Can doctor&#39;s offices withhold test results for some length of time? Massachusetts/USA here. I had a EMG a few days ago and scheduled a followup with my doctor for later in the month (about 3 weeks from now). I am very anxious to hear the results. I just called and the nurse/assistant was able to confirm that the results are ready, but she said that she isn't allowed to read them to me, and that I will have to wait until my scheduled appointment (again, 3 weeks from now) with the doctor. I call bologna! Can they do this? I would think some provision in HIPAA or otherwise would entitle me to immediate readings of the results. What are my options here?
According to an HHS guide entitled "Individuals’ Right under HIPAA to Access their Health Information", HIPAA does entitle you to access your medical records; however, the medical provider has 30 days to respond to your request. See the section on "Timeliness". So if the doctor wants to withhold the information until your appointment in 3 weeks, it looks to me like they are legally entitled to do so. Massachussets law has some similar provisions which are linked from the state court system's page on medical privacy. But as far as I could tell, they also only set a 30 day window, and it only applies to requests that are related to a claim for Social Security or a similar program. It doesn't appear that the law is on your side here. You might have more luck just trying to reschedule your appointment for an earlier date, or letting them know that you would take an appointment on short notice in case they have a cancellation.
There is no state that requires you to show ID to obtain medical care. To the extent that this is done it is done at the behest of whoever is paying for the care to determine that you are someone who is authorized to benefit from this payment, and not an imposter, or as a matter of policy of the doctor. (An exception to this general rule applies when one wants to pick up a prescription for a controlled substance or a Sudafed product, where you must indeed show ID to show that your name matches a prescription or to insure that the right name is entered into the Sudafed database.) It might be more convenient for the doctor in terms of collection of bad debt, insurance policy claims (where an insurance card would normally be required, at least), protection against fraud claims from an insurer, and medical record keeping to have a name, so a doctor might make it a policy to require ID, but it is not required by law (except where a government benefit provider like Medicaid or Medicare is involved and has a regulation requiring it). For example, in the Las Vegas shooting, where there wasn't time to process paperwork, hospital triage officials simply assigned an alias to every incoming patient and wrote it in marker on their body to keep the medical records straight, and to allow that alias to track medical costs to be billed when the time came to get the proper intake paperwork filled out and the file sent to the accounting department. There are also other circumstances that do not involve emergency treatment (e.g. STD testing, methadone treatment at free clinics, and clinical trials) where an alias rather than a true name is sometimes used to keep track of patients.
You generally are not required to share your medical details with people you don't want to. That said, the camp would also not be required to allow people who don't comply to enroll. They can't force you to divulge your information, but you can't force them to let you come if you don't, either. HIPAA deals with the ability of healthcare providers to disclose medical information to parties who aren't the patient themselves - it would be a HIPAA violation for your doctor to disclose your information directly to the camp without your consent. HIPAA has absolutely no bearing on who you choose to disclose your own information to, however - you can disclose your own information to anyone you want.
For the same reason that states require doctors to be licensed Surely, if I want an unqualified, unlicensed surgeon (or a person that says they’re a surgeon) to crack open my cranium and poke my brain, that’s up to me? There is no doubt that requiring people to attend medical school for half a decade and then spending a similar period as an intern and a resident is a large barrier to entry compared to handing high school graduates a scalpel and a bone saw and telling them to learn on the job. The same applies to engineers, lawyers, plumbers, electricians, builders etc. I mean if a building falls down because the engineer or builder didn’t know what they were doing, it can’t kill that many people, can it? Even drivers for that matter - it’s a large cost to individuals and businesses to learn to drive, pass a test, maintain a license and a relatively clean record, register a car, keep it roadworthy etc. Surely it would be simpler to let anyone drive anything and if they cause someone harm, like dying, for that individual to seek redress through the courts? We’ll, there’s a reason why states mandate things and it’s economic rather than legal. When people don’t trust each other transaction costs go up. These costs are usually borne by the consumer as the suppliers engage in a “race to the bottom” - whoever provides the worst service at the lowest cost wins. Further, these costs are borne unevenly - most consumers are fine, some are very severely damaged; possibly with no real redress. By imposing minimum standards, the state places these costs in the hands of the people who are best positioned to manage them - the supplier. Once a user has given their data to the supplier they have no control over it. Therefore the economical optimal solution to maximize economy-wide output is to make the supplier legally responsible for managing the data in accordance with minimum standards. Extraterritoriality In an ideal world, there would be universal privacy standards. There would also be universal standards for training doctors and engineers. But there aren’t. Therefore, countries and states impose their own standards on organizations that operate within their jurisdiction. The threshold for the GDPR (and most other privacy laws) is whether you are targeting users within their jurisdiction. If so, they have the power under international law to assert sovereignty even if you are located elsewhere. A state has power where it says it has power. Otherwise, you could plan a terrorist attack on the USA from the UK and not have to fear prosecution. That’s what extradition treaties and honoring other nation’s civil judgements is all about. A website or similar platform operates in each and every jurisdiction it is accessible from. Like a surgeon with unlimited plane tickets. Therefore, it must comply with the law in each and every jurisdiction it’s operating in. Countries have adopted one of 2 solutions - China’s is to simply block all external sites, everyone else has said you can operate here but you have to follow our rules, just like every other business has to. Now, you may not like this but there is no doubt they have the legal power to do it.
Yes. Making statements in a legally protected confidential context is not publishing them, and in most jurisdictions, defamation must be published to create a cause of action. In such a case the patient might well have a cause of action against the therapist for violation of patient confidentially, and a complaint to the relevant authority could get the therapist's license revoked, or perhaps a censure from the licensing authority, whatever it is the the jurisdiction. Note &quot;published&quot; does not have to mean putting them in print, but does mean making them in such a way that general circulation of them is plausible. In addition, such statements may be coered by a qualified privilege. In Marchesi v. Franchino, 283 Md. 131, 135, 387 A.2d 1129 (1978) the Maryland Supreme Court (reviewing a case from the Court of Special Appeals) held (at 135-136) that: ... the common law recognized that a person ought to be shielded against civil liability for defamation where, in good faith, he publishes a statement in furtherance of his own legitimate interests, or those shared in common with the recipient or third parties, ... The Maryland court went on to quote the Restatement (Second) of Torts, (Scope Note preceding § 593 (1977)) which states that if a privilege were not granted: information that should be given or received would not be communicated because of [the] fear of . . . persons capable of giving it that they would be held liable in an action of defamation if their statements were untrue. It would seem that a statement by a person to his or her own therapist, as a part of therapy, and intended to be held in confidence by the therapist, ought to fall under this definition of privilege, although I cannot find any actual case with this exact fact pattern. If the person knew or had reason to know that the therapist was likely to repeat the statement, that would be different. If the person and the therapist were not in a practitioner/patient relationship, with its normal expectations of confidentiality, that also would be different.
HIPAA does not legally protect physicians from disclosing PHI to another party, although there are a few exceptions: HHS provides an excellent resource on these, but the regulation most relevant to your question is Permitted Uses and Disclosures (5) Public Interest and Benefit Activities, which includes "Required by Law. Covered entities may use and disclose protected health information without individual authorization as required by law (including by statute, regulation, or court orders)." These statues, regulations, and court orders vary from state, but almost all of them refer to STDs and not genetic conditions (in some states, physicians are required to disclose positive STD test results to known sexual partners, but I can't find similar legislation for genetic tests). Here's an example of a voluntary patient information disclosure form – you'll notice that an individual has to specify the parties to whom they're willing to have PHI disclosed. The example you provided is still a violation of the Privacy Rule in the U.S., but this is a very curious grey area in bioethics and law. Disclosure of Genetic Information Within Families: How nurses can facilitate family communication. Gallo et al. Am J Nurs. 2009 Apr; 109(4): 65–69. (Emphasis mine.) HIPAA and Genetic Disclosure Does the law affect families? The privacy rule of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) went into effect on April 14, 2003. The rule created new requirements for health care providers, third-party payers, and health care clearinghouses to protect the privacy and security of health information, including genetic information, that could identify a person. A person's decision not to disclose her or his risk of developing a genetic condition to a family member may pose a dilemma for the health care professional, who has to choose between ethical obligations to inform the at-risk party and legal requirements to respect and protect the patient's privacy. The potential for harm to family members often plays a large role in the decision. For example, in rare cases, the use of a certain surgical anesthesia can cause death in people with the mutation that disposes them to malignant hyperthermia. Likewise, strenuous exercise can bring on sudden death in people with hypertrophic cardiomyopathy. In such cases, clinicians should carefully explain the reasons for sharing information with family members, strongly encourage patients to notify at-risk relatives, and offer to help develop a plan for notifying them. When patients choose not to notify family members, clinicians typically respect the decision. There are situations, however, in which the clinician may consider overriding the patient's preferences because the family member is judged to be in danger of serious or immediate harm or there is a high likelihood that a dangerous condition will occur that can be either prevented or adequately treated with early recognition. Clinicians who believe it is necessary to override a patient's wish regarding the notification of family members, should consider consulting an ethics committee or legal council. In most situations, though, the risk of serious harm associated with nondisclosure is not clearly immediate. For instance, if a woman has tested positive for the BRCA1 or BRCA2 mutation but doesn't want to upset her two sisters by sharing that information with them, the need for disclosure isn't clearly urgent. Each sister has a one in two chance of carrying the same mutation. It would be understandable for the patient to try to learn more about what the mutation means for her and her children and to give careful thought to whether and how she'll share her test results with her sisters. Clinicians can best help family members by clearly informing patients who test positive for genetic conditions or the mutations that cause them about the risks faced by their family members, discussing the value of disclosure and offering assistance with it. The "Duty to Warn" a Patient's Family Members About Hereditary Disease Risks. Offit et al. JAMA. 2004;292(12): 1469–1473. (I can send you the full-text of this if you want it; it contains an excellent overview of cases and their outcomes relating to disclosing genetic information in the U.S. under HIPAA.) In general, the special nature of genetic tests has been viewed as a barrier to physicians' breaching the confidentiality of personal genetic information. However, the failure to warn family members about hereditary disease risks has already resulted in 3 lawsuits against physicians in the United States. While the findings of case law and the state and federal statutes that bear on the issue of "duty to warn" of inherited health risk are still being defined, we believe that health care professionals have a responsibility to encourage but not to coerce the sharing of genetic information in families, while respecting the boundaries imposed by the law and by the ethical practice of medicine. ...in considering whether to breach patient confidentiality to warn of risks of a genetic disease, clinicians need to balance the actual risk of that disease, the efficacy of potential preventive interventions, as well as emerging legal considerations and potential liabilities. Overriding patient confidentiality and genetic privacy might very well mean violation of HIPAA and certain state regulations, with attendant civil or criminal liability. At the same time, in one state appellate court decision that has not been overturned, the estate of a physician was held liable for his failure to warn relatives of hereditary disease risk.
I think this shows a misunderstanding of the meaning of the GDPR. A data subject has the right to demand information, correction, deletion etc. about some of their data held by some institutions, depending on the legal basis for the data processing. One John Smith does not have the right to see the data of any other data subject named John Smith, and he cannot even demand to know if there are other John Smiths in the database. The data controller has to make reasonable steps to ensure that an individual who seeks account information is in fact the individual who is the data subject. In the case of an email, that's usually easy -- if John Smith can access the mail account jsmith@sample.org, one can assume that he is the John Smith who opened the account. If not, then not. If the data controller has the birthplace and birthdate in their records, they can possibly match that against some government-issue identity document, too, but why would they have that data?
1) Bob could disclose the PTSD condition and seek accommodation for it (in reality, controlled narcotics aren't actually used to treat PTSD but it isn't hard to imagine a situation where another controlled substance, e.g. ketamine, was used to treat this or some other Americans with Disabilities Act recognized disability and the absence of that disability was not a bona fide qualification of the job). The legal analysis in the case of the FBI (a federal government civilian civil service employer subject to special rules applicable to governmental employers), and a private employer, is not exactly the same, but it ends up in the same place. 2) Medical marijuana is, as a matter of federal law an oxymoron, because it is a Class I controlled substance that as a matter of law (contrary to reasonable facts) has no medical applications, and the FBI is charged with enforcing this law (among other agencies), so medical marijuana would legally disqualify someone from FBI employment. In Colorado which has legal under state law medical marijuana, employers have been allowed to discriminate based upon medical marijuana use because an employer is at a minimum allowed to treat federal law as enforceable. It is conceivable that some U.S. state other than Colorado which allows medical marijuana at the state level might reach a different conclusion as a matter of state law on the employment discrimination point, but potentially, the employer could appeal to the U.S. Supreme Court on a pre-emption argument so it would be a tenuous legal position to take.