Opinion ID: 1283853
Heading Depth: 1
Heading Rank: 7

Heading: hipaa's application to hrc's records

Text: [4] Kinyoun claims that HIPAA precludes the release of burial records because such records constitute protected health information. [6] HIPAA was enacted to safeguard medical information and to improve the efficiency and effectiveness of the health care system by facilitating the electronic exchange of information with respect to financial and administrative transactions carried out by health plans, health care clearinghouses, and health care providers. [7] Under 42 U.S.C. § 1320d(6), [t]he term individually identifiable health information means any information, including demographic information collected from an individual, that (A) is created or received by a health care provider, health plan, employer, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual, and (i) identifies the individual; or (ii) with respect to which there is a reasonable basis to believe that the information can be used to identify the individual. Kinyoun claims, and we agree, that HRC is an entity covered by HIPAA and that the burial records constitute the individually identifiable health information that HIPAA was designed to protect. [8] And, under 45 C.F.R. § 164.502(f) (2008), [a] covered entity must comply with the requirements of this subpart with respect to the protected health information of a deceased individual. Therefore, HIPAA and its attendant regulations do apply to deceased individuals. Under the Code of Federal Regulations governing HIPAA and the dissemination of private medical information, however, there is an exemption for information required to be released by law, and 45 C.F.R. § 164.512 (2008) defines [u]ses and disclosures for which an authorization or opportunity to agree or object is not required. Subpart (a)(1) of that section defines the standard for uses and disclosures and states that those disclosures may be made to the extent required by law, if in compliance with and limited to the relevant requirements of such law. Required by law is defined under 45 C.F.R. § 164.103 (2008) as a mandate contained in law that compels an entity to make a use or disclosure of protected health information and that is enforceable in a court of law. This provision includes statutes and regulations that require the production of the information, such as Nebraska's public records statutes. [9] [5] Nebraska, like the federal government and many other states, has broad public records laws that generally provide open access to governmental records. Under Neb.Rev.Stat. § 84-712(1) (Reissue 2008), citizens of the state have the right to examine and make copies of most public records. Public records include all records and documents, regardless of physical form, of or belonging to this state, any county, city, village, political subdivision, or tax-supported district in this state, or any agency, branch, department, board, bureau, commission, council, subunit, or committee of any of the foregoing. [10] As a state-supported institution, HRC is subject to the public records statutes. Under Neb.Rev.Stat. § 84-712.05(2) (Reissue 2008), however, [m]edical records, other than records of births and deaths, may generally be withheld from the public. (Emphasis supplied.) ACHS argues that the records sought in this case are records of deaths as defined by the statute. Kinyoun counters this argument by claiming that the records ACHS is requesting are part of the deceased patients' medical records. She contends that because all of those patients buried in the HRC cemetery had been patients at HRC when they died, releasing their names is equivalent to releasing medical records. For that reason, Kinyoun claims, the burial information is part of the medical record that HRC is required to keep, and HIPAA prohibits the release of the medical records because they constitute individually identifiable health information as a result. [11] We do not find Kinyoun's argument persuasive, however, and we find that the records sought are records of ... deaths. [12] First, the information sought by ACHS is more limited than the information available on a death certificate. Death certificates are available to the public. Neb.Rev.Stat. § 71-605(2) (Cum. Supp.2008) requires that death certificates include the Social Security number of the deceased, as well as the cause, disease, or sequence of causes ending in death; the death certificate entered into the record as an exhibit in this case shows the Place of Burial or Removal. Second, those patients admitted to HRC were admitted for a variety of reasons. The record reflects that patients were admitted to HRC for issues relating to substance abuse, senility and dementia relating to old age, various psychotic disorders, mental deficiencies, and other undiagnosed mental disorders. The fact that the deceased persons were treated at HRC does not indicate the nature of their diagnoses, or even the causes of deathinformation routinely released via death certificates. Furthermore, the records sought by ACHS do not include diagnosis or treatment information, but instead are limited to the names of the deceased and the locations of burial. ACHS cites two cases from other states in which courts have allowed the release of information in spite of HIPAA due to the application of state open records laws. [13] Kinyoun, in contrast, has not cited any cases which address the intersection of HIPAA with state or federal open records laws. Although the cases ACHS cited are not directly on point, the cases are instructive, because the information sought did not identify individuals. Both cases demonstrate that HIPAA can and does give way to state laws requiring disclosure of certain kinds of information. [14] Therefore, in this situation, HIPAA does not bar release of the information, and Kinyoun has not met her burden to establish a reason to withhold the burial records.