Disclosure to a third party

Patient Access to Health Records

Healthcare providers have a duty to assist the patient when the patient wants to access their own information or request that it be disclosed.

Can a patient authorize disclosure to third party?

Common requests for patient records include patients authorizing their own information to be sent to a third party. The third party – insurance agent, employer, government agency, etc – sometimes acts on behalf of the patient to request the patient’s records from their healthcare provider. The third party will often use their own forms. When the healthcare provider receives the request, they may have questions about the request.

If the custodian / physician has any questions or concerns about the request, they can (and should) get clarification before releasing the information.  You could:

a)  request the third party to provide clarification or provide a revised consent authorized by the patient or

b)  refuse the request and state the grounds (reminder – you need to state the legal authority not to process the request) or

c)  healthcare provider contact the patient directly to discuss the request to release records.  This is my personal favourite option. This meets the obligation of duty to assist, provides clarity for both the patient and the custodian about what information is (and is not) included in the response to the 3^rd party.  You can have the patient book an appointment with the custodian to review the request and then update or provide a new consent to release.

Valid consent criteria

Valid consent criteria includes:

1. Identify the individual (patient)
2. Who has been authorized to disclose
3. To whom
4. Explicitly what information
5. For what purpose
6. Legal authority
7. Patient acknowledgment
8. Date, sign, valid until

‘Valid Until’

‘Valid Until’ is not a requirement under Health Information Act, however it is good practice.

The length of time ‘valid until’ is often discretionary to the custodian – often 30-90 days or whatever is reasonable to:

a) ensure that the patient authorizing the release can provide informed consent and

b) reasonable length of time to process the request (standard is 30 days turn-around to respond to a request)

A patient has the right to know how their health information is being collected, used, and disclosed. A patient has the right to access their own health information. A healthcare practice that demonstrates attention to detail, courtesy to the patient, and respect for confidentiality will also have good business practices and excellent customer service.

As a practice manager, clinic manager, healthcare provider or employee, it is your job to make sure that you know how to respond to access request, process the request, and provide good customer service. See our new series of articles, one article each week starting July 14, on the key steps in ‘Patient Access to Health Records.’

Additional resources:

Alberta Health and Wellness. HIA Guidelines and Practices Manual.

“Best of the Practice Management Nugget interviews’ will be posted next Thursday and will include the replay – and resources – for ‘Patient Access to their records’.  See informationmanagers.ca/pmn-events-live

Your comments and discussion are encouraged – join our new LinkedIn group, Practice Management Nuggets. When you are signed into LinkedIn, simply go to ‘interests’, ‘groups’, search for ‘Practice Management Nuggets’ and request to join.