov

For information about access to health records, visit the Web site of the California Medical Association, www.cmanet.org (look for "Free Legal Information").

http://www.medical-record.blogspot.com/