Patient Records, Confidentiality, and HIPAA-Related State Requirements
Patient records, confidentiality, and HIPAA-related state requirements
This domain tests recordkeeping, patient access, confidentiality, and the interaction of HIPAA with Maryland law. The exam favors practical scenarios: who may receive records, what may be withheld, and how long records must be kept.
Core rules
Optometrists must create and maintain legible records sufficient to support diagnosis and treatment, including history, findings, test results, prescriptions, referrals, and informed consent. Maryland's medical-records and confidentiality statutes apply alongside HIPAA. Protected health information may be disclosed for treatment, payment, and health care operations, or with a valid authorization, and otherwise only as law requires or permits. Patients have a right to inspect and obtain copies, with fees limited by Maryland law. Minors and personal representatives raise special consent issues. Records must be retained for the period required by Maryland law and regulation, commonly at least five years from the last professional service, and longer for minors. A breach of unsecured information may trigger federal and Maryland notification duties.
Worked example
An attorney sends a letter demanding a patient's entire chart without an authorization, saying the patient 'won't mind.' Reasoning: a demand letter is not a valid authorization or court order. The optometrist should not release the record until receiving proper authorization, a subpoena with the required notice, or a court order, and should document the response.
Traps that cost marks
Do not assume HIPAA preempts stricter Maryland confidentiality rules; the more protective rule often controls. Do not release records to a spouse or adult child without authority. Do not alter a record after a request; amendments must follow the proper process. Do not ignore retention requirements when closing a practice.