OHIO LAW AS IT RELATES TO HIPAA PRIVACY

OHIO LAW AS IT RELATES TO HIPAA PRIVACY

The following provides you with information related to who is entitled, under Ohio law, to
authorize the release medical information and to exercise HIPAA patient rights, such as
requests for access, amendments, accounting, restrictions, confidential communications and the
provision of a Notice of Privacy Practices. It also discusses special disclosure limitations and
required disclosures under Ohio law. As the laws change frequently, it is important to check
the current status of the listed statute or regulation before relying on it.

WHO CAN SIGN AUTHORIZATION FORMS AND EXERCISE PATIENT RIGHTS UNDER
OHIO LAW

Adults

General Rule. The following are entitled to exercise patient rights under HIPAA and to sign
authorizations for uses and disclosures of protected health information.

• An adult patient who has received health care treatment. O.R.C. § 3701.74.

• The patient's guardian if the patient is incompetent. O.R.C. § 1337.11.

• The patient's attorney in fact pursuant to a durable power of attorney for health
care if the patient is incompetent. O.R.C. § 1337.13.

• An authorized person (a person to whom a patient has given written authorization
to act on the patient's behalf). O.R.C. § 3701.74.

Wright State Physicians Ohio Law as it Relates to HIPAA Privacy H2053 1
Implementation Date: 9/23/2013
Revision Date:

OHIO LAW AS IT RELATES TO HIPAA PRIVACY

Deceased Patient. If a patient is deceased, the patient's personal representative (the executor
or administrator of the patient's estate, or the person responsible for the patient's estate if it is
not to be probated) can exercise patient rights on behalf of the decedent under HIPAA. O.R.C. §
3701.74.

Minors

General Rule. Minors may not consent to medical treatment or to the use or disclosure of their
protected health information in most situation. Likewise, they cannot exercise patient rights
under HIPAA.

• A “Minor” is a person under 18 years of age or under 21 if mentally or physically
disabled. O.R.C. § 3109.01

Parents or Legal Guardians. May authorize uses/disclosures of child’s protected health
information and may exercise patient rights on behalf of the minor under HIPAA.

Divorced Parents. Both have equal right to authorize uses and disclosures of child’s protected
health information and to exercise patient rights on behalf of the minor under HIPAA. No
preference is given to the custodial parent. O.R.C. § 3109.051(H)

Emancipated Minor. Determined on case-by-case basis because it is difficult to determine who
fits this category. There is no Emancipated Minor statute in Ohio. Situations in which minors are
generally deemed emancipated, and thus able to authorize uses and disclosures and to
exercise their patient rights under HIPAA, include:

• Otherwise gained independence from his/her parents
• Marriage
• Enlistment in armed forces
• Placement in an adult penal institution O.R.C. 2151.23
• Married minor who subsequently is divorced

Wright State Physicians Ohio Law as it Relates to HIPAA Privacy H2053 2
Implementation Date: 9/23/2013
Revision Date:

OHIO LAW AS IT RELATES TO HIPAA PRIVACY

Unemancipated Minors who may consent to certain treatment may also authorize uses and
disclosures of their protected health information related to such treatment. They would not be
entitled to exercise the HIPAA patient rights.

• HIV testing (O.R.C. § 3701.242)
• Diagnosis and treatment for venereal diseases (O.R.C. § 3709.241)
• Diagnosis and treatment for conditions caused by drugs or alcohol (O.R.C. §

3719.012)
• Examination for purposes of gathering evidence, when the minor has been a

victim of sexual offense (O.R.C. § 2907.29)
• Blood donation if the minor is 17 or older and the donation is made as part of a

non-profit program (O.R.C. § 2108.21)
• Certain outpatient mental health services, if 14 years old or more (O.R.C. §

5122.04)
• Abortion, under limited circumstances (O.R.C. § 2919.12)

SPECIAL DISCLOSURE LIMITATIONS AND REQUIREMENTS UNDER OHIO LAW

Disclosure of HIV/AIDS-Related Information

General Rule. Health care workers and state agencies are prohibited from disclosing the
following information to outside persons or entities without appropriate authorization and this law
will take precedence over HIPAA which may allow such disclosures:

• The identity of an individual tested for HIV
• The results of an HIV test (unless test results are anonymous)
• The identity of any individual diagnosed with AIDS or an AIDS-related condition

O.R.C. § 3701.243(A)

Wright State Physicians Ohio Law as it Relates to HIPAA Privacy H2053 3
Implementation Date: 9/23/2013
Revision Date:

OHIO LAW AS IT RELATES TO HIPAA PRIVACY

Permitted Disclosures. Disclosure of a patient’s HIV test results is permitted in certain
circumstances. Note that Ohio law allows certain permitted disclosures which are not listed here
because these disclosures would be preempted by HIPAA. The following are consistent with
both Ohio law and HIPAA:

• To the patient or the patient’s legal guardian

• To the patient’s physician for treatment

• To any person authorized by the patient in writing

• To the Department of Health when reporting a communicable disease as
required by law

• To transplant facilities when the deceased individual was a donor

• To accreditation or oversight review committees who conduct program
monitoring, evaluation, or service reviews

• To a health care provider, emergency medical services worker, or peace officer
who has sustained significant exposure to bodily fluids for purposes of testing the
recipient of the information. Only the fact that the test was given, the results, and
any diagnosis of AIDS or AIDS-related conditions may be disclosed but not
patient identifying information. (May be preempted by HIPAA; check with legal
counsel before making a disclosure pursuant to this section)

• To law enforcement agencies pursuant to a search warrant or subpoena in a
criminal investigation

• To individuals involved in diagnosis or treatment and such information is needed
to treat the patient if there is a “medical need to know”

• To appropriate government agencies for the purpose of federal, state, or local
public assistance programs such as Medicare or Medicaid

• To emergency care workers who have been exposed to bodily fluids (may be

preempted by HIPAA but HIPAA does allow certain disclosures when there is an

threat to health or safety; before making any disclosures under this section,

check with legal counsel)

Wright State Physicians Ohio Law as it Relates to HIPAA Privacy H2053 4
Implementation Date: 9/23/2013
Revision Date:

OHIO LAW AS IT RELATES TO HIPAA PRIVACY

• Pursuant to a court order in some circumstances

O.R.C. § 3701.243(B)

Disclosure of Mental Health Treatment-Related Information

General Rule. All records and reports of mental health treatment (provided at a mental health
hospital or inpatient unit of a hospital designated as a mental health unit) shall be kept
confidential and this law will take precedence over HIPAA which may allow such disclosures.
O.R.C. § 5122.31

Permitted Disclosures. Mental health information maintained by a mental health hospital or
inpatient unit of a hospital designated as a mental health unit may be disclosed to the following
outside persons or entities:

• To the patient, unless access is restricted for treatment reasons
• Based on authorization of the patient (or patient’s guardian or parent)(if it is in the

patient’s best interest)
• To insurers to obtain payment for goods and services provided to the patient,

provided that the entity disclosing the information attempts to obtain patient
authorization
• Pursuant to a court order
• To a family member who is involved in the provision and planning of a patient’s
treatment (if it is in the patient’s best interest and the patient is notified and does
not object)
• To a prosecuting attorney if treatment is based on criminal commitment, or to a
board of mental health services if treatment is based on voluntary commitment
• To the Ohio Department of Mental Health for quality review (however, the
patient’s name should be excluded)

Wright State Physicians Ohio Law as it Relates to HIPAA Privacy H2053 5
Implementation Date: 9/23/2013
Revision Date:

OHIO LAW AS IT RELATES TO HIPAA PRIVACY

• To other treatment providers if the purpose of the exchange is to facilitate
continuity of care, provided that the entity disclosing the information attempts to
obtain patient authorization

• To hospitals and other entities licensed by or that have a current agreement with
the Ohio Department of Mental Health for other purposes, provided that only the
following information is released: medication history, physical health status and
history, financial status, summary of course of treatment in the hospital, summary
of treatment needs, and a discharge summary, and provided that the entity
disclosing the information attempts to obtain patient authorization

• To the executor or administrator of the estate of a decease patient when the
information is necessary to administer the estate.

O.R.C. § 5122.31(A).

Disclosure of Drug and Alcohol Related Information

General Rule. Designated alcohol and/or drug treatment programs must keep all patient
records and other information pertaining to treatment of alcohol or drug abuse confidential and
these laws will take precedence over HIPAA which may allow such disclosures. 42. C.F.R. Part
2; O.R.C. § 3793.13(A).

Permitted Disclosures Under Federal and Ohio Law. Substance abuse records can be
disclosed to third parties if the patient consents (it is recommended that a HIPAA compliant
authorization form be used for these consents) in writing and the consent specifically identifies
the person or entity to whom the information is to be provided and describes with reasonable
specificity the record or information to be disclosed, the purposes of the disclosure, and the
intended use of the disclosed information

42 C.F.R. Part 2; O.R.C. § 3793.13(B).

Wright State Physicians Ohio Law as it Relates to HIPAA Privacy H2053 6
Implementation Date: 9/23/2013
Revision Date:

OHIO LAW AS IT RELATES TO HIPAA PRIVACY

Other Permitted Disclosures

• Patient participates in a drug/alcohol treatment program as a condition of parole,
probation, or court order permitting treatment instead of conviction O.R.C. §
3793.13(C).

• Where research, management, financial audits, or program evaluation will be
conducted on a patient-anonymous basis O.R.C. § 3793.13(D).

• Where a court has ordered disclosure to a prosecutor or director of mental health
O.R.C. § 3793.13(E).

• To outside medical personnel for bona fide medical emergencies.

Disclosure of Resident Records

General Rule. Representatives of the Office of the State Long-Term Care Ombudsman
program are entitled to access records, including medical records, of a long term care resident
(or a recipient of community-based long-term care services) to investigate complaints if consent
is given. Consent may be given in any of the following ways:

• In writing by the resident;

• Orally by the resident, witnessed in writing at the time it is given by one other
person, and, if the records involved are being maintained by a long-term care
provider, also by an employee of the long-term care provider;

• In writing by the guardian of the resident;

• In writing by the attorney in fact of the resident if the resident has authorized the
attorney in fact to give such consent;

• In writing by the executor or administrator of the estate of a deceased resident.

O.R.C. § 173.20.

Consent Unobtainable. If consent to access to records is not refused by a resident or his legal
representative but cannot be obtained and any of the following circumstances exist, a

Wright State Physicians Ohio Law as it Relates to HIPAA Privacy H2053 7
Implementation Date: 9/23/2013
Revision Date:

OHIO LAW AS IT RELATES TO HIPAA PRIVACY

representative of the Office of the State Long-Term Care Ombudsman program may inspect the
records of a resident that are reasonably necessary for investigation of a complaint:

• The resident is unable to express written or oral consent and there is no guardian
or attorney in fact;

• There is a guardian or attorney in fact, but he cannot be contacted within three
working days;

• There is a guardianship or durable power of attorney, but its existence is
unknown by the long-term care provider and the representative of the office at
the time of the investigation;

• There is no executor or administrator of the estate of a deceased resident or
recipient.

Consent Denied. If a representative of the Office of the State Long-Term Care Ombudsman
program has been refused access to records by a guardian or attorney in fact, but has
reasonable cause to believe that the guardian or attorney in fact is not acting in the best
interests of the resident or recipient, the representative may, on approval of the State Long-
Term care Ombudsman, inspect the records of the resident or recipient, including medical
records, that are reasonably necessary for investigation of a complaint.

Disclosures of Patient Medical Information REQUIRED to be Disclosed. The following
medical information is required to be disclosed under Ohio law. Note that these laws change
often and you should consult with legal counsel periodically as to the current status of
Ohio law and whether there are any new requirements not listed here.

• Physicians and other health care providers are required to report to law
enforcement any gunshot or stab wound that the provider treated or observed, or

• any other serious physical harm that the provider reasonably believes resulted
from a violent offense. O.R.C. § 2921.22.

Wright State Physicians Ohio Law as it Relates to HIPAA Privacy H2053 8
Implementation Date: 9/23/2013
Revision Date:

OHIO LAW AS IT RELATES TO HIPAA PRIVACY

• Physicians and other health care providers are required to report any suspected
cases of child abuse to a public children services agency or to law enforcement.
O.R.C. § 2151.421.

• Physicians and other health care providers are required to report any suspected
cases of abuse, neglect, or exploitation of an adult (person 60 years old or older)
to the county department of job and family services. O.R.C. § 5101.61.

• A provider who provides treatment to an injured employee must report the
employee’s injury to the Managed Care Organization responsible for payment to
the provider. O.A.C. § 4123-6-028.

• Law enforcement authorities may obtain copies of any records related to any
drug or alcohol test administered to a person to determine the presence of
alcohol or drugs in the person’s system at any time relevant to the criminal
offense in question. O.R.C. § 2317.022. There is a specific form found in R.C. §
2317.022 that law enforcement must executie and present to the provider to
obtain testing results.

• Hospitals, physicians and other health care providers are required to report to
law enforcement any burn injury that was inflicted by an explosion or other
incendiary device or that shows evidence of having been inflicted in a violent,
malicious, or criminal manner. O.R.C. § 2921.22(E).

Wright State Physicians Ohio Law as it Relates to HIPAA Privacy H2053 9
Implementation Date: 9/23/2013
Revision Date: