California residents have broad rights to inspect, copy and even amend their health records under both federal and state law. The Federal Health Insurance Portability and Accountability Act (commonly known as “HIPAA”) sets minimum standards for patient access to health records that all states must follow. In California, patients are also protected by the Patient Access to Health Records Act (“PAHRA”). Each of those laws provide different protections for patients and impose different obligations upon health care providers.
Unfortunately, the existence of both state and federal regulations regarding patient access to health records can be confusing for patients and health care providers alike.The applicable law can even be a point of contention in the event that a consumer finds himself in conflict (such as a malpractice lawsuit) with his or her health care provider and the patient seeks health records that the provider would prefer not to disclose.
Whether HIPAA or PAHRA controls a patient’s access to his or her health records in a particular instance can be a complex inquiry.HIPAA specifically provides any state law that is less stringent than HIPAA (meaning any state law that does not provide a patient with equal or greater access to his or her health records than HIPAA) is preempted by HIPAA. Conversely, if a state law provides a patient with greater access to his or her health records than HIPAA, the state law controls. Ultimately, whether HIPAA or PAHRA controls the disclosure of health records often comes down to the nature of the health records sought. For instance, under HIPAA, a mental health professional can refuse to disclose psychotherapy notes to a patient for any reason and without review. However, PAHRA contains no such limitation regarding psychotherapy notes.
Therefore, because PAHRA provides greater access to a patient’s psychotherapy notes, PAHRA provides the controlling rules of law.
Whether you are a patient or a health care provider, it is important to know your rights and obligations with respect to health records. PAHRA, requires health care providers to provide access to requested records within 5 business days of a patient’s written request. A health care provider’s improper refusal to provide such access is unprofessional conduct subject to sanction. In addition, a patient may sue a health care provider to enforce PAHRA. The prevailing party in such a lawsuit may be awarded their attorneys fees and costs. Accordingly, a health care provider’s improper refusal to disclose health records can be an expensive error. Likewise, a patient’s lawsuit to enforce disclosure of properly withheld records can be both futile and costly.
The Law Office of Andrew W. Twietmeyer provides guidance to both patients and providers who need counsel regarding their rights and obligations under HIPAA and PAHRA. If you are unsure of your own rights or obligations, contact Mr. Twietmeyer for a free preliminary interview.