On June 27, 2007, Governor Mike Easley signed into law House Bill 353 (Session Law 2007-115). This new law affects health care providers by more closely aligning North Carolina laws governing patient privacy with HIPAA's provisions regarding (i) disclosures of patients' protected health information ("PHI") to law enforcement, and (ii) disclosures for treatment, payment and health care operations.
Before Session Law 2007-115 was enacted, health care providers could not release to law enforcement confidential information obtained in medical records without the patient's authorization or a court order, except in very limited circumstances permitted under specific North Carolina laws. Accordingly, health care providers were often placed in the uncomfortable situation of explaining to law enforcement that they could not comply with law enforcement's request for information because, under HIPAA's preemption provision at 45 C.F.R. § 160.230(b), the stricter North Carolina law prevented disclosure.
Health care providers should be aware of Session Law 2007-115, as its provisions should lessen such conflicts between health care providers and law enforcement. The new law amends N.C. Gen. Stat. § 90-21.20B(a), which now reads:
Notwithstanding G.S. 8-53 or any other provision of law, a health care provider may disclose to a law enforcement officer protected health information only to the extent that the information may be disclosed under the federal Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R. § 164.512(f) and is not specifically prohibited from disclosure by other state or federal law.
This provision now permits, but does not require, health care providers to release PHI to law enforcement to the extent such release is specifically permitted by HIPAA.
Session Law 2007-115 further alleviates a significant concern of North Carolina hospitals following the enactment of the Motor Vehicle Driver Protection Act of 2006 ("Act"). Under the Act, when a law enforcement officer requested a physician, registered nurse, emergency medical technician, or other qualified person to perform a blood or urine test upon an individual, that health care professional was required to obtain the blood or urine sample, even without the individual's authorization or approval. Hospitals were highly concerned about the physical safety of both the patient and the personnel administering the test when the patient did not consent or cooperate. The new law permits the medical provider to refuse to take the sample and revises N.C. Gen. Stat. §§ 20-139.1(c) and 20-139.1(d2) as follows:
A person requested to withdraw blood or collect urine pursuant to this subsection may refuse to do so only if it reasonably appears that the procedure cannot be performed without endangering the safety of the person collecting the sample or the safety of the person from whom the sample is being collected. If the officer requesting the blood or urine requests a written justification for the refusal, the medical provider who determined the sample could not be collected safely shall provide written justification at the time of the refusal.
The changes in the law still do not address who is responsible for payment of the test.
The new law also adds a new provision, N.C. Gen. Stat. § 90-21.20B(e), concerning disclosure of PHI for treatment, payment and health care operations:
Notwithstanding G.S. 8-53 or any other provision of law, a health care provider may disclose protected health information for purposes of treatment, payment or health care operations to the extent that disclosure is permitted under 45 C.F.R. § 164.506 and is not specifically prohibited by other state or federal law. As used in this subsection, "treatment, payment, or health care operations" are as defined in the Standards for Privacy of Individually Identifiable Health Information.
The full effect of this change is unclear. For physicians in private practice, the change may permit, but not require, them to disclose PHI for treatment, payment and health care operations without obtaining patient consent or a court order. For institutional providers and other types of health care professionals, however, other specific laws apply and should be considered before making such disclosures without obtaining consent or a court order. Because the highlighted language suggests that disclosure should not occur if other state or federal laws contain specific prohibitions to disclosure, a provider must consider whether these other laws permit the disclosure or require patient consent or a court order.
For example, there are specific prohibitions or requirements in other state and federal laws and regulations governing behavioral health facilities, communicable diseases, long term care facilities, and acute care hospitals that can be interpreted as not permitting disclosure without patient consent or a court order. North Carolina law also contains prohibitions on disclosure of confidential patient information by other types of health care professionals, such as psychologists, counselors, therapists and social workers, without the patient's consent or a court order. Although the intent likely was to permit these types of professionals to disclose PHI without patient consent or a court order, it is unclear at this time how courts will interpret the first phrase and the last phrase in this provision, considering other specific North Carolina and federal laws.
In light of the new law, health care providers should consider the following actions:
- Revising policies and procedures to address (1) appropriate responses to law enforcement requests for information, including PHI, and (2) appropriate circumstances for refusing to perform blood or urine tests.
- Educating staff members regarding proper responses to law enforcement requests for information. Staff members should be reminded that HIPAA permits but does not require disclosures of PHI to law enforcement in certain but not all circumstances. For example, HIPAA permits PHI to be disclosed upon a request from law enforcement to locate a specific person. It would not be proper, for example, for law enforcement to issue a blanket request that health care personnel contact law enforcement every time an unaccompanied minor, who may or may not be a runaway, is treated.
- Revising the standard "Notice of Privacy Practices" that is provided to patients to reflect that PHI may be disclosed to law enforcement in certain situations, and that PHI also may be released to third parties for purposes of treatment, payment, and health care operations in some circumstances without patient consent.
- Evaluating whether to revise policies and procedures to allow staff in certain circumstances to disclose PHI for treatment, payment, or health care operations without obtaining specific patient consent or a court order.
Session Law 2007-115 does not resolve every situation faced by health care providers in which HIPAA and North Carolina law conflict and gray areas still exist. Providers should consider other state and federal laws that may impact how they should address release of PHI. Nonetheless, the new law should ease conflicts with law enforcement that health care providers must navigate in their daily operations and allow some flexibility when disclosing PHI for treatment, payment or health care operations.