06 Oct Virginia: Medical Malpractice – a Lawyer’s Privacy
In medical malpractice cases, hospitals are resisting patient requests for the audit trails and underlying metadata of their electronic medical record. However, Virginia’s Health Records Privacy Act is some good patient authority.
It requires: “Health care entitles shall disclose health records to the individual who is subject of the health record”. Va. Code §32.1-127.1:03(A)(1)(emphasis added). “Health care provider” means “any health care provider, health plan or health care clearinghouse”. Va. Code §32.1-127.1:03(B).
“Health record” means “any written, printed or electronically recorded materials maintained by a health care entity in the course of providing health services to an individual concerning the individual and the services provided.” Id. (emphasis added). It “also includes the substance of any communication made by an individual to a health care entity in confidence during or in connection with the provision of health services or information otherwise acquired by the health care entity about an individual in confidence and in connection with the provision of health services to the individual.” Id.
Virginia law expressly incorporates Federal law about required disclosure of patient health care records electronically: “Health care records required to be disclosed pursuant to this section shall be made available electronically only to the extent and in the manner authorized by the federal Health Information Technology for Economic and Clinical Health Act [‘HITECH’] (P.L. 111-5) and implementing regulations and the Health Insurance Portability and Accountability Act [‘HIPAA’] (42 U.S.C. § 1320d et seq.) and implementing regulations.” Va. Code §32.1-127.1:03(E). Health care entities must respond “within 15 days of receipt of a request for copies of or electronic access to health records”. Id.
In a judicial proceeding, §32.1-127.1:03 and HIPAA even allow for disclosure of otherwise protected third-party medical records and health information. E.g., Planicka v. Anesthesiology of Virginia, P.C., 83 Va. Cir. 482, 483-84 (Fairfax Nov. 22, 2011)(“medical records for the other, third-party patients in the INOVA Fairfax Hospital electro-physiology lab” redacted for “patient identifying information” ordered); Young v. Loudoun Long Term Care Ctr., 67 Va. Cir. 532, 533-34 (Loudoun Aug. 2, 2004)(“name, address, and telephone number of the decedent’s [nursing facility] roommate” ordered); Auer v. Baker, 63 Va. Cir. 596, 600-01 (Norfolk Feb. 17, 2004)(“letters and/or complaints relating to contamination and/or preservation of the integrity of samples and specimens… regarding two patients unrelated to this action” ordered for in camera review and redaction of “any confidential, patient-identifying information”). Significantly, such third-party confidential material disclosure even extends to Audit Trails: Virginia Hospital Center “shall provide the OB TraceVue Audit Trail(s) for all labor and delivery patient entries made by Nurse Bates Gilpin for the period 12:30 a.m. to 7:00 a.m. on July 10, 2008… redacted to remove the identifying characteristics”. Kipoliongo v. Tchabo, No. CL-2010-7881, Order (Fairfax May 20, 2011)(emphasis added). See, Ex. 6 (attached).
Correspondingly, the Virginia Administrative Code (“VAC”) requires: “A medical record shall be established and maintained for every person treated on an inpatient, outpatient (ambulatory) or emergency basis in any unit of the hospital.” 12 VAC 5-410-370(B). “Provisions shall be made for the safe storage of medical records or accurate and legible reproductions thereof according to §32.1-127.1:03 of the Code of Virginia and the Health Insurance Portability and Accountability Act, or HIPAA (42 U.S.C. §1320d, et seq.).” 12 VAC 5-210-370(E).