Records, access to patient records at city clinic

Mr. Patrick G. Gilligan
Ocala City Attorney
7 East Silver Springs Boulevard
Suite 500
Ocala, Florida 34470

RE: MEDICAL RECORDS--MUNICIPALITIES--access to patient records at city-owned clinic. s. 456.057, Fla. Stat.

Dear Mr. Gilligan:

On behalf of the City of Ocala, you ask substantially the following question:

Who may access city employees' medical records maintained at a city-owned and operated medical clinic?

In sum:

Patient records at a city-owned and operated medical clinic are confidential and may only be released upon the written consent of the patient or under the specific circumstances provided under Florida law. Under its duty to ensure the confidentiality of such records, the city may allow access to such records to city employees whose duties are related to the furnishing of medical services to the patient/employee.

You state that the City of Ocala owns and operates a medical clinic for the use and benefit of its employees. A full-time registered nurse employed by the city staffs the facility. In addition, the city contracts with a private medical practice for a part-time physician's assistant who is supervised by a physician from the private practice. The clinic treats employees for routine illnesses and injuries and performs drug and alcohol screenings, annual fitness for duty exams, pre-employment physicals and drug screenings and return to work evaluations. The clinic makes referrals depending on the employee's medical condition. As a result, medical records are created and received by the clinic. These records are maintained by the city-employed nurse, who reports directly to the city's director of human resources. Questions have arisen as to who, other than the patient and the clinic's medical staff, may have access to the employee's medical records.

Section 456.057(5), Florida Statutes, states that medical records "may not be furnished to, and the medical condition of a patient may not be discussed with, any person other than the patient or the patient's legal representative or other health care practitioners and providers involved in the care or treatment of the patient, except upon written authorization of the patient."

Such records, however, may be furnished without written authorization under the following circumstances:

"(a) To any person, firm, or corporation that has procured or furnished such examination or treatment with the patient's consent.
(b) When compulsory physical examination is made pursuant to Rule 1.360, Florida Rules of Civil Procedure, in which case copies of the medical records shall be furnished to both the defendant and the plaintiff.
(c) In any civil or criminal action, unless otherwise prohibited by law, upon the issuance of a subpoena from a court of competent jurisdiction and proper notice to the patient or the patient's legal representative by the party seeking such records.
(d) For statistical and scientific research, provided the information is abstracted in such a way as to protect the identity of the patient or provided written permission is received from the patient or the patient's legal representative."[1]

You assert that the city falls within the exception in paragraph (a) above, since it furnishes medical care to its employees and, in most cases, employees seek such care freely, thereby consenting to examination and treatment.

In Attorney General Opinion 89-40, this office found that section 455.241(2), Florida Statutes, a predecessor to section 456.057(5), Florida Statutes,[2] allowed the release of an employee's medical records to the employer when medical care is being furnished by the employer pursuant to a workers' compensation claim. Under such circumstances, the employer is the "person, firm or corporation that has procured or furnished such examination or treatment with the patient's consent."

The sharing of medical records of city employees was addressed in Attorney General Opinion 96-58. There, the City of Jacksonville had contracted with a physician to serve as the medical director of its fire and rescue division and also to perform routine pre-employment and annual fitness for duty physicals for emergency medical technicians, paramedics and firefighters. Drug testing, a part of the pre-employment and annual fitness for duty physicals, was performed pursuant to a collective bargaining agreement under which employees required to take such tests signed an authorization to release medical records to the city. In light of the written authorizations executed by the paramedics and medical technicians, it was concluded that the physician could release the medical records to the city.

A similar situation was addressed in Attorney General Opinion 95-75, regarding who may have access to confidential records produced under section 401.30, Florida Statutes, which requires records of emergency calls to be maintained by a provider. Records of emergency calls containing patient examination and treatment information are made confidential by the section and may not be disclosed without the consent of the person to whom they relate. While the section specifies persons or entities outside the agency who may receive such information, this office concluded there was nothing in the statute to preclude the sharing of the information with "agency employees who are responsible for advising the agency as to its duties and responsibilities in providing such care." It was observed, however, that the confidentiality provisions may prevent disclosure of such records to agency employees for purposes unrelated to the incident.

Applying the analysis and conclusions contained in the opinions discussed above, it would appear that the medical records of city employees who use the city's clinic are confidential under section 456.057, Florida Statutes. The city's ownership of the clinic does not appear to make it an entity procuring or furnishing examination or treatment with the patient's consent. An employee's use of the facility does not necessarily constitute consent to have medical records released, nor could it reasonably be inferred that such use substitutes for the written authorization required under section 456.057(5), Florida Statutes.

Moreover, as found in Attorney General Opinion 95-75, while city employees who are responsible for providing the medical services to the patient/employee may have access to patient records, confidentiality provisions generally governing the release of such records may preclude disclosure to other city employees whose duties are unrelated to the care and treatment of a patient at the medical clinic.

Other statutory provisions regarding the release of medical records confirm that, generally, such records are confidential and may not be released without the patient's consent. For example, section 456.057(6), Florida Statutes, provides that except in a medical negligence action or administrative proceeding when a health care practitioner or provider is or expects to be named as a defendant, information that is disclosed to a health care practitioner or provider by a patient during the course of the patient's care or treatment is confidential and "may be disclosed only to other health care practitioners and providers involved in the care or treatment of the patient, or if permitted by written authorization from the patient or compelled by subpoena at a deposition, evidentiary hearing, or trial for which proper notice has been given."[3]

The Department of Health may obtain patient records pursuant to a subpoena, in its investigation of health care practitioners for violation of Chapter 456, Florida Statutes, or any professional practice act, for providing inadequate health care based on termination of insurance, or for filing inaccurate insurance claims to obtain greater fees than would have been obtained for the actual service provided.[4] All patient records obtained by the department are confidential and exempt from section 119.07(1), Florida Statutes, and may only be used in the investigation, prosecution, and appeal of disciplinary proceedings.[5]

Thus, the confidentiality of patient records does not appear to be compromised by the fact that a public agency operates the medical facility where treatment is sought and such records may only be accessed with the patient's consent or under the specific circumstances set forth in the statutes.

All "records owners" are required to develop and maintain appropriate policies, standards, and procedures to ensure the confidentiality and security of a patient's medical record.[6] As used in section 456.057, Florida Statutes, the term "records owners" means

"any health care practitioner who generates a medical record after making a physical or mental examination of, or administering treatment or dispensing legend drugs to, any person; any health care practitioner to whom records are transferred by a previous records owner; or any health care practitioner's employer, including, but not limited to, group practices and staff-model health maintenance organizations, provided the employment contract or agreement between the employer and the health care practitioner designates the employer as the records owner."[7] (e.s.)

As the records owner, the city is under a duty to ensure that the confidentiality of a patient's medical records is maintained. This would appear to encompass policies or procedures that allow access to patient records only by those city employees whose duties are related to the furnishing of medical care and treatment for the patient/employee.[8]

Accordingly, it is my opinion that patient records of city employees who use the services of a medical clinic operated by the city are confidential and may only be released upon the written consent of the patient or under the specific circumstances provided under Florida law. Under its duty to ensure the confidentiality of such records, the city's grant of access to such records would appear to be limited to those city employees whose duties are related to the furnishing of medical care and treatment to the patient/employee.

Sincerely,

Robert A. Butterworth
Attorney General

RAB/tls

--------------------------------------------------------------

[1] Section 456.057(5), Fla. Stat.

[2] See s. 82, Ch. 97-261, Laws of Fla. (1997), rewriting and transferring s. 455.241, Fla. Stat., to s. 455.667, Fla. Stat., and s. 79, Ch. 2000-160, Laws of Fla. (2000), transferring, amending, and renumbering s. 455.667, Fla. Stat.

[3] See also Richter v. Bagala, 647 So. 2d 215, 217 (Fla. 2d DCA 1994) ("In order to obtain an injured plaintiff's medical records from the plaintiff's treating physician . . . , a person . . . must, absent a waiver, use a statutory method or follow the applicable Florida Rule of Civil Procedure"), approved sub nom., Acosta v. Richter, 671 So. 2d 149 (Fla. 1996).

[4] Section 456.057(7)(a)1.-3., Fla. Stat.

[5] Section 456.057(8)(a), Fla. Stat.

[6] Section 456.057(9), Fla. Stat.

[7] Section 456.057(1), Fla. Stat.

[8] Cf. s. 395.3025(4), Fla. Stat., governing patient records at hospitals, ambulatory surgical centers, or mobile surgical facilities, stating:

"Patient records are confidential and must not be disclosed without the consent of the person to whom they pertain, but appropriate disclosure may be made without such consent to:
(a) Licensed facility personnel and attending physicians for use in connection with the treatment of the patient.
(b) Licensed facility personnel only for administrative purposes or risk management and quality assurance functions."

Disclosure is also allowed to the Agency for Health Care Administration, other state agencies and entities for specific purposes, and pursuant to a subpoena issued by a court of competent jurisdiction. See s. 395.3025(4)(c)-(k), Fla. Stat. See also s. 395.3025(8), Fla. Stat., providing that "[p]atient records at hospitals and ambulatory surgical centers are exempt from disclosure under s. 119.07(1), except as provided by subsections (1)-(5)."