Navigating laws protecting patient medical records is a time-consuming task, even for the experienced, privacy-savvy litigators. Laws vary from state to state, and the laws themselves, being relatively new, are challenging to interpret even for dedicated health privacy experts.
Records Drive Pretrial Discovery Efforts
This state of affairs creates a not-insignificant operational headache for litigators. Medical records are every bit as important as depositions during the pretrial discovery phase of any lawsuit where one party has suffered a personal injury or suffers from a health-related condition. These documents provide objective evidence of the victim’s injuries, they corroborate (or impeach) witness testimony, they identify possible witnesses to be deposed or subpoenaed for trial, and they supply the building blocks for timelines describing all relevant dates in the case.
Delegating records acquisition to an experienced vendor transforms a complex, high-stakes process into one that is secure, efficient, and cost-effective.
Expert witnesses in injury cases rely extensively on medical records. Discovery of medical records may provide the basis for new causes of action, or defenses, not asserted in the initial pleadings. And in some cases, medical records can provide evidence so compelling they spur early settlement of the litigation.
However, relevant medical records are not always easy to obtain. They are often possessed not by a single entity but by multiple entities, all of which must be provided a legally compliant medical records request according to the laws of their jurisdiction. And in every instance, medical records are protected by the Health Insurance Portability and Accountability Act (HIPAA), a federal law that creates federal privacy standards and a compliance framework for personal health information.
State laws further complicate matters by supplementing HIPAA protections. State laws often dictate time limits for responding to records requests, provide detailed fee schedules and state-specific request forms. In some cases, state laws create additional substantive protections for requests seeking highly sensitive information about mental health, HIV, or substance abuse.
In any given case, relevant medical records might be held by any or all of the following entities:
- hospitals
- primary care physicians
- medical specialists such as orthopedists, neurologists, or psychiatrists
- urgent care centers
- physical therapy providers
- imaging centers (x-rays, magnetic resonance imaging, computed tomography (CT) scans)
- mental health providers
- ambulance and emergency medical services
- nursing homes and rehabilitation facilities
- occupational therapists and pain management clinics
Submitting legally compliant medical records requests and managing the ensuing influx of case-critical documents, are time-consuming tasks for both litigators and their support teams.
No State Law Is Quite the Same
Further complicating the medical records request process is the extent to which state laws modify the baseline privacy protections provided by HIPAA. State laws are not uniform as far as which records need to be provided, how long providers have to respond, how much may be charged, which request forms must be filed, and whether records may be produced in either electronic or print formats. In the context of class action and mass tort litigation that span multiple jurisdictions across the United States, the task of requesting and monitoring the medical records acquisition process is a significant operational challenge for all but the largest law firms and insurers.
For example, in the area of response times alone, many states have deviated from HIPAA’s baseline 30-day response deadline:
- Response within 15 days of request.
- New York. Response within 10 days of request.
- Texas. Response within 15 days of request.
- Michigan. Response within 10 business days of request.
- Illinois. Response within 7 business days of request.
- Florida. Response within 30 days of request.
- Minnesota. Response within 10 days of request.
- New Jersey. Response within 7 business days of request.
- Colorado. Response within 10 days of request.
- Washington. Response within 10 business days of request.
The differences among state medical records laws aren’t limited to response deadlines. Each state may have its own definitions of protected health information, as well as state-specific rules regarding fees, patient consent forms, and record delivery formats. For this reason, the amount of administrative overhead involved in medical records requests can be daunting. In fact, all records requests involve considerable time and effort when done well.
The Case for an External Solution
Hiring additional law firm staff is one way to manage the workload involved in records requests. Another approach favored by many law firms is to delegate the records acquisition process to an outside vendor with expertise in records acquisition and document management. The vendor should be reliable and able to demonstrate an ability to deliver a wide range of records that are:
- complete, accurate, and properly authenticated,
- retrieved within required deadlines,
- transmitted and stored under robust data security measures, and
- easy to access by law firm personnel via a unified online portal.
Importantly, long-established vendors in the records retrieval space will most likely have the largest database of records sources to draw on, as well as a demonstrated track record of on-time delivery of requested records. By insisting on these qualities in a vendor, law firms will have the best chance of obtaining efficiencies (and possibly cost savings) in the records retrieval process.
