Patient Confidentiality, HIPAA Interactions, and Release of Records
Confidentiality questions test the interaction between Kansas professional duties and HIPAA. The safest answer protects patient information unless a valid authorization or legal exception applies.
Core rules
- Chiropractic records are confidential. Release generally requires a valid patient authorization that identifies the information, recipient, purpose, and expiration, or a legal exception such as required reporting, Board investigation, or valid subpoena/court order.
- HIPAA applies to covered entities and sets a federal floor for privacy, access, minimum necessary use, and security. Kansas law or Board rules may impose additional or stricter requirements; follow the more protective rule when they differ.
- Patients have rights to inspect and obtain copies of their records and to request amendment, subject to limited exceptions. Do not deny access merely because the patient has an unpaid bill unless applicable law permits.
- Use minimum necessary disclosures, secure transmission, and role-based access. Discuss only what is needed with family members or others when the patient has authorized it or when an exception applies.
Worked example
An attorney sends a signed authorization from the patient requesting records for a specified date range. The DC verifies the authorization's scope, confirms the patient's identity, and releases only the requested records by a secure method. When opposing counsel later requests the full chart without authorization or subpoena, the DC declines and asks for valid legal process. The patient's signed authorization does not become a blanket release to everyone.
Traps
HIPAA does not block every Board subpoena or mandatory report. Do not release records to a spouse or employer on a phone request. Do not ignore a patient's access request. Do not send more information than the authorization or legal process requires.