Details on State Medical Records Privacy Laws

Federal, state, and local governments are responsible for protecting and safeguarding the public health and welfare. Accordingly, during terms of various epidemics the state has required the registration of infected persons in order to treat and/or quarantine them and to study the spread of the disease to ultimately control and eradicate it. Thus, although access to medical records is highly guarded, the reporting of diseases is widely practiced at all levels of government. The Center for Disease Control, for example, publishes The Morbidity and Mortality Weekly Report, containing a comprehensive list of all reported illnesses by both state and region that benefits the family practice doctor as well as the epidemiologist. The reports of cases that are reported, from the flu to various venereal diseases to AIDS (acquired immunodeficiency syndrome), are given in confidence, and access to the records is forbidden for most other purposes.

The outbreak of AIDS has sparked controversy over the confidentiality of medical records and diagnoses. Some employers and insurance companies have sought to have individuals tested for the HIV virus, which can lead to AIDS, before hiring in order to prevent considerable expenses in the future as the employee's health fails. Often these same parties argue for access to medical records for background checks as part of the interview process. The great tension regarding the rights of individuals with the HIV virus or AIDS, the public's interest in controlling and fighting the epidemic, and the interest of employers, insurers, and health officials in providing adequate and affordable medical care has created a very dynamic ethical and legal dilemma that will not soon be resolved.

The laws controlling and regulating access to medical records vary greatly from state to state, although the basic protection is always there: a person's medical records are personal and private. As is historically the case, the federal government has gotten increasingly involved in the area of individual rights and has enacted a number of pieces of privacy legislation. For example, the Federal Privacy Act of 1974 requires the release of information in federal files to the subject individual upon request, although some government agencies have established regulations allowing the release of information to a physician chosen by the requesting individual (5 U.S.C. 552a(f)(3)). Federally funded community mental health and mental retardation centers must maintain safeguards to preserve confidentiality and protect the rights of patients (52 U.S.C. 2689(d)(2)), and the Department of Defense may not use for any adverse personnel decision any personal information obtained in interviews with members of the service who are HIV positive (PL 49-661 §;705(c)).

This chapter treats all statutes that could be found concerning privacy and medical records. It must be noted, however, that this emerging field is increasingly subject to revision and new legislative attention. In addition, in certain areas such as AIDS information, the courts may have construed other statutes as protecting or not protecting AIDS victims. In these cases the courts may be awaiting or inviting legislative action. Spaces on the chart that are left blank are those situations where specific laws cannot be found; this does not necessarily mean that an individual is without protection in these areas.