The Maryland General Assembly passed a new law which authorizes health care providers to disclose certain “directory information” and alters the circumstances under which a health care provider can disclose medical records. This law became effective on October 1, 2017.
This change in law reportedly came after testimony from a parent who was unable to find his son, who suffers from psychosis, for three months after the son was transferred from the hospital to which he was initially admitted.
The law is intended to ensure that Maryland law related to the confidentiality of medical records is not interpreted to be more restrictive than the federal privacy regulations adopted under HIPAA; is not in conflict with HIPAA; and is interpreted consistently with any federal regulation, policy guidance, or judicial decision relating to HIPAA.
First, the law provides that unless the patient has restricted or prohibited the disclosure of directory information, a health care provider may disclose such information about a patient to an individual who has asked for the patient by name. “Directory information” is defined as information concerning the presence and general health condition of a patient who has been admitted to a health care facility, or who is currently receiving emergency health care in a health care facility.
The health care provider is required to (1) inform the patient of the information that may be included in the directory and the individuals to whom such information may be disclosed; and (2) provide the patient with the opportunity to restrict or prohibit the disclosure of directory information as soon as practicable. If, due to the patient’s incapacity or need for emergency treatment, it is infeasible for the health care provider to consult with the patient about disclosure, the health care provider may disclose the patient’s directory information if the disclosure is (1) consistent with a previously expressed preference of the patient; and (2) based on the health care provider’s professional judgment, in the best interest of the patient.
The law also alters the circumstances under which a health care provider may disclose a patient’s medical record—without authorization—to immediate family members of the patient or any other individual with whom the patient is known to have a close personal relationship. Previously, the law permitted a health care provider to disclose a patient’s medical record to such individuals without authorization under any circumstances, unless the patient instructed the provider not to make the disclosure, or the record was developed primarily in connection with the provision of mental health services. Now, the law permits a health care provider to disclose a patient’s medical record—including mental health records—so long as the disclosure is limited to information that is directly relevant to the individual’s involvement in the patient’s health care. In addition, if the patient is available prior to the disclosure and has the capacity to make health care decisions, the disclosure is permissible if (1) the patient was given the opportunity to object to the disclosure and did not object; or (2) based on the health care provider’s professional judgment, the health care provider reasonably infers from the circumstances that the patient does not object to the disclosure. If the patient is unavailable before the disclosure is made, or if providing the patient with an opportunity to object is not practicable because of the patient’s incapacity or need for emergency treatment, the health care provider may disclose the patient’s medical record if, based on the health care provider’s professional judgment, the disclosure is in the best interests of the patient.
Please contact Greg Garrett if you have any questions or would like additional information.
This alert has been prepared by Tydings for informational purposes only and does not constitute legal advice.