Health Information Management

Q&A: State-prison patients

HIM-HIPAA Insider, March 30, 2009

Q. We treat many patients who come from a state prison. When these patients come to our facility, the officer signs the patient in, and HIPAA privacy requirements are followed. After this person is released from prison is it a HIPAA violation to release the patient’s medical record as long as there is a signed authorization?


A. After the patient is no longer in the custody of the state criminal system, the record is in the control of the patient. PHI can be released without authorization for treatment, payment, healthcare operations (TPO), and certain other exceptions described in the HIPAA privacy rule (keeping in mind there are likely state laws that provide additional privacy protections and may require a signed authorization even for TPO). Other releases, such as to a spouse or an attorney, require a signed authorization from the patient.


Editor's note: Chris Apgar, president of Portland, OR-based Apgar & Associates, LLC, answered this question. This is not legal advice. Consult your attorney regarding legal matters.

Most Popular