Comparison of protected health information laws among states

Background: The Privacy Rule of 1996 provides federal guidelines for privacy requirements related to the disclosure of protected health information (PHI). However, most states have passed more stringent legislation to provide greater privacy rights. Variations among state privacy laws create difficulties to disclose PHI across state lines.

Objective: Study objectives are to identify PHI disclosure and consent requirements in 11 participating states and describe state's laws about the duration of PHI consent.

Methods: Data were collected via semi-structured discussions or facilitated group sessions from 11 geographically diverse states. Project team members in each state were asked to respond to situations where limitations may occur on inter-state exchange of public health data. Responses were qualitatively analyzed to determine patterns of variations of PHI disclosure between and within the states.

Results: Five of the 11 states have no constraints or no mention of limits to the duration of consent. Maine, Oklahoma, and New Hampshire's limitations are time-specific. New York and Utah only allow for a one-time disclosure for records already in possession. In Vermont, consent can be on-going, but must provide a date indicating expiration. Wisconsin law does not specifically describe how long consent is effective, but allows for the patient to decide.

Conclusions: Variations in state consent and disclosure laws indicate a clear need for a guide to each state's requirements to facilitate the disclosure of PHI across state lines. Inter-state PHI exchange may be difficult due to these wide variations and therefore shows that a set of common guidelines to govern inter-state PHI exchange may be warranted.