HIPAA and requests from attorney’s

HIPAA's rules regarding access to records apply to requests from patients or their "personal representatives." Just because an attorney is acting on a patient's behalf and is his or her legal representative does not mean that the attorney is a "personal representative" as defined by HIPAA's privacy rule. If an attorney is not a personal representative, HIPAA's 30-day deadline and restriction on fees charged for records do not apply, and the records do not need to be sent directly to the attorney.

At least one OCR regional office (Philadelphia) has confirmed this distinction. So if you receive a request from an attorney and you are unsure whether it falls under HIPAA's rules, I suggest you check with your OCR regional office.

About the Author

Reed Tinsley CPA

This article is written by Reed Tinsley, a Houston, TX-based CPA with over 30 years of experience advising physicians and medical practices across Texas and the United States. Reed holds certifications as a Certified Valuation Analyst (CVA), Certified Healthcare Business Consultant (CHBC), and Certified Financial Planner (CFP), specializing exclusively in the healthcare sector. He is a published author, nationally recognized speaker, and trusted advisor to physicians on accounting & tax, practice management, and financial planning. Schedule a Free Consultation.