|
|
VIRGINIA FREEDOM OF INFORMATION ADVISORY COUNCIL
COMMONWEALTH
OF VIRGINIA |
AO-01-19
March
1, 2019
Dave
Ress
Newport News, VA
The staff of the Freedom of Information Advisory Council
is authorized to issue advisory opinions. The ensuing
staff advisory opinion is based solely upon the information
presented in your electronic mail message dated September
25, 2018.
Dear
Mr. Ress:
You have asked for an advisory opinion regarding whether
state hospitals must provide a patient with access
to the patient's personal medical records under the
Virginia Freedom of Information Act (FOIA). You provided
in your email dated September 25, 2018, that you repeatedly
asked VCU Medical Center for access to your medical
records, but that you were told by your attending
physician, nurses, and someone from the "Risk
Management Department" that you could only access
your records upon discharge, after filling out a particular
hospital form, or after waiting for a period of 30
days.
Issue
Presented
You have asked whether a hospital run by the state
or other public body must provide a patient with access
to his personal medical records.
Applicable
Law and Discussion
As a preliminary matter, it must first be determined
whether the hospital is a public body under FOIA as
defined in § 2.2-3701 of the Code of Virginia.1
"Public body" means any legislative body,
authority, board, bureau, commission, district or
agency of the Commonwealth or of any political subdivision
of the Commonwealth, including cities, towns and
counties, municipal councils, governing bodies of
counties, school boards and planning commissions;
governing boards of public institutions of higher
education; and other organizations, corporations
or agencies in the Commonwealth supported wholly
or principally by public funds.
Virginia
Commonwealth University Health System Authority (Hospital)
is a statutorily created authority.2 It
is therefore considered a public body and is subject
to FOIA unless an exception applies.
Generally
speaking, as a public body, the Hospital is required
to release certain public records in accordance with
FOIA, except as otherwise specifically provided by
law.3 In order to determine whether the Hospital is
required to give you access to your personal medical
records, we must first determine if an exception applies.
Under § 2.2-3705.5, "health records, except
that such records may be personally viewed by the
individual who is the subject of such records, as
provided in subsection F of § 32.1-127.1:03"
are "excluded from mandatory disclosure provisions
. . . but may be disclosed by the custodian in his
discretion, except where such disclosure is prohibited
by law." Subsection F of § 32.1-127.1:03
provides:
Except
as provided in subsection B of § 8.01-413,
copies of or electronic access to an individual's
health records shall not be furnished to such individual
or anyone authorized to act on the individual's
behalf when the individual's treating physician
or the individual's treating clinical psychologist
has made a part of the individual's record a written
statement that, in the exercise of his professional
judgment, the furnishing to or review by the individual
of such health records would be reasonably likely
to endanger the life or physical safety of the individual
or another person, or that such health record makes
reference to a person other than a health care provider
and the access requested would be reasonably likely
to cause substantial harm to such referenced person.
Based
on the information provided in your email, the exception
provided for in subsection F of § 32.1-127.1:03
does not seem to apply here. Subsection B of §
8.01-413 provides in relevant part:
Copies
of a health care provider's records or papers shall
be furnished within 30 days of receipt of such request
to the patient, his attorney, his executor or administrator,
or an authorized insurer upon such patient's, attorney's,
executor's, administrator's, or authorized insurer's
written request, which request shall comply with
the requirements of subsection E of § 32.1-127.1:03.
If a health care provider is unable to provide such
records or papers within 30 days of receipt of such
request, such provider shall notify the requester
of such records or papers in writing of the reason
for the delay and shall have no more than 30 days
after the date of such written notice to comply
with such request.
Subsection
E of § 32.1-127.1:03 provides:
Health
care records required to be disclosed pursuant to
this section shall be made available electronically
only to the extent and in the manner authorized
by the federal Health Information Technology for
Economic and Clinical Health Act (P.L. 111-5) and
implementing regulations and the Health Insurance
Portability and Accountability Act (42 U.S.C. §
1320d et seq.) and implementing regulations. Notwithstanding
any other provision to the contrary, a health care
entity shall not be required to provide records
in an electronic format requested if (i) the electronic
format is not reasonably available without additional
cost to the health care entity, (ii) the records
would be subject to modification in the format requested,
or (iii) the health care entity determines that
the integrity of the records could be compromised
in the electronic format requested. Requests for
copies of or electronic access to health records
shall (a) be in writing, dated and signed by the
requester; (b) identify the nature of the information
requested; and (c) include evidence of the authority
of the requester to receive such copies or access
such records, and identification of the person to
whom the information is to be disclosed; and (d)
specify whether the requester would like the records
in electronic format, if available, or in paper
format. The health care entity shall accept a photocopy,
facsimile, or other copy of the original signed
by the requester as if it were an original. Within
30 days of receipt of a request for copies of or
electronic access to health records, the health
care entity shall do one of the following: (1) furnish
such copies of or allow electronic access to the
requested health records to any requester authorized
to receive them in electronic format if so requested;
(2) inform the requester if the information does
not exist or cannot be found; (3) if the health
care entity does not maintain a record of the information,
so inform the requester and provide the name and
address, if known, of the health care entity who
maintains the record; or (4) deny the request (A)
under subsection F, (B) on the grounds that the
requester has not established his authority to receive
such health records or proof of his identity, or
(C) as otherwise provided by law. Procedures set
forth in this section shall apply only to requests
for health records not specifically governed by
other provisions of state law.
Per
your email, the Hospital informed you that you could
only get your records upon discharge, upon filling
out a particular hospital form, or after a wait of
30 days. Both subsection B of § 8.01-413 and
subsection E of § 32.1-127.1:03 provide that
you are entitled to your medical records and the Hospital
is required to provide access to those records within
30 days of receipt of your request. As those provisions
are more specific than the provisions of FOIA, the
30-day time limit applies instead of the five-day
time limit that typically applies under FOIA.4 If the
Hospital is unable to comply with the 30-day deadline,
they are to notify you in writing of the reason for
the delay and they shall have no more than 30 days
after the date of such written notice to comply with
the request.
Subsection
E of § 32.1-127.1:03 requires a request for medical
records to be in writing, signed, and dated by the
requester; the request must identify the nature of
the information requested (i.e., comprehensive medical
records); the request must also include evidence of
the requester's authority to receive the records as
well as the identification of the person to whom the
information is to be disclosed; and lastly, the request
must specify whether the records should be produced
in electronic format, if available, or in paper format.
A photocopy or facsimile of the original signed request
shall be treated as an original. As stated above,
upon receipt of a properly signed request, the Hospital
has 30 days to produce the requested records. If the
records cannot be produced in that time frame, the
Hospital must either (1) inform the requester that
the information requested does not exist or cannot
be found; (2) inform the requester if the Hospital
does not maintain a record of the information that
has been requested and provide the name and contact
information, if known, of the entity who maintains
those records; or (3) deny the request pursuant to
subsection E of § 32.1-127.1:03 or other applicable
law.
There
is nothing in the law that requires a patient to be
discharged before requesting and gaining access to
his personal medical records; however, you must make
a written request for your records. The Hospital is
allowed to charge a reasonable fee not to exceed the
actual cost for the requested records.5 Given the fact
that the Hospital has created a written form, it is
likely that filling out that form will provide them
with all of the statutorily required information necessary
for them to produce the requested records; however,
subsection G of § 32.1-127.1:03 provides a sample
written authorization form that contains all of the
statutorily required information. This form may be
used instead as there is no requirement for a requester
to use a specific form furnished by a healthcare entity,
so long as the written request contains all of the
required information.
Conclusion
Because
Virginia Commonwealth University Health System Authority
falls within the definition of a "public body,"
it is subject to the rules under the Virginia Freedom
of Information Act.6 Although there are exceptions
under FOIA that would preclude access to health records,
based on the provided facts, none of those exceptions
apply here. It is important to note that your right
to access your personal medical records is governed
by laws outside of FOIA, as well as by FOIA, because
§§ 2.2-3705.5, 8.01-413, and 32.1-127.1:03
set out specific provisions regarding health records.
Where the more specific provisions conflict with the
default rules of FOIA, the more specific provisions
control.
As
a requester, in order to obtain a copy of your medical
records, your request must be in writing, signed,
and dated, it must identify the nature of the information
requested, must include evidence of your authority
to receive such records and provide your identification
as the person to whom the records shall be disclosed,
and the request must specify whether the records are
to be produced electronically or in paper format.
After submitting a proper request, by law the Hospital
has 30 days to comply with your request and produce
the requested records unless, per subsection E of
§ 32.1-127.1:03, an exception applies.
Thank
you for contacting this office. We hope that this
opinion is of assistance.
Sincerely,
Ashley
Binns
Attorney
Alan
Gernhardt
Executive Director
1All
section numbers provided are from the Code of Virginia.
2§ 23.1-2401.
3§ 2.2-3704(A).
4§ 2.2-3704(B).
5§ 2.2-3704(F).
6See
§ 2.2-3701.
|