States' specificity or limitation on patient consent for health information exchange

Background: With a few exceptions, federal regulations allow for the disclosure of protected health information (PHI) for treatment, payment, and other health care operations without consent. However, individual states have laws that go beyond federal regulations to mandate patient consent for disclosure of PHI.

Objective/Purpose: The objective of this study is to assess laws from 11 states about the limitation and/or specificity of consent for the exchange of PHI.

Methods: The study included 11 states, which completed a questionnaire about interstate requirements for PHI disclosures of adult persons in an emergency treatment situation. Using grounded theory approach, qualitative analysis was conducted to synthesize information to describe each state's laws about the limitation and/or specificity of consent to disclose PHI.

Results: Wide variations in consent requirements were observed across the states. Eight of the 11 states allow for the patient to specify PHI types that can be disclosed. In Maine, except for PHI from mental health facilities or mental health provider, licensing laws cannot specify or limit what types of PHI may be disclosed. However, this may be circumvented by the allowance of the patient to “limit the disclosure to certain purposes.” State laws in Indiana, New Hampshire, and Utah do not specifically address this issue.

Discussion/Conclusions: The differences in consent laws indicate a need to assess each state's requirements to assist in the disclosure of PHI across states, but also a need for more consistent requirements to simplify and facilitate inter-state PHI exchange during medical emergencies.