Taking Patient Files to a New Practice: Does HIPAA Prohibit It?

Practices often cite HIPAA to prevent outgoing providers from walking out of the door with patient records. Is it a valid objection?

It’s a common scenario: a healthcare provider leaves a practice to start their own or join another. It’s also typical for the provider and their patients to wish to continue their course of treatment at the practice. When this happens, the left-behind practice often tries to protect their own interests by alleging that by taking patient files, the outgoing practitioner is violating the Health Insurance Portability and Accountability Act (HIPAA). 

HIPAA and Patient Records

This question reflects a legal gray area, as HIPAA does not speak directly to this situation. Navigating this issue can be critical to ensuring continuity of care for patients when their treating provider leaves their practice.

Does HIPAA Apply to the Practice?

First, HIPAA only applies to “covered entities” and “business associates.” To be a covered entity under the HIPAA, a provider must maintain and transmit electronic protected health information (“ePHI”) for the purpose of billing patients’ insurance. If a practice or professional is not a covered entity, then HIPAA would not prohibit a departing owner from taking patient files with them.

It’s important to note that HIPAA isn’t the only relevant law to consider. Individual states also impose medical privacy requirements that may further restrict providers’ behavior around their handling of medical records.

Does the Patient Want the Files Moved to the New Practice?

Second, as a practical matter, HIPAA does not prohibit a departing provider from taking patient files where there is a valid patient authorization to do so. HIPAA also describes circumstances when PHI can be used and disclosed by without express patient authorization (an exception that is particularly relevant during a public health emergency, when a patient’s information may need to be sent to treating providers before the patient’s consent can be obtained).

If a patient wants to continue care at their treating provider’s new practice, HIPAA is clear that the patient’s valid authorization is all that is required for the practitioner to bring those records with them. Indeed, a valid patient authorization is sufficient overcome many of HIPAA’s ambiguities and ensure continuity of care. Keep in mind, however, that the originating practice may need to retain copies of records in case of future governmental or private insurer audits or investigations.

The Real Impediment to Taking Patient Files: Contracts

Taking patient files is more likely to violate an employment agreement between a departing professional and the practice than it is to implicate HIPAA. Outgoing physicians, mental health professionals, physical therapists, and other providers often need to tread a thin line—complying with their contract while also meeting their ethical and legal obligations to patients. These obligations sometimes conflict, and practitioners are left to navigate competing interests and requests. When such a situation arises, it’s usually a good time to consult an attorney who is familiar with HIPAA and its regulations.

Conclusion

Usually, the patient’s request that a provider continue to treat them, accompanied by a valid HIPAA authorization, is enough to justify a provider taking that patient’s medical records with them to a new practice. That doesn’t mean that it won’t create upset (and maybe even lead to a lawsuit) between the practitioner and their previous employer. There is a lot of confusion around “ownership” of medical records and whether they’re the practice’s property.

Each specific situation has its nuances. Before taking files, it’s wise to consult an experienced healthcare attorney who can examine the departure through the lens of applicable laws and contract terms. If you’re in a state where Jackson LLP practices, reach out to us by booking a free consultation. 

This blog is made for educational purposes and is not intended to be specific legal advice to any particular person. It does not create an attorney-client relationship between our firm and the reader and should not be used as a substitute for competent legal advice from a licensed attorney in your jurisdiction.