Consent, Privacy and Medical Records

Topics Covered on This Page

Consent for Treatment
Minor Consent
Privacy And Medical Information
Access To Records
Amendment Of Record
About the Author

By Anne Cramer
Primmer, Piper, Eggleston & Cramer, P.C.

Consent for Treatment

What are the legal principles leading up to the establishment of a patient’s right to informed consent?
Our common law in the United States has long recognized that every human being of adult years and sound mind has the right to determine what shall be done with his or her body. Initially, this right was defined in terms of an individual’s right to be free of unwanted bodily invasion – essentially that a person cannot be “touched” without his or her explicit permission. As a result, a person who has not given consent to a “touching,” such as medical treatment, was considered to have a cause of action against the health care provider for a battery.

What is a battery?
A battery is an intentional “tort” or act that results in harmful contact with another. A defense to a claim of battery is that the individual claiming harm consented to the contact. In a medical context, a health care provider commits a battery if the provider performs a procedure for which the patient has not given consent.

What is the current law in Vermont regarding the principle of informed consent?
The duty of a health care provider to obtain consent from a patient for treatment has been defined by statute in most states, including in Vermont in 12 V.S.A. §1909, which limits the scope of a medical malpractice action based on lack of informed consent, and in the Hospital Patient Bill of Rights, 18 V.S.A. §1852(3) and (4).

The medical malpractice provision enacted in Vermont (originally in 1975), defines “informed consent” in the negative, meaning that the lack of informed consent means the following:

(1) The failure of the person providing professional treatment or diagnosis to disclose to the patient such alternatives thereto and the reasonably foreseeable risks and benefits involved as a reasonable medical practitioner under similar circumstances would have disclosed in a manner permitting the patient to make a knowledgeable evaluation; or

(2) The failure to provide to a patient a reasonable answer to any specific question about foreseeable risks and benefits. [12 V.S.A. §1909(a)]

The Hospital Patient Bill of Rights provides the patient the affirmative “right to obtain from a physician coordinating his or her care, complete and current information concerning the diagnosis, treatment and any known prognosis in terms the patient can reasonably be expected to understand.” The patient has the right, except in emergencies, to receive from the physician information necessary to give informed consent prior to the start of any procedure or treatment. Such information should include the medically significant risks involved with this procedure or treatment, the probable duration of incapacity and any medically significant alternatives.

Note that the rights are also set forth in the Medicare Hospital Conditions for Participation, 42 CFR §482.13.

What is the difference between a case where the patient has provided no consent to the treatment or procedure and a case that fails to meet an informed consent standard?
Where a medical professional performs a treatment or procedure for which there is no consent, the patient has a cause of action for battery – an intentional contact or invasion which causes harm. Where the patient has provided consent for the treatment or procedure employed, but receives inadequate disclosure of the alternatives and foreseeable risks and benefits of the alternatives, the cause of action and liability is based on lack of informed consent and a claim of medical malpractice in failing to provide the necessary disclosures. [Christman v. Davis, 179 Vt. 99 (2005)]

Must a medical professional obtain informed consent in an emergency?
No, where treatment has been provided to address an emergency, Vermont law specifies that there can be no cause of action for medical malpractice based on a lack of informed consent. [12 V.S.A. §1909(b); see 18 V.S.A. §1852(4)]

Under what other conditions is it permissible for a physician to have treated a patient without first having obtained informed consent?
The following circumstances have been recognized as defenses to any claim for medical malpractice based on lack of informed consent: (1) that the risk that was not disclosed was so commonly known that it would not need to be affirmatively stated; and that the risk is not substantial, or (2) the patient had previously assured the medical professional he would undergo the treatment procedure or procedures regardless of the risk involved, or (3) the patient indicated to the medical professional that he did not want to know of the matters to which he would be entitled to be informed, or (4) consent either by the patient or on behalf of the patient was not reasonably possible, perhaps as a result of the patient’s incapacity and the unavailability of any patient representative, or (5) a reasonably prudent person in the patient’s position would have undergone the treatment or procedure if he had not been fully informed. [12 V.S.A. §1909(c)]

Must a patient be advised of the foreseeable risks and benefits of a treatment or procedure in the event that the medical professional believes that this information would adversely affect the patient’s condition?
Yes, Vermont no longer recognizes a “limited” therapeutic privilege and prior statutory references to such a privilege found in the informed consent and patient bill of rights provisions have been deleted from Vermont’s statutes.

What type of evidence must be produced by a patient at trial to support a charge of medical malpractice as a result of lack of informed consent?
Vermont statutory law, 12 V.S.A. Section 1908, requires that a patient establish the standard of care for the treatment or procedure that was not met or for which insufficient information was provided to give informed consent.  Courts have interpreted this law to mean that normally the burden of proof imposed by the section will be satisfied only by expert testimony.  See Larson v. Candlish, 144 Vt. 499 (1984).  Although recent cases confirm this standard, a limited exception has been carved out where the alleged violation of the standard of care is so apparent that it can be understood by a layperson without the aid of medical experts.  See Provost v. Fletcher Allen Health Care, Inc., 2005 VT 115, ¶ 12, 179 Vt. 545, 547.

If a patient consents to a treatment or procedure after being fully informed of the risks, benefits and alternatives, and the medical professional performs a treatment or procedure with similar risks, benefits and alternatives, but not the same treatment or procedure, does the patient have a cause of action for malpractice based on lack of informed consent?
The answer to this question depends upon whether a different treatment or procedure was performed or whether the treatment or procedure performed was “within” the conduct for which consent was obtained. For instance, in the case of Christman v. Davis, the patient gave consent to a tissue graft to address root exposure. The periodontist decided to do a less invasive flap procedure instead after an anesthetic was administered. Afterwards, the patient was surprised by this change. When the desired results were not achieved, the patient sued for dental malpractice based on lack of informed consent and for battery. The Vermont Supreme Court found that the treatment/procedure provided was within the bounds of the consent obtained and thus there could be no cause of action for battery as consent was obtained and the dentist simply exercised professional judgment. The Court noted that there may have been an actionable claim for malpractice due to lack of informed consent, but this claim had previously been dismissed.

Must a patient’s consent be provided in writing to qualify as informed consent?

There is no specific requirement that informed consent be given in writing or acknowledged in writing. However, given the time delays attendant to any challenge to a medical procedure for lack of informed consent, obtaining written acknowledgement is prudent and is considered the accepted practice. Additionally, for professionals treating patients in a hospital or ambulatory care setting, evidence of informed consent must be obtained to meet the Medicare Conditions of Participation, 42 CFR §482.13 and JCAHO Accreditation Standards.

Who is responsible for securing informed consent?
The professional who will be providing treatment has the duty to secure the patient’s informed consent. Although the treating professional need not perform this task personally, he or she is the one who faces liability if it is not performed or is performed inadequately or improperly. Additionally, the Hospital Bill of Rights provides that the patient has the right to obtain this information from the physician who is coordinating the patient’s care.

What information must the health care professional disclose to the patient before informed consent can be fairly given?
The professional must give the patient information regarding the reasonably foreseeable risks and benefits of the proposed treatment or procedure and also of the alternatives to the proposed treatment or procedure.

What risks, benefits and alternatives must be disclosed?
The treating professional must disclose any “reasonably foreseeable risks” that a “reasonable . . . medical practitioner under similar circumstances would have disclosed.” Essentially, the evaluation must be that the information provided permits the patient to make a knowledgeable evaluation of the treatment or procedure.

How must the information be disclosed?
Vermont’s statutory provisions anticipate that the patient has an opportunity to question the professional regarding foreseeable risks and benefits. As a result, a face-to-face explanation is advisable although, not necessarily required. Providing the patient with written or video information about the risks, benefits and alternatives may also satisfy the standard in many instances. However, it must be a meaningful communication such that the patient needs to be able to read or understand the language and vocabulary utilized. Additionally, although informed consent is a process rather than a form, documenting the process on a form is important in order to demonstrate the information provided by the professional to the patient, the questions asked by the patient, and to have evidence of the patient’s signature at the time such information is given.

For what treatments or procedures is informed consent required?
Vermont law does not designate the types of treatment, procedure or surgeries which require the professional to obtain a patient’s informed consent before acting. However, a defense to a claim of medical malpractice for lack of informed consent may be based on allegations that the risk that was not disclosed is so commonly known and insubstantial that informed consent was not necessary.

What are the exceptions to the principle of informed consent?
The following exceptions have been set forth in the statute:

• If the patient is in an emergency medical condition, no informed consent is necessary;
• The risk not disclosed is too commonly known to require disclosure and is not substantial;
• The patient had assured the medical practitioner that he/she would undergo the treatment procedure or diagnosis regardless of risk involved;
• The patient indicated to the medical practitioner that he/she did not want to be informed of the matters to which he/she would be entitled to be informed;
• Consent by or on behalf of the patient was not reasonably possible;
• A reasonably prudent person in the patient’s position would have undergone the treatment or diagnosis if he/she had been fully informed, or

Any discussion about informed consent, or exceptions to informed consent should be documented in the medical record including the reasons for any exception. An executed patient consent form should be maintained in the record or a reason noted as to why a form was not signed.

Minor Consent

What is the legal age of informed consent in Vermont? 

Eighteen (18). In Vermont any individual under the age of 18 is considered a minor. In most circumstances, minors are not capable of giving informed consent to their own medical care.

Who can give informed consent to health care for a minor?

In Vermont, the following individuals may give informed consent to health care for a minor: 

• A guardian or representative who has been appointed by a judge to make healthcare decisions for the child;
• A parent. (adopted or biological)

Who can give informed consent to health care when the minor’s parents are divorced? 

In general, both parents can make health care decisions for the child. If the parents are divorced, the informed consent of either parent may be assumed to be sufficient. Of course, every divorce decree is different and there are situations where a judge has entered an order in which one or both of the parents is no longer authorized to make health care decisions for their child. In those situations, health care professionals are obligated to follow the judge’s order. If one parent claims that he or she has exclusive control of medical decision-making, he or she should be asked to present relevant family court documents.

Can a parent or guardian delegate authority for giving informed consent to medical treatment for a minor? 

Vermont law is silent on this question. It is reasonable to assume that where the parent(s) or guardian(s) will not be reasonably available to give informed consent to medical treatment (e.g., vacations, illness, etc.), they may delegate this authority to a selected adult. Because there are no clear guidelines for determining the legality of an apparent delegation of this parental authority, providers should make reasonable efforts to obtain parental informed consent and should use their professional judgment and exercise greater caution in providing services involving any increased risk. If the office has a written consent on file that has been signed by the parent authorizing the physician and his/her staff to provide medical care to the child, there is little or no risk in providing the child with routine medical care. In situations where the treatment is non-routine or poses some degree of risk to the child, it is always advisable to consult with the parent before proceeding. Asking parents ahead of time to document authorization for medical treatment in their absence is recommended.

When faced with a situation where the minor has been brought to the office by a grandparent or adult sibling, should a provider refuse treatment until informed consent from the parent/guardian has been obtained? 

No. As long as the health care professional has exercised due care and made a good faith determination that the grandparent or adult sibling has been authorized by the child’s parent or guardian to act as the agent in obtaining medical care for the minor, liability is unlikely if the parent later claims that the grandparent or sibling lacked authorization. Of course, if the medical care will involve anything more than routine, low-risk procedures, the health care professional should make every effort to obtain the parent’s specific informed consent before providing this type of care. Health care professionals are expected to use good judgment in determining which procedures require specific parental informed consent.

Can a minor ever give informed consent for his or her own health care? 

Yes. Minors who are married or have ever been married, and minors on active U.S. military duty, may give informed consent to their own health care. Minors emancipated by court order may also give informed consent to their own health care.

What is the definition of an “emancipated minor?” 

To become emancipated, a probate court must determine that a minor: 1) is sixteen (16) years of age; 2) has lived separate and apart from his or her parents or legal guardians for at least three (3) months; 3) is managing his or her own financial affairs; and (4) has demonstrated ability to be self-sufficient in financial and personal affairs. [12 V.S.A. § 7151(a)(1)]

Are there any special situations where an unemancipated minor may give informed consent to their own health care? 

Yes. Minors 12 years or older may give informed consent to treatment for sexually transmitted diseases (including HIV and AIDS), drug dependence, and alcoholism. But if a minor requires immediate hospitalization for treatment of any of these conditions, the parents must be notified of the hospitalization. [18 V.S.A. § 4226]

Minors 14 years or older may also voluntarily admit themselves to a hospital for mental health related treatment if they give informed consent in writing. Minors under 14 may admit themselves to a hospital for mental health related treatment by providing their own written informed consent and a written application from a parent or guardian.  [18 V.S.A. § 7503]

Minors of any age may give informed consent to medical treatment associated with rape, incest, or sexual abuse. Health care providers are required to report such incidents to the Department of Children and Families (“DCF”) within 24 hours.  [33 V.S.A. § 4911 et seq.] 

Is parental informed consent required before a minor can terminate a pregnancy or receive contraceptive devices/medications?

Current U.S. Supreme Court rulings and Vermont state law permit unemancipated minors to give informed consent to abortions and medical treatment necessary to obtain contraceptive devices and medications. In determining whether the minor’s informed consent is sufficient, health care providers should carefully assess whether the minor understands the nature and risks of the proposed treatment and is capable of making an informed, rational choice. The following factors should be considered: age, ability, experience, education, maturity level, conduct and demeanor.  There should be little legal risk if the provider determines that notifying the parent or guardian is in the best interests of the child. It is always important to document decisions and the basis for the decision.

Is parental informed consent required before minors are provided pregnancy, prenatal and delivery care?

Vermont law is silent as to whether pregnant, unemancipated minors can give informed consent to reproductive services. Because cases involving other reproductive services, such as abortion and contraception, have allowed minors considerable freedom, health care providers should evaluate whether the minor’s informed consent is sufficient using the criteria outlined above.

Are there any situations where providers need not obtain informed consent from anyone before providing the minor with health care? 

Yes.  When dealing with an emergency – a situation in which immediate treatment is needed to save the patient’s life or health – where, for some reason, informed consent cannot be obtained, treatment may be provided without obtaining informed consent. Of course, it is good practice to try and obtain informed consent as soon as possible even in an emergency situation. [12 V.S.A. § 1909(b)]

If adolescents drive themselves to their appointments, should providers obtain parental informed consent before treating the minor? 

In those situations, again, the health care professional is expected to exercise sound judgment as to whether the parent must be contacted. If the office has a written consent on file that has been signed by the parent authorizing the physician and his/her staff to provide medical care to the child, there is little or no risk in providing the child with routine medical care. In situations where the treatment is non-routine or poses some degree of risk to the child, it is always advisable to consult with the parent before proceeding.

In situations where it is not required to obtain the parent or guardian’s informed consent (e.g., treatment for venereal disease or substance abuse), is the parent or guardian responsible for the costs of this medical care?

Yes. Generally, parents or guardians are responsible for support of their unemancipated minors if the treatment is medically necessary. 

In situations where it is not required to obtain the parent or guardian’s informed consent, may the physician inform the minor’s parents of the medical treatment?

In the case of substance abuse, federal regulations prohibit the physician from disclosing this treatment to the parent or guardian unless the minor lacks the capacity to make rational decisions, the situation poses a substantial threat to the child’s life or well-being, and the physician determines that this threat may be reduced by communicating the treatment to the parents. Generally, ethical/medical rather than legal concerns control the decision to inform parents in situations where it is not required to obtain the parent’s or guardian’s informed consent. There should be little legal risk of informing parents or guardians if the disclosure is in the best interests of the child. Note that parents may become aware of the visit, if their insurance is used to pay for care.

In addition to obtaining informed consent from the parent or guardian, must providers also obtain informed consent from the minor? 

No. If the parent or guardian is authorized to informed consent, health care professionals are not also required to obtain the informed consent of the minor. Of course, depending on the age and maturity level of the child, it is good practice to explain the procedure to the child and attempt to obtain his or her informed consent and cooperation.

In situations where an unemancipated minor has a child of her own, who is authorized to give informed consent for care of the minor’s child?

The child’s parent, regardless of age, is authorized to make decisions for her own minor child. This may lead to the anomalous situation where the parent is not legally capable of giving informed consent to her own health care, but can make decisions on behalf of her infant.

When minors are in the state’s custody, who is authorized to provide informed consent for their health care?

The commissioner of DCF has authority under Vermont statute to step into the shoes of the parent and thus is authorized to provide informed consent for a minor’s health care just as a parent would as outline above. The commissioner has additional authority to delegate this responsibility to other members of the department.

Are minors in DCF custody able to receive contraceptive services?

According to SRS policy, caseworkers will ensure that appropriate supportive counseling and contraceptive services are available to teens in custody.

May minors in DCF custody receive pregnancy-related services without informing their parents?

DCF staff may or may not inform parents of teens in custody about their pregnancy-related care, depending upon the department’s determination of what is in the best interests of the minor.

Who is authorized to consent to treatment when a child is in custody of the Department of Corrections?

The Department of Corrections has exclusive authority to consent to medical treatment for children in the custody of the department. The commissioner of Corrections designates health staff to represent the state. As a matter of policy, the department tries to involve the child's parents whenever possible to obtain their input and background information.

When a minor in corrections custody receives medical care from a provider outside the prison, can the corrections officer accompanying the minor receive medical records of the visit?

Yes, the health care professional may give the records to the corrections officer transporting the patient in a sealed envelope marked: "To the attention of the responsible Department of Corrections health authority." Records may also be mailed to the "designated health authority" at the facility where the child is residing.

When minors are in custody of the commissioner of Corrections who has access to their medical records or health care information?

The following individuals have access to health care information about a minor in custody of the Department of Corrections:

·         The commissioner, deputy commissioner, director of correctional services, clinical director, medical director and their designees - on an as needed basis;

·         Health care providers designated by the Department of Corrections;

·         Non-health staff employed by the Department of Corrections have access as determined by health services staff.

Persons in custody are entitled to reasonable opportunities to discuss their medical care and treatment with health care providers. Guardians, including parents, have the same type of access to discuss care that the person in custody has.

Resources Related to Minor Consent:

Consent to treatment for STD, drug, alcohol 18 V.S.A. § 4226

Voluntary admission for mental health treatment 18 V.S.A. § 7503

Medical treatment associated with rape, incest, or sexual abuse 33 V.S.A. § 4911

Emancipation: 12 V.S.A § 7151

Corrections: 28 V.S.A. § 1104; Department of Corrections Directive 254.02 Access to Health Care Records;

also Social Services Policy Manual: Working with Families No. 74, 10/27/99

Emergency: 12 V.S.A. § 1909(b)

Privacy and Medical Information

What federal and state rules govern the confidentiality of medical records in Vermont?
Health care providers must consider the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations governing the electronic transfer and security of data and the privacy of medical information found at 45 CFR Parts 160 and 164. These regulations allow a provider to use and disclose health information for (1) providing treatment to the individual patient, (2) seeking payment for services or (3) for the provider’s “health care operations.”

The HIPAA regulations provide a “floor’ for protecting the privacy of identifiable health information, but they do not preempt state laws which are more protective of privacy or provide greater patient rights to access information.

Under Vermont law, the patient privilege statute, 12 V.S.A. §1612, provides greater protection than the HIPAA privacy rule and requires that doctors, chiropractors, dentists, nurses and mental health professionals must not disclose any information acquired in attending a patient unless the patient waives the confidentiality or it is waived by an express provision of law. Hospital patients and nursing home residents are further protected by the confidentiality provisions contained in the Patient Bill of Rights, 18 V.S.A. §1852(7) and the Nursing Home Bill of Rights, 33 V.S.A. §7301(8) which emphasizes that the patient/resident must authorize the release or use of their records outside of the treatment team or the facility. Where pharmacy, mental health treatment, or substance abuse treatment records are at issue, there are additional federal and state laws to consider as will be discussed below.

Are prescription records given the same confidentiality protection as other medical records?
Under the federal HIPAA privacy regulations, prescription records are treated the same as other health records and are subject to the same confidentiality provisions. Vermont law separately provides for the confidentiality of prescriptions, pharmacy orders and records relating to regulated drugs, but specifically mandates that these records shall be open to inspection to law enforcement agents enforcing federal and state drug laws and to agents of professional licensing boards. [18 V.S.A. §4211 and 4218]  Additionally, pharmacies are required to submit a report to the Vermont Prescription Monitoring System (VPMS) for each outpatient Schedule II, III or IV controlled substance prescription. [http://healthvermont.gov/adap/VPMS.aspx]

The law also specifies that no privilege of confidentiality shall apply to information communicated to a physician to unlawfully obtain a regulated drug by fraud, deceit, false representations, etc. [18 V.S.A. §4223(a) and (b)] Examples of such unlawful behavior may include, failing to disclose that the patient is receiving regulated drugs from another prescriber, pretending to be an established patient of another physician to a covering physician, altering a prescription for 10 pills to be a prescription for 100 by adding a zero, or a patient saying they are taking a drug when a screen shows they are not.

What additional protection is given to mental health treatment records in Vermont?
Information and records pertaining to the treatment of mental illness and developmental disability or to involuntary hospitalization must be kept confidential, including information which directly or indirectly identifies the patient, unless one of the very limited exceptions apply or the patient or legal guardian consents. [18 V.S.A. §7103(a)] Under the HIPAA privacy regulations, psychotherapy notes, which refer to notes recorded by a mental health professional and documenting or analyzing a conversation during a counseling session, are kept separate from the rest of an individual health record and require specific authorization from an individual to be released. [45 CFR §164.501 and §164.508(a)(2)]

What rules apply to the confidentiality of substance abuse treatment records?
Federal law affords separate provisions and protection to the confidentiality of alcohol and substance abuse treatment program records as set forth in 42 CFR Part 2. These provisions prohibit disclosure of the identity of anyone receiving treatment and require a specific consent or authorization form (distinct from the form required by the HIPAA privacy regulations) be executed by the patient before the disclosure of any treatment related information. When these records are disclosed, they must include language that they may not be further disclosed or released without the individual’s specific written consent. [42 CFR §2.32]

Under what circumstances may a Vermont provider disclose health information or medical records without a patient’s consent or authorization?
Under Vermont law, such disclosures may be made only where there are “express provisions of law” or a court order. Disclosures required by “express provisions of law” include the following incidents:

Child Abuse. Health care providers are obligated to contact the Department of Children and Families when they have reasonable cause to believe that any child has been abused or neglected. [33 V.S.A. §§4911-4920]

Crime Victim Under Age of Sixteen. Health care providers are required to disclose information that a patient under the age of sixteen has been a victim of a crime. [12 V.S.A. §1612]

Abuse, neglect or exploitation of vulnerable adults. Similarly, providers must report to the Department of Aging and Independent Living when they have reasonable cause to believe that a disabled adult or an adult suffering from infirmities of age or an adult receiving personal care services at home or at a licensed facility has been abused, neglected or exploited. [33 V.S.A. §§6901-6914] Note, however, that under the HIPAA Privacy Rule, the victim or his or her personal representative is to be notified of such a report or disclosure unless it is believed that such notification might place the individual at risk of serious harm. See 45 CFR 164.512(c)(2).

Firearm-related injuries. Health care providers treating bullet wounds, gunshot wounds, powder burns or other injuries caused by the discharge of a firearm must report such cases to local law enforcement officials or to the state police. [13 V.S.A. §4012]

Suspicious Deaths. A suicide or an unusual, unnatural or suspicious death must be reported by a physician to a medical examiner.  [18 V.S.A. § 5205(a)]

Requests by Chief Medical Examiner.  Information regarding the mental or physical condition of a deceased patient must be released by a physician, dentist, chiropractor, mental health provider, or nurse upon request from the chief medical examiner. [12 V.S.A. § 1612 (c)(2)]

Communicable diseases. Health care providers are obligated to report incidents of certain listed communicable diseases, including tuberculosis and venereal diseases, to the Department of Health. [18 V.S.A. §§1001, 1004, 1007, 1041-1048, 1091-1106]

Fetal deaths. Health care providers are also obligated by statute to report fetal deaths to the Department of Health. [18 V.S.A. §§5221-5224]

Cancer. Providers are required to report each case of cancer to the Department of Health within 120 days of diagnosis, unless the patient has been previously diagnosed or admitted for cancer treatment at a hospital facility in Vermont. [18 V.S.A. §§151-156]

Lead Poisoning. Health Care providers or their employees must report any diagnosis of lead poisoning to the Department of Health, and any laboratory in Vermont analyzing the blood samples of children under the age of six must make reports as required by the Department. [18 V.S.A. §1755(d)]

Blood Alcohol Level Reporting. If a blood test is performed in a hospital emergency room on a patient who was involved in a motor vehicle accident and the blood tests show that the patient’s blood alcohol level exceeded the level prohibited by law, the health care provider shall report that fact to a law enforcement agency having jurisdiction over the area where the accident occurred. [23 V.S.A. §1203b]

Duty to Warn. The Vermont Supreme Court has held that in certain instances, mental health counselors may be obligated to breach patient confidentiality and warn potential victims, if they know or should know that a patient poses a serious risk of danger to an identifiable victim. [Peck v. Counseling Service of Addison County, 146 Vt. 61 (1985)]

What obligation does a provider have to notify a patient of an unauthorized use or disclosure of medical information of a Vermont patient?
Although Vermont law does not require any notification to a patient of a wrongful disclosure or use of medical information, the federal HITECH Act does.  The Interim Final Rule on Breach Notification, which implements the HITECH Act breach notification requirements, became effective on September 23, 2009 and requires providers to notify a patient whose unsecured medical information has been accessed, acquired or disclosed as a result of a breach which compromises privacy or security no later than 60 days after the discovery of the breach.  The definition of breach, as well as the content and methodology of notification are set forth in the American Medical Association’s guidance, “What You Need to Know About the New HIPAA Breach Notification Rule.” [See link.]  Providers are required to keep a log of any breaches discovered and report them to the U.S. Department of Health and Human Services annually.

What liability or penalties could be imposed on a provider who wrongfully discloses the medical information of a Vermont patient?
Under the HIPAA privacy rules and the HITECH Act, a civil penalty may be imposed by the U.S. Department of Health and Human Services Office of Civil Rights (OCR) ranging from $100 to a maximum of $1,500,000. The Vermont Attorney General’s office, along with all states attorney generals, is authorized to enforce the HIPAA privacy regulations through injunction or civil penalties ranging from $100 up to a maximum of $25,000.  Criminal penalties for certain egregious wrongful disclosures may be pursued by the U.S. Department of Justice as well.

Under Vermont law, there is no general penalty or cause of action for the wrongful release of confidential medical information. However, there is a statutory provision which imposes either a $500 fine or up to one year of imprisonment for the wrongful disclosure of information related to hospitalization for mental illness. [18 V.S.A. §7103(c)]

Although in other states a person harmed by a wrongful disclosure of medical information may have a cause of action for invasion of privacy, defamation or breach of contract or fiduciary trust, Vermont has no statutory law or reported case law which establishes a clear right or cause of action to the individual.

How long must a provider retain medical records?
Hospitals are required to retain medical records for a minimum of ten years as part of their state licensure obligations. [18 V.S.A. §1905(8)] The licensure laws are silent for other providers. Retention of medical records for longer periods of time is recommended, however.

The Vermont Statute of Limitations governing medical malpractice or personal injury actions allows a cause of action to be brought within three years of the discovery of the injury. [12 V.S.A. §512(4)] Under a variety of facts, an extensive period of time may pass before a particular medical problem is discovered. Litigation cases involving the past exposure of an individual to toxic or hazardous substances, such as asbestos, as well as the cases questioning the past prescription of various drugs, such as diethylstilbestrol (DES), demonstrate the benefit to the patient of retaining medical records for as extensive a time period as a patient’s full lifespan.

It simply cannot be known when a variety of latent medical conditions will be “discovered.”

In any event, children’s records should be retained until at least three years following their eighteenth birthday because the statute of limitations for a minor to sue for a cause of action does not begin until the minor reaches the age of majority. [12 V.S.A. §551(a)]

What period of time is recommended for retaining the records of a deceased patient?
The wrongful death statute requires court actions to be commenced two years from the date of death. The survival of actions law; however, permits court actions to be commenced two years after the date of issuance of letters testamentary by the probate court, which can be some time after the death. Physicians should check with the court with respect to the timing of the issuance of letters testamentary. As a general rule, it is recommended that a provider retain records of deceased patients for no less than three years after the patient’s death.

May a provider in Vermont release medical records or disclose medical information in response to a subpoena?
No, unless the patient has authorized or consented to the release, or, in the rare instance, that the subpoena has been issued by a Vermont or federal court rather than an attorney. The Vermont patient privilege statute [12 V.S.A. §1612] and the mental health information statute [18 V.S.A. §7103] permit disclosures without patient consent only if directed by a court of law. A civil subpoena, commonly issued by attorneys, does not override the patient privilege of confidentiality. Vermont law is to be distinguished as much stricter than the HIPAA privacy regulation which permits a health care provider to disclose health information in response to a subpoena if certain efforts have been made to notify the individual. [45 CFR §164.512(e)]

What should a provider do if he is served a subpoena for medical records or to testify about medical information?

The following steps are recommended:

• Determine whether there is a proper basis for releasing the patient’s records. For instance, a patient authorization may be attached to the subpoena. If so, the provider is authorized to release patient information in response to the subpoena.
• If no proper legal basis appears for releasing the records, contact the party issuing the subpoena to seek a voluntary resolution. Explain that the subpoenaed documents or information cannot be released without the patient’s authorization, and that none appears. Often, a subpoena will be withdrawn on this basis or authorization will be obtained. If the former occurs, document the withdrawal of the subpoena in writing by a follow-up letter.
• If the subpoena is not voluntarily withdrawn, and there remains no evident legal basis for releasing the records or information sought, determine whether the subpoena has been validly issued. Note that a subpoena issued by another state court is not valid in Vermont and requires no response. There may be other technical defects in the subpoena as outlined above. (Check with your attorney.)
• If the subpoena is valid, a response must be made before the return date. Counsel should be contacted to make an appropriate response, either by written objection, a motion to quash or by a motion for protective order.
• Under appropriate circumstances, it may be desirable to contact a patient in response to a subpoena to determine whether the patient will consent to the release of the requested documents or records.

Some special comments are in order in responding to investigative or criminal subpoenas issued by prosecutors and law enforcement agencies. Subpoenas in this context may be seeking information about a criminal defendant or suspect, or about a victim (as in a rape case). Resistance from practitioners to release information may sometimes be interpreted by law enforcement agencies as lack of cooperation in criminal enforcement. These problems must be handled delicately and diplomatically, and may require meetings with local law enforcement agencies to explain the practitioner’s obligations to protect patient records and communications. At a minimum, law enforcement officials could be asked to obtain a district court order in support of a criminal subpoena. Such an order which the state could obtain ex parte, would ensure that due consideration is accorded the confidentiality rights of the patient whose records are being sought.

What should a practitioner do if an officer has a search warrant for medical records?
The practitioner must comply with the warrant as a search warrant is only issued after prior judicial approval and a showing of probable cause. There can be no question in the context of search warrants that a court order has been issued. The practitioner should call legal counsel as soon as possible.

Search warrants have a distinctly different purpose than a subpoena. Search warrants are limited to criminal proceedings to obtain evidence against a defendant suspected of a criminal violation. The defendant may be a health care provider or facility or a patient. Because a search warrant is only issued after a showing of probable cause, they are executed immediately and there is no time between issuance and execution for the person subject to the warrant to challenge its legal validity. Therefore, challenges to search warrants are always made after the warrant has been issued and executed and prior to the introduction of the documents or objects in evidence.

A copy of the search warrant will be served on the person from whom or from whose premises the property was taken. In addition, the officer executing the warrant must provide a receipt for the property taken. (The basic requirements for state search warrants are set forth in V.R.C.P. 41.)

What rights do the media or press have to patient information?
The media’s rights to access information are no different than anyone else’s. They must either have patient authorization or a court order.

Access to Records

What rules govern a patient’s access to his or her medical record?
Under Vermont law, practitioners are required to provide patients prompt access to their records upon written request, and failure to do so constitutes unprofessional conduct under 3 V.S.A. §129a(a)(8) and 26 V.S.A. §1354(a)(10). These provisions require that copies be provided to the patient’s representative or succeeding health care practitioner upon the patient’s written request. The HIPAA Privacy Regulations also require that records or copies be made available to patients upon written request, and they provide a thirty day time period for a health care provider to respond to a patient’s request to inspect or obtain a copy of their medical record. This response time may be extended for a second thirty-day period. [45 CFR §164.524]

May access to a patient’s medical record ever be denied to the patient or his or her representative?
Vermont law requires the prompt and complete disclosure of medical information. The HIPAA regulations, unlike the Vermont statutes pertaining to unprofessional conduct, specify limited circumstances under which a practitioner may deny access to an individual’s health information. Because Vermont law would be considered to be more beneficial to a patient, it is likely to govern and preempt any contrary federal provision. Thus, the process for the review of such a denial by another practitioner afforded by the HIPAA regulations may be academic. The HIPAA regulations do allow for a denial in the following circumstances:

• when a provider, in the exercise of his or her professional judgment, determines that it is reasonably likely that access to the requested information would endanger the life or physical safety of the individual or other person (sometimes referred to as the “therapeutic privilege”);
• when the requested information refers to another person and the provider, in the exercise of professional judgment, determines that access is reasonably likely to cause substantial harm to that other person; or
• when the request for access is made by the individual’s personal representative and a provider, in the exercise of his or her professional judgment, determines that providing access to that representative is reasonably likely to cause substantial harm to the individual or another person.

Note that under the HIPAA privacy regulations, a practitioner may deny access to psychotherapy notes to the subject patient (45 CFR §164.524) and cannot disclose such information to others without the patient’s voluntary and specific authorization. Vermont professional licensing law contains no similar exception within its unprofessional conduct provisions, as a result this discussion is largely academic. Vermont law requires the prompt and complete disclosure to the individual.

If I receive records from another provider, must I produce them to a patient or where a patient has authorized the release of all information I maintain?
Yes. The patient has a right to all of their medical information you maintain regardless of who generated the original documentation.

Must I provide a record labeled “Do Not Rerelease” to a patient?
Yes. Under Vermont law, a patient has access to all information pertaining to their medical care. Generally, records labeled “Do Not Rerelease” are related to alcohol or drug abuse treatment and are subject to a specific federal regulation which requires the patient to specifically consent to their further release.

Who may authorize the disclosure of the medical record of a deceased individual?
The Vermont patient privilege statute requires the disclosure of information regarding the mental or physical condition of a deceased patient if the privilege of confidentiality is waived by the decedent’s personal representative, the surviving spouse or the next of kin of the decedent. [12 V.S.A. §1612(c)] Vermont law does not specify which relatives qualify as “next of kin.” Also note that this disclosure requirement is voided in the event that the practitioner concludes that the disclosure “would tend to disgrace the memory of the decedent.” No further guidance has been provided by either legislation or court precedent to define the scope of this contingent provision.

What am I allowed to charge patients, or others such as lawyers and insurance companies, for providing copies of a patient’s health care record?
Both Vermont law and the HIPAA Privacy Rule address the amount that may be charged for providing copies of a patient’s health care record. In sum, you are allowed to charge a reasonable cost-based fee, not to exceed $.50 per page. If applicable, you may also charge for postage. Also, practitioners and health care facilities are required to provide an itemized bill to the recipient of the records copied. However, Vermont law prohibits any charge for copies of records needed to support a claim or an appeal for public benefits such as welfare, Social Security, Medicare or Medicaid. The HIPAA Privacy Rule does not override this provision.

What is the difference between the federal regulation and state law on Medical Record Copy Charges?
The two provisions provide as follows:

·         Vermont Law [18 V.S.A. § 9419] permits a physician office to charge a fee that is no more than a flat $5.00 fee or $0.50 per page, whichever is greater. No charges may be imposed when the records are requested to support a claim or an appeal for public benefits, such as welfare, Social Security, Medicare or Medicaid.

·         The federal HIPAA Privacy Rule [§164.524(c)(4)] permits offices to charge a reasonable, cost-based fee for copying a patient’s medical records, based only on the cost of copying, including the cost of supplies, equipment lease, and labor for copying the records requested. The fee may not include charges for searching for the record or reviewing the record in connection with copying it.  

Your office must follow whichever provision above results in the lower copying fee. For example, if your office’s reasonable cost-based fee of copying the records is less than the Vermont allowance of $.50 per page or $5.00 fee, you must charge the reasonable cost-based fee for the copies, unless, of course, it is to support a public benefits claim or appeal in which case no copy charge may be imposed. On the other hand, if the actual cost of providing copies exceeds the amount permitted by Vermont law, you are capped by the Vermont statutory allowance and can charge no more than $.50 per page or a $5.00 fee.

A provider is permitted to charge for the preparation of an explanation or summary of a record, in lieu of the full record, if the recipient has agreed in advance to receive an explanation or summary and if they have agreed in advance to the fees. A provider may also charge a fee for mailing, if the patient agrees in advance. A provider should document in the patient’s record whether they have requested that the record be mailed to them or have agreed to have the record summarized.

What am I allowed to charge patients for providing copies of images?
Vermont law allows physician offices to charge a cost-based fee for providing copies of x-rays, films, models, disks, tapes or health information maintained in other formats. This provision is consistent with the HIPAA Privacy Rule.

Amendment of Record

What procedures should be followed if a physician seeks to amend a medical record previously created?
If the necessity to correct an entry in a medical record arises, the correction must be made without erasing, obliterating or deleting the original medical record entry. Alterations to or deletions of original records may raise the suspicion of an attempt to conceal the truth. Whether the correction is made in an electronic record or a paper record, the original entry should not be changed. The amendment should include the date and time of the amendment, a notation that the entry is an amendment, to distinguish it from the original record, and the reason for the amendment. Health care facilities and professionals should develop policies on correcting medical records and delegate authority to make corrections to specific identified individuals.

What rights does a patient have to amend his or her medical record?
Patients have the right under HIPAA to amend or supplement their own medical records for as long as the covered entity maintains the information. The health care professional or facility must act on an individual’s request for amendment no later than 60 days after it receives the request. The deadline may be extended up to 30 days.

If a request to amend is accepted, the covered entity must inform the individual and make the appropriate amendment. It must then provide the amendment to entities identified by the individual and to other entities known to have received the erroneous information.

A request to amend may be denied if the health care professional or facility determines that the information or record:

·         Was not created by the covered entity, unless the originator of the protected health information is no longer available to make the amendment;

·         Is not part of the designated record;

·         Would not be available for inspection under the patient’s right of access; or

·         Is accurate and complete.

In this situation, the health care professional or facility must give the patient written notice of its decision that describes:

·         The basis for the denial;

·         The patient’s right to submit a written statement disagreeing with the denial;

·         A statement that the patient can request the health care professional or facility to include the patient’s request and the denial with any future disclosures of the information (if the patient does not file a statement of disagreement); and

How the individual can file a complaint with the covered entity or the secretary of HHS.

Return to Guide Home Page 

About the Author
Anne Cramer, a partner in the law firm of Primmer, Piper, Eggleston & Cramer, P.C., serves as counsel to hospitals, nursing homes, community mental health agencies, physician groups and other private health care interests in Vermont. Anne and her firm have long served as counsel to the Vermont Association of Hospitals and Health Systems and also provide counsel to the Vermont Health Care Association, and the Council for Developmental and Mental Health Services. She is a member of the American Health Lawyers Association, and the Health Law Section of the American Bar Association. In her health law practice, Ms. Cramer emphasizes compliance with federal and state regulatory requirements, including fraud and abuse prevention, HIPAA regulations on privacy, antitrust compliance and employment law. Ms. Cramer lectures frequently on health law topics generally, and she has been cited in Best Lawyers in America for her health law related work for over ten years.