Question 1

Can covered healthcare providers share protected health information about patients for treatment purposes?

Accepted Answer

A facility or medical practice’s Notice of Privacy Practices is required to inform the patient how the practice intends to use and disclose protected health information.

If the patient has received your Notice of Privacy Practices and signed an acknowledgment of receipt, you may share information with other healthcare providers for treatment, payment, and operations.

Question 2

Is the release of medical records related to mental health or drug and alcohol treatment handled any differently than the release of other types of medical treatment?

Accepted Answer

Patients who have received treatment in a mental health facility or drug and alcohol treatment facility must sign an authorization specific to the release of those records.

If the patient has talked to their primary care physician about depression or drug and alcohol use in the course of other treatment, those records fall under HIPAA guidelines for treatment, payment, and operations.

Question 3

If we receive a request for medical records with a proper authorization, and another physician’s records are contained in our chart, must we copy and send those records as well?

Accepted Answer

Under the federal HIPAA law, 45 C.F.R. 164.501, a designated record set is:

A group of records maintained by, or for, a covered entity that is used, in whole or in part, by, or for, the covered entity to make decisions about individuals.
It includes any item, collection, or grouping of information that includes protected health information and is maintained, collected, used, or disseminated by, or for, a covered entity.

Therefore, if the person requesting the medical record requests the entire chart, or a portion of the chart, which includes records from another provider, and you have relied upon those records for treatment decisions, those records should be released along with your own medical records.

An Exception to the General Rule

That exception falls under a federal law protecting the records of a patient for drug or alcohol abuse. 42 C.F.R. Part 2. If you have records from another provider that include records dealing with drug or alcohol abuse, you may not be able to disclose those particular records based on the federal law preventing such re-disclosure.

Question 4

How often does HIPAA require a patient to sign a medical practice’s Notice of Privacy Practices?

Accepted Answer

A covered healthcare provider who has a direct treatment relationship with a patient is required to make a good faith effort to obtain an individual's acknowledgment of receipt of the notice only at the time the provider delivers the initial service.

Question 5

Is a patient required to pay for a copy of their medical record information?

Accepted Answer

The HIPAA Privacy Rule permits the covered entity to impose reasonable, cost-based fees. The fee may only include the cost of copying (including supplies and labor) and postage if the patient requests that the copy be mailed.

If the patient agrees to receive a summary explanation of his or her protected health information, the covered entity may also charge a fee for preparing it. The fee may not include costs associated with searching for and retrieving the requested information. See 45 C.F.R. 164.524(c).

Question 6

I have received a records request from an attorney. What do I do?

Accepted Answer

Make sure you read the entire records request.

Check to see what the attorney is asking for and who they are representing.
Check to see if the records request includes a HIPAA-compliant authorization from the patient to release the protected health information.

If there is no supporting authorization, call the attorney’s office to tell them you will not be able to send the records. If you need assistance determining if there is proper authorization, contact KAMMCO, and we will review the request with you.

Question 7

I have received a subpoena. What do I do?

Accepted Answer

Pay special attention to what the subpoena is commanding. Some subpoenas are orders to appear, while others are simply orders to produce records.

Check to see who issued the subpoena. If the subpoena was signed by a judge, making it a court order, you must comply with it. If the subpoena was issued by an attorney or clerk of the court, you will need one of the following:

A court order, signed by a judge;
A HIPAA-compliant patient authorization;
Satisfactory assurances in the subpoena plus an exception to Kansas law allowing the disclosure; or,
An exception under HIPAA and state law allowing the disclosure.

If none of these are present, hire an attorney to object to the subpoena.

If you receive a subpoena to appear for testimony, you still need proper authorization to release PHI. If you do not have proper authorization, you MUST still appear on the date and time stated in the subpoena. You will likely be given a court order upon your appearance authorizing the release of patient information, so it is important to bring the patient’s information with you.

If desired, KAMMCO will provide an attorney to accompany you when subpoenaed to testify, regardless of whether your medical care is at issue.

For help in determining if you have the proper documents to release patient information, contact KAMMCO.

Question 8

Who can get the records of a deceased patient?

Accepted Answer

First, determine if an estate has been opened by the court for the deceased patient. If so, the court will have named an executor or administrator of the estate. If an executor or administrator is named, that person is the only person who may obtain the deceased patient's records, absent a court order.

However, often no estate has been opened, nor will one be. In this case, the next-of-kin in line of descent are entitled to access and authorize the release of the deceased patient's medical records.

Next-of-Kin Rules

Under next-of-kin rules, if there is a spouse, the spouse may obtain the records, and no one else may do so absent a court order.

If there is no spouse, then any adult child of the deceased patient may get the records.

If there are no adult children, then the patient’s parents may get a copy of the records.

Finally, if there are no parents, then the patient’s siblings may get the records.

Documentation

Document your reasoning for allowing access to the medical records by the person requesting the medical records. Also, document some reasonable attempt to prove that the person is who they claim to be. For example, you could check a driver’s license, check the chart to see if next-of-kin were named, or verify matching last names.

Question 9

The Board of Nursing or the Board of Healing Arts has subpoenaed a patient record. May I release the information?

Accepted Answer

Licensing boards, such as the Board of Healing Arts and the Board of Nursing, have a right to request protected health information (PHI) in investigating potential or existing disciplinary actions against a licensee. If you receive a request for PHI from a licensing board, you may release the information after verifying and documenting that the Board needs it for an investigation into the licensee.

HIPAA does not preclude the release of records under such circumstances if you have determined that the purpose of the release is for healthcare operations, such as investigating disciplinary actions, by the healthcare oversight agency, including the Board of Nursing or the Board of Healing Arts.

Question 10

I have been asked to release the patient medical record, with proper authorization. Do I have to release other providers’ records I have in my chart?

Accepted Answer

Should you determine that the release of the records is inappropriate, you should state that there are records you are not at liberty to release. You do not need to disclose the other provider, the origin of the records, the type of treatment involved, or the reason for the non-disclosure.

Question 11

How long do I have to keep medical records?

Accepted Answer

Physicians keep medical records for ten (10) years from the date of last treatment. This includes minors and deceased patients.

Hospitals keep medical records for ten (10) years after the date of the patient's last discharge, or one (1) year beyond the date the minor patient reaches the age of majority, whichever is longer. A hospital must maintain a summary of medical records that are destroyed.

This summary shall be retained on file for at least twenty-five (25) years and shall include the following information:

The name, age, and date of birth of the patient;
The name of the patient’s nearest relative;
The name of the attending and consulting practitioners;
Any surgical procedure and date, if applicable; and,
The final diagnosis.

Question 12

How long am I required to keep charts of inactive patients?

Accepted Answer

Each physician shall maintain the patient record for a minimum of ten (10) years from the last date the physician provided services to the patient.

Question 13

Am I required to keep inactive charts on site?

Accepted Answer

No, a physician may designate an entity, another physician, or a healthcare facility to maintain the record, so long as the record is stored in a manner that allows access and maintains confidentiality.

Question 14

What are the requirements for electronic medical records?

Accepted Answer

Patient records may be stored by an electronic data system, so long as:

The electronic record is an exact duplication of the paper record.
The entry is authenticated and unalterable.
The record can be reproduced in paper form if requested.
The electronic medical record indicates if there are existing original documents or information not included in the electronic record.

Question 15

Can I destroy the paper copies once they are entered into the electronic record?

Accepted Answer

Paper records may be destroyed once they are entered into an electronic record if the electronic record is an exact replication of the information on the paper record, and the record can be reproduced in paper form from the electronic record if requested.

Question 16

I am terminating my practice. What do I do with patient records?

Accepted Answer

Patient records should be stored upon the termination of practice. The physician is required to notify the Board of Healing Arts/Medical Board, within thirty (30) days of terminating the practice, with the following information.

The location where the patient records are stored;
If the physician has designated an agent to maintain the records, the name, telephone number, and mailing address of the agent; and,
The date on which the patient records are scheduled to be destroyed.

Question 17

How much should I charge for copying patient records?

Accepted Answer

The HIPAA Privacy Rule permits the covered entity to impose reasonable, cost-based fees. The fee may only include the cost of copying (including supplies and labor) and postage if the patient requests that the copy be mailed.

If the patient agrees to receive a summary explanation of his or her protected health information, the covered entity may also charge a fee for preparing it. The fee may not include costs associated with searching for and retrieving the requested information. See 45 C.F.R. 164.524(c).

Question 18

A patient has requested a records transfer but still owes our practice for prior services. Can we demand payment before transferring the records?

Accepted Answer

A physician should furnish a copy of a patient’s medical record upon receipt of a signed release. The release of a medical record cannot be conditioned upon payment of a medical debt.

However, a statement that the physician may charge a reasonable fee for the costs of retrieving and reproducing the record. It is not a violation to demand pre-payment of this fee when the request comes directly from the patient rather than from another provider.

Question 19

How do I deal with a patient complaint?

Accepted Answer

Instead of immediately responding to an angry patient, first, determine the actual reason for the patient’s dissatisfaction. The most common cause of patient dissatisfaction is a surprise, usually stemming from the outcome of the patient’s treatment or the amount of the bill.

After you determine why the patient is angry, the best practice is to deal with the situation directly. Often, a patient simply wants attention or an answer, and their anger dissipates once they receive one.

If a patient has a complaint about a particular physician or staff member, responses should be made promptly and in the form requested by the patient (e.g., letter or telephone call).

If a particular situation is especially difficult, you may want to draft a response to the patient and ask KAMMCO to review it before sending it.

Question 20

What if a patient requests a refund or a write-off of their bill?

Accepted Answer

Because every situation is different, there are no set guidelines on whether to refund or write off a patient’s bill. Often, a patient who does not have to pay for what they feel is unwarranted will accept the waiver as restitution and interpret it as a gesture of goodwill. However, some patients may interpret it as an admission of liability, so the risks and benefits should be weighed carefully before making such a decision.

If, in fact, you do decide to write off the patient’s bill, it is important to emphasize that you are doing so from a customer service standpoint. Also, it is a good idea to have the patient sign a release of claims form, which is an agreement between the patient and physician stating that, in exchange for the physician writing off the patient’s charges, the patient is waiving their right to bring a claim related to the incident at issue

Question 21

What if a patient fails to show up for follow-up appointments?

Accepted Answer

If a patient cancels or is a no-show for an appointment, be sure to note in the patient’s chart that he or she did not keep the appointment. If the patient does not call to reschedule, they should be contacted by telephone to remind them of the importance of keeping their appointments.

If the patient does not respond, you may want to send a letter, depending on the nature of the missed appointment.

If it is an important follow-up appointment for a condition requiring ongoing care, send a letter to the patient outlining the importance of seeking continuing medical attention and include contact information for your facility. Be sure to include a copy of the letter in the patient’s chart.

Question 22

For what reasons can I dismiss a patient?

Accepted Answer

A patient can be dismissed for any number of reasons, including noncompliance, failure to pay their bill, or a breakdown of the physician-patient relationship.

It is important to evaluate where the patient is in their care when considering dismissal. If the patient’s care will be interrupted by dismissal, it is recommended that you see the patient through the end of the current treatment to avoid abandonment issues.

Special consideration should be given to patients who are pregnant, undergoing surgery, or who have chronic illnesses. It is important to evaluate the patient's status in his or her course of treatment before dismissal.

Question 23

Do I have to tell the patient why I am dismissing them?

Accepted Answer

It is not required for a physician to tell a patient why they are being terminated from the practice. Often, it is not recommended that the patient be informed of the reason, as this may inflame the patient and complicate an already sensitive situation.

There is an exception to this general rule. That exception falls under a federal law protecting the records of a patient for drug or alcohol abuse, 42 C.F.R. Part 2.

Should you determine that the release of the records is inappropriate, you should state that there are records you are not at liberty to release. You do not need to disclose the other provider, the origin of the records, the type of treatment involved, or the reason for the non-disclosure.

Question 24

What process should I follow when terminating a patient?

Accepted Answer

Notify the patient in writing of your intent to terminate their care with your practice. The letter should include:

A statement advising the patient of the actual termination date, which is typically thirty (30) days from the date of the letter;
If appropriate, a statement advising the patient that their condition warrants continued treatment by another physician;
A statement advising the patient that the termination applies to all members of your group, if applicable;
A statement explaining that, should you be called upon to treat the patient in the emergency room, you will treat the patient, but it is not a re-establishment of the physician-patient relationship; and,
An offer to send copies of the patient’s medical records to his or her new physician pursuant to a signed authorization.

The letter should be sent by both regular mail (addressed with service requested) and certified mail (return receipt requested). A copy of the letter should be placed in the patient’s chart.

Frequently Asked Questions

Risk Management Resources

Our Approach to Risk Management

Med-IQ Online Learning Center

Risk Management Resources and Tools

Education Library

Events Calendar

HIPAA FAQ

An Exception to the General Rule

Medical Records FAQ

Next-of-Kin Rules

Documentation

Patient Relations FAQ

Additional Resources

INSURANCE

RISK MANAGEMENT

CLAIMS