Trial lawyers often need to obtain medical records for use at trial. To do so, litigators not only overcome challenges to the doctor-patient privilege but they also must comply with the 1996 Health Insurance Portability and Accountability Act (HIPAA). HIPAA sets federal standards for health care plans, health care clearinghouses, and most health care providers to protect patients’ personal health information (PHI). HIPAA’s “Privacy Rule” defines how providers can use PHI and when and how PHI can be disclosed. 
 
Under special circumstances, the Privacy Rule permits disclosure of PHI. In judicial proceedings, PHI can be disclosed in three ways:

1. with a patient’s signed authorization complying with HIPAA and any state regulations,
    
2. a court order allowing access to specific medical information, and
    
3. through a subpoena, discovery request,or other lawful process and either give notice of the request to the individual or enter into a HIPAA-approved protective order. In short, litigants must show proof of notice to the patient that PHI has been requested or seek a court order. 

Under HIPAA, the best proof of notice is a written document that informs a patient of the request for PHI and the litigation. The notice should also permit time for the patient to object to the disclosure.
 
A HIPAA-compliant court order should limit the parties to using or disclosing the PHI only to the litigation or judicial proceedings. Additionally, the court order should require the PHI to be returned or destroyed after litigation.
 
Ultimately, after the PHI is produced, whether it will be admitted into evidence turns on other considerations that are governed by state law instead of HIPAA.
 
After litigation, if the PHI is retained by litigators for ethical or record-keeping purposes, the information will be marked as confidential and the provider will be informed that the information will be retained and safeguarded.
 
For providers, good record keeping is key to HIPAA compliance. Providers should ensure that they disclose PHI only under the specific circumstances outlined in HIPAA. Providers should also ensure that they keep records of each specific disclosure and the reason for each disclosure.
 
John D. Martin is a trial lawyer and the managing partner of the Cranfill Sumner & Hartzog LLP’s Wilmington, North Carolina office. Martin concentrates his practice in the medical malpractice and professional liability defense practice groups.  He has tried numerous medical malpractice and personal injury cases throughout eastern North Carolina. Many of his cases involve brain injury, birth trauma, paraplegia and wrongful death. Additionally, Martin has experience with large construction litigation, premises liability and hospital/workplace security. To contact Martin, call (910) 777-6018 or email him at [email protected].