Release of Records to a Spouse
A woman calls asking for copies of her husband's visit notes and lab results from the past year. She says she manages all his appointments and pays the bills, and she is listed on his insurance. She is polite and sounds familiar to the front desk, who recognizes her voice. The husband is 47 and has no documented incapacity. The practice uses an electronic record; the front desk can print or portal-release records. The office's release form requires the patient's signature. She asks you to email the records to her personal address today because she needs them for a specialist appointment tomorrow.
1. Can you release the records to her right now? Explain your reasoning.
Read the worked answer
Not based on these facts alone. Under HIPAA, being a spouse, being on the insurance, or paying the bills does not automatically make someone a personal representative with authority to receive the patient's PHI. A spouse is a personal representative only if the patient has authorized it or the patient lacks capacity and the spouse is acting in that role.
The safe path:
- Confirm whether the husband has signed an authorization naming her, or whether the record documents that she is his personal representative (e.g., health care proxy, guardianship).
- If not, obtain the patient's signed authorization - ideally a direct conversation with him or a signed release - before releasing anything.
- Do not release 'just this once' because she sounds familiar or is in a hurry. Familiarity is not authorization.
2. She is upset and says, 'I have a right to his records, I'm his wife.' How do you respond, and what about the email request?
Read the worked answer
Respond with empathy but hold the line: 'I understand this is frustrating, especially with an appointment tomorrow. I'm not able to release another adult's records without his written authorization or proof that you're his legal representative. I can help you get that in place quickly.'
On email specifically: email of PHI carries risk, and the practice should follow its policy - many practices use an encrypted portal rather than plain email. Even with authorization, offer the secure portal as the default and confirm the patient's preferred method. If email is used, follow the practice's encryption/consent policy.
Practical options to offer:
- Have the husband call or come in to authorize release, or sign the release form.
- If he can't, document the request and reason for denial.
- Offer to send records to the specialist directly once authorization is in hand - often faster and avoids the email issue.
Document the request, the reason it was not fulfilled, and what you told her.