FOI Advisory Council opinion AO-01-19
VIRGINIA FREEDOM OF INFORMATION ADVISORY COUNCIL
COMMONWEALTH OF VIRGINIA
AO-01-19
March 1, 2019
Dave Ress
Newport News, VA
The staff of the Freedom of Information Advisory Council is authorized to issue advisory opinions. The ensuing staff advisory opinion is based solely upon the information presented in your electronic mail message dated September 25, 2018.
Dear Mr. Ress:
You have asked for an advisory opinion regarding whether state hospitals must provide a patient with access to the patient's personal medical records under the Virginia Freedom of Information Act (FOIA). You provided in your email dated September 25, 2018, that you repeatedly asked VCU Medical Center for access to your medical records, but that you were told by your attending physician, nurses, and someone from the "Risk Management Department" that you could only access your records upon discharge, after filling out a particular hospital form, or after waiting for a period of 30 days.
Issue Presented
You have asked whether a hospital run by the state or other public body must provide a patient with access to his personal medical records.
Applicable Law and Discussion
As a preliminary matter, it must first be determined whether the hospital is a public body under FOIA as defined in § 2.2-3701 of the Code of Virginia.1
"Public body" means any legislative body, authority, board, bureau, commission, district or agency of the Commonwealth or of any political subdivision of the Commonwealth, including cities, towns and counties, municipal councils, governing bodies of counties, school boards and planning commissions; governing boards of public institutions of higher education; and other organizations, corporations or agencies in the Commonwealth supported wholly or principally by public funds.
Virginia Commonwealth University Health System Authority (Hospital) is a statutorily created authority.2 It is therefore considered a public body and is subject to FOIA unless an exception applies.
Generally speaking, as a public body, the Hospital is required to release certain public records in accordance with FOIA, except as otherwise specifically provided by law.3 In order to determine whether the Hospital is required to give you access to your personal medical records, we must first determine if an exception applies. Under § 2.2-3705.5, "health records, except that such records may be personally viewed by the individual who is the subject of such records, as provided in subsection F of § 32.1-127.1:03" are "excluded from mandatory disclosure provisions . . . but may be disclosed by the custodian in his discretion, except where such disclosure is prohibited by law." Subsection F of § 32.1-127.1:03 provides:
Except as provided in subsection B of § 8.01-413, copies of or electronic access to an individual's health records shall not be furnished to such individual or anyone authorized to act on the individual's behalf when the individual's treating physician or the individual's treating clinical psychologist has made a part of the individual's record a written statement that, in the exercise of his professional judgment, the furnishing to or review by the individual of such health records would be reasonably likely to endanger the life or physical safety of the individual or another person, or that such health record makes reference to a person other than a health care provider and the access requested would be reasonably likely to cause substantial harm to such referenced person.
Based on the information provided in your email, the exception provided for in subsection F of § 32.1-127.1:03 does not seem to apply here. Subsection B of § 8.01-413 provides in relevant part:
Copies of a health care provider's records or papers shall be furnished within 30 days of receipt of such request to the patient, his attorney, his executor or administrator, or an authorized insurer upon such patient's, attorney's, executor's, administrator's, or authorized insurer's written request, which request shall comply with the requirements of subsection E of § 32.1-127.1:03. If a health care provider is unable to provide such records or papers within 30 days of receipt of such request, such provider shall notify the requester of such records or papers in writing of the reason for the delay and shall have no more than 30 days after the date of such written notice to comply with such request.
Subsection E of § 32.1-127.1:03 provides:
Health care records required to be disclosed pursuant to this section shall be made available electronically only to the extent and in the manner authorized by the federal Health Information Technology for Economic and Clinical Health Act (P.L. 111-5) and implementing regulations and the Health Insurance Portability and Accountability Act (42 U.S.C. § 1320d et seq.) and implementing regulations. Notwithstanding any other provision to the contrary, a health care entity shall not be required to provide records in an electronic format requested if (i) the electronic format is not reasonably available without additional cost to the health care entity, (ii) the records would be subject to modification in the format requested, or (iii) the health care entity determines that the integrity of the records could be compromised in the electronic format requested. Requests for copies of or electronic access to health records shall (a) be in writing, dated and signed by the requester; (b) identify the nature of the information requested; and (c) include evidence of the authority of the requester to receive such copies or access such records, and identification of the person to whom the information is to be disclosed; and (d) specify whether the requester would like the records in electronic format, if available, or in paper format. The health care entity shall accept a photocopy, facsimile, or other copy of the original signed by the requester as if it were an original. Within 30 days of receipt of a request for copies of or electronic access to health records, the health care entity shall do one of the following: (1) furnish such copies of or allow electronic access to the requested health records to any requester authorized to receive them in electronic format if so requested; (2) inform the requester if the information does not exist or cannot be found; (3) if the health care entity does not maintain a record of the information, so inform the requester and provide the name and address, if known, of the health care entity who maintains the record; or (4) deny the request (A) under subsection F, (B) on the grounds that the requester has not established his authority to receive such health records or proof of his identity, or (C) as otherwise provided by law. Procedures set forth in this section shall apply only to requests for health records not specifically governed by other provisions of state law.
Per your email, the Hospital informed you that you could only get your records upon discharge, upon filling out a particular hospital form, or after a wait of 30 days. Both subsection B of § 8.01-413 and subsection E of § 32.1-127.1:03 provide that you are entitled to your medical records and the Hospital is required to provide access to those records within 30 days of receipt of your request. As those provisions are more specific than the provisions of FOIA, the 30-day time limit applies instead of the five-day time limit that typically applies under FOIA.4 If the Hospital is unable to comply with the 30-day deadline, they are to notify you in writing of the reason for the delay and they shall have no more than 30 days after the date of such written notice to comply with the request.
Subsection E of § 32.1-127.1:03 requires a request for medical records to be in writing, signed, and dated by the requester; the request must identify the nature of the information requested (i.e., comprehensive medical records); the request must also include evidence of the requester's authority to receive the records as well as the identification of the person to whom the information is to be disclosed; and lastly, the request must specify whether the records should be produced in electronic format, if available, or in paper format. A photocopy or facsimile of the original signed request shall be treated as an original. As stated above, upon receipt of a properly signed request, the Hospital has 30 days to produce the requested records. If the records cannot be produced in that time frame, the Hospital must either (1) inform the requester that the information requested does not exist or cannot be found; (2) inform the requester if the Hospital does not maintain a record of the information that has been requested and provide the name and contact information, if known, of the entity who maintains those records; or (3) deny the request pursuant to subsection E of § 32.1-127.1:03 or other applicable law.
There is nothing in the law that requires a patient to be discharged before requesting and gaining access to his personal medical records; however, you must make a written request for your records. The Hospital is allowed to charge a reasonable fee not to exceed the actual cost for the requested records.5 Given the fact that the Hospital has created a written form, it is likely that filling out that form will provide them with all of the statutorily required information necessary for them to produce the requested records; however, subsection G of § 32.1-127.1:03 provides a sample written authorization form that contains all of the statutorily required information. This form may be used instead as there is no requirement for a requester to use a specific form furnished by a healthcare entity, so long as the written request contains all of the required information.
Conclusion
Because Virginia Commonwealth University Health System Authority falls within the definition of a "public body," it is subject to the rules under the Virginia Freedom of Information Act.6 Although there are exceptions under FOIA that would preclude access to health records, based on the provided facts, none of those exceptions apply here. It is important to note that your right to access your personal medical records is governed by laws outside of FOIA, as well as by FOIA, because §§ 2.2-3705.5, 8.01-413, and 32.1-127.1:03 set out specific provisions regarding health records. Where the more specific provisions conflict with the default rules of FOIA, the more specific provisions control.
As a requester, in order to obtain a copy of your medical records, your request must be in writing, signed, and dated, it must identify the nature of the information requested, must include evidence of your authority to receive such records and provide your identification as the person to whom the records shall be disclosed, and the request must specify whether the records are to be produced electronically or in paper format. After submitting a proper request, by law the Hospital has 30 days to comply with your request and produce the requested records unless, per subsection E of § 32.1-127.1:03, an exception applies.
Thank you for contacting this office. We hope that this opinion is of assistance.
Sincerely,
Ashley Binns
Attorney
Alan Gernhardt
Executive Director
1. All section numbers provided are from the Code of Virginia.
2. § 23.1-2401.
3. § 2.2-3704(A).
4. § 2.2-3704(B).
5. § 2.2-3704(F).
6. See § 2.2-3701.
