Corporate Compliance

Q&A: Transporting original medical records

Compliance Monitor, April 15, 2009

Q: The Department of Defense allows some active duty service members moving to a new base to transport their own original medical record to the next base. Is this a HIPAA violation? This seems to represent a privacy and security concern by risking the loss or theft of the original medical record.

A: It is not a HIPAA violation to allow a patient, whether in the armed forces or changing primary care physicians, to transport his or her own original medical record from one location to another. However, it is true that this represents a significant risk. Even allowing the individual to carry a copy of his or her medical record (as opposed to the original) from one location to another represents a privacy risk.

Although HIPAA does not prohibit an individual from transporting his or her medical record, it would be wise to discontinue such practices to better protect the privacy and security of the record. Covered entities are allowed to adopt more stringent privacy and security practices than required by HIPAA. Such practices would be appropriate in this case.
This question was answered by Chris Apgar, CISSP for the HCPro newsletter Briefings on HIPAA. For more information on this newsletter visit the HCMarketplace.

Most Popular