Opinion ID: 787339
Heading Depth: 3
Heading Rank: 1

Heading: DHS Employee Access to Records

Text: 81 Ariz. Admin. Code R9-10-1511(A)(4)(b), (c) requires providers to give DHS employees access to unredacted medical records. 82 The type of information that may be requested under the regulation is extremely broad, and includes patient identifying information such as names and full medical histories. Defendants maintain that DHS could only review and copy patient records as part of sampling them during a licensing survey or as part of a complaint investigation, but these limits are still very broad, especially as the scheme permits anonymous complaints. Moreover, while statutes giving DHS access to records limit the purpose for which access can be sought, the challenged regulation has no such limitations on its face. 83 The potential for harm in any subsequent non-consensual disclosure is obviously tremendous, and defendants do not dispute this, yet the safeguards to prevent unauthorized disclosure to members of the public are inadequate. Although the act prohibits DHS from publicly releasing specific, identifiable patient information, Ariz.Rev.Stat. §§ 36-449.03(I), 36-2301.02(G), it is unclear whether the statute provides for any criminal or civil penalties for such disclosure by DHS employees. Cf. Lawall II, 307 F.3d at 787 (noting the criminalization of an employee's disclosure of information); see also Whalen, 429 U.S. at 594-95, 97 S.Ct. 869 (same). The civil and criminal penalties to which defendants cite, Ariz.Rev.Stat. §§ 36-431, 36-431.01, appear to refer primarily to the health providers, and may not apply to DHS employees. DHS argues that it trains its employees in the need for patient confidentiality, but the only evidence of such training it has submitted is vague deposition testimony by DHS personnel stating that certain employees are required to keep information confidential, and that some staff are trained in confidentiality, without explaining which employees are trained, whether those with primary access to the records are the ones trained in confidentiality, or what that training entails. 84 Furthermore, even if the safeguards against public disclosure were adequate, there are no safeguards at all against release of information to government employees who have no need for the information, as there were in Lawall II. In Whalen, access to the files was confined to a very limited number of health department and investigatory personnel: seventeen Department of Health employees and twenty-four investigators who only had access in cases of overdispensing investigations. 429 U.S. at 595, 97 S.Ct. 869. Also in Whalen, older files were kept in a locked vault, and the receiving room for the information was surrounded by a locked wire fence and protected by an alarm system. Id. at 594, 97 S.Ct. 869. 85 Weighing even further against the medical record access is the fact that there is little, if any, need for much of this information, such as the names and addresses of patients. Defendants assert that they need access to patient identifying information because they need to ensure that providers are complying with the scheme's requirement that they document such information, but ensuring compliance with this administrative requirement is tenuously related to health interests, and DHS could ensure such compliance simply by checking whether the required fields are present in a patient's chart, even if the content of those fields were marked out. Other monitoring goals could easily be satisfied using a coding system to track records without the release of patient identifying information. 86 Finally, while the public interest involved — promoting health and safety — is of course a strong one, we fail to see how insisting on unredacted materials promotes this need. We therefore hold that the regulation giving DHS unbounded access to unredacted patient records violates the informational privacy rights of patients. 87