Health Insurance Portability and Accountability (HIPAA) Act of 1996

Key Points

  • A medical forensic exam is a medical exam that in most cases is subject to the Health Insurance Portability and Accountability Act of 1996.
  • In Texas, anyone who “comes into possession of protected health information” is a covered entity and must comply with HIPAA privacy standards (Texas Health & Safety Code §181.001(b)(2)(B)). This includes, but is not limited to, health care professionals, investigatory agencies, and legal professionals.
  • Health care providers may share copies of patient medical records only with other health care providers or health plans as needed for treatment or payment (HIPAA Privacy Rule).
  • Health care providers may provide information to law enforcement without patient consent if the information is used to identify or locate a suspect, fugitive, material witness or missing person, or to inform law enforcement about the commission and nature of a crime.
  • There is no statute of limitations on sexual offenses in Texas, therefore it is best practice to maintain medical forensic records related to sexual assault securely and indefinitely. Physicians and hospitals may not destroy a medical record from the medical forensic examination of a sexual assault victim until the 20th anniversary of the date the record was created (Texas Health and Safety Code §241.1031).
  • Health care providers should obtain patients’ verbal and written consent to provide a copy of their medical forensic assessment record to law enforcement and attorneys and only with a subpoena or following facility policy.
  • Health care providers may share information without patients’ consent in response to court orders issued by a judge, limited to the information requested in the court order.
  • Health care providers do not need to obtain consent to report child abuse or child/dependent adult sexual abuse/assault to law enforcement and Child Protective Services (Texas Family Code §261.001).
  • Gunshot wounds and controlled substance overdoses must be reported to law enforcement under Texas law (Texas Health & Safety Code §161.041).
  • Patients have a right to inspect, review and receive a copy of their medical records under HIPAA.
  • In Texas, providers must give patients a copy of their medical record within 15 business days of a written request if using electronic health records (Texas Health & Safety Code §181).
  • Allowable exceptions under HIPAA to providing patients with a copy of their medical records are uncommon in sexual assault medical forensic examinations.
  • Denials to release medical records to patients must be provided within 60 calendar days of a request and can be appealed.
  • Health care providers can request patients meet with them to review patients’ medical records and discuss concerns about releasing them; however, they cannot require patients to meet with them as a condition for providing the records.
  • Medical records of students receiving health care at campus health centers are an exception; they are covered by Family Educational Rights and Privacy Act (FERPA) of 1974 (Education U.S.C. §1232g, 2013) and HIPAA.