• Texas Open-Records Law Prevails Over HIPAA
  • March 8, 2005
  • Law Firm: Frost Brown Todd LLC - Louisville Office
  • Federal medical-privacy rules that took effect during 2003 do not prevent Texas police officers and other state agencies from releasing patient information under the state's open-records law, Texas Attorney General Greg Abbott ruled on February 13, 2004. (Open Records Decision No. 681)

    The decision is possibly the first in the country to resolve the potential conflict between the federal Health Insurance Portability and Accountability Act of 1996, or HIPAA, and a state's open-records law.

    The federal law, which took effect in April 2003, forbids "covered entities" such as health care providers from releasing an individual's health information without that person's permission.

    In Texas, a governmental agency that is a "covered entity" must evaluate open-records requests for health information by applying the state's Public Information Act, not the more restrictive federal law, Abbott wrote.

    Abbott was responding to questions from state Sen. Robert Duncan, who asked whether the Lubbock Fire Department and city emergency medical workers could disclose medical information they either observed firsthand or received from a hospital.

    Duncan also asked whether the Lubbock Police Department could disclose to the public medical information it received from a hospital regarding accident victims, crime victims or criminal suspects.

    Abbott noted that HIPAA allows disclosure of protected health information if such disclosure is required by law. Because the Texas Public Information Act imposes a legal obligation on governmental bodies to release requested health information, state agencies must evaluate such requests under the state law and not HIPAA, Abbott wrote.

    However, medical information could still be withheld from disclosure if an exemption to the Public Information Act applied. Other provisions of state law that protect the privacy of health information could also prevent disclosure.

    Importantly, Abbott stated that a police officer is not a "covered entity" under HIPAA and is not forbidden by that law from disclosing health information the officer observed firsthand or obtained from a covered entity, such as a hospital.

    More significantly, the federal Office for Civil Rights has advised that the federal Freedom of Information Act prevails over HIPAA when federal agencies receive open-records requests for protected health information, Abbott wrote.

    Abbott's opinion applies only to requests made under the Texas Public Information Act. HIPAA would apply to all other requests for protected health information from government agencies that are covered entities.