HIPAA and requests from attorney’s

HIPAA's rules regarding access to records apply to requests from patients or their "personal representatives." Just because an attorney is acting on a patient's behalf and is his or her legal representative does not mean that the attorney is a "personal representative" as defined by HIPAA's privacy rule. If an attorney is not a personal representative, HIPAA's 30-day deadline and restriction on fees charged for records do not apply, and the records do not need to be sent directly to the attorney.

At least one OCR regional office (Philadelphia) has confirmed this distinction. So if you receive a request from an attorney and you are unsure whether it falls under HIPAA's rules, I suggest you check with your OCR regional office.

Have questions? I’m here to help.