It is very common for health care entities to receive patient information from outside sources—e.g., other providers—and incorporate that information into a patientʼs health care record. Entities must pay particular attention when they subsequently share—or redisclose—the received health information, in whole or in part, with another entity. For example, redisclosure occurs when a patient's primary care physician receives records from the patient's recent hospitalization, includes those hospital records in the patient's health care record, and later releases the patient's complete health care record, including the hospital records, to a specialist for treatment of a specific condition.

While the redisclosure of health information promotes continuity of care for patients treated by several different providers, it also puts patient confidentiality at risk. Both federal and state laws address this issue by placing restrictions on the redisclosure of health information. Consequently, entities must understand their responsibilities with regard to records originating from outside sources, and create policies and procedures for the proper management and redisclosure of those records.

Laws Governing the General Redisclosure of Health Information

Redisclosure that is authorized by a patientʼs informed consent is generally not problematic. Statutes and regulations therefore tend to address the circumstances under which redisclosure may be appropriate in the absence of informed consent.

Federal Requirements

At the federal level, the Health Insurance Portability and Accountability Act (HIPAA) fails to address redisclosure. However, the United States Department of Health and Human Services has clarified that HIPAA permits a covered entity to disclose a complete medical record, including portions created by another provider, so long as the disclosure is for a proper purpose under HIPAA—e.g., treatment—and the released information is limited to the minimum necessary to accomplish the intended purpose of the disclosure.

Wisconsin Requirements

Wisconsin law is more restrictive in its requirements relating to the redisclosure of health information. Therefore, Wisconsin law preempts HIPAA, and entities must comply with the additional restrictions created within the Wisconsin statutes.

In Wisconsin, an entity's ability to redisclose health information without informed consent depends on whether the entity redisclosing the information is a covered entity (as defined under HIPAA) or not.1 Covered entities—including most health care providers—are permitted under Wisconsin law to redisclose a patientʼs record, without informed consent, in all circumstances where disclosure, without informed consent, is allowed.2

Section 146 of the Wisconsin Statutes provides a list of numerous, specified circumstances in which disclosure can be made without informed consent. For example, informed consent is not required when disclosure, or redisclosure, is made: to a health care provider who is rendering assistance to the patient; for billing or collection purposes; to a governmental agency under certain circumstances; during management audits, health care services review or accreditation; or under a court order.3

An entity that does not fit within HIPAAʼs definition of a covered entity is much more limited in its ability to redisclose health information. A non-covered entity may only redisclose health information: (1) with informed consent; (2) pursuant to a court order; or (3) when the redisclosure is limited to the purpose for which the patient record was initially received.4

Greater Protection for Treatment Records Containing Sensitive Health Information

Both federal and state regulations place greater restrictions on the redisclosure, without informed consent, of records that contain some particularly sensitive types of health information.

Federal Regulations

Federal regulations generally bar the redisclosure of certain alcohol and drug abuse treatment records, without informed consent, with two exceptions: (1) during a medical emergency; or (2) pursuant to a court order and subpoena.5 Further, if redisclosure is made, the redisclosed treatment records must be accompanied by a specific statement (provided for in the regulations) that notifies the recipient that the received records may not be redisclosed.6

Wisconsin Regulations

Wisconsin regulations also provide more restrictive requirements on the redisclosure of treatment records, including mental health, developmental disability, and alcohol or drug abuse treatment records. The Wisconsin regulations prohibit the redisclosure of treatment records, in the absence of informed consent, unless specifically authorized by the regulations themselves.

While the regulations do not specify the circumstances in which the redisclosure of treatment records is permitted without informed consent, it is likely that the legislature intended to permit redisclosure, without informed consent, in all of the same circumstances where disclosure, without informed consent, is allowed – e.g., during audits; for billing and collection purposes; pursuant to a court order; and in cases of a medical emergency.7 When redisclosures of treatment records occur, the Wisconsin regulations also require that a written statement accompany the released confidential information.8

Tips for Managing Redisclosures

The restrictive federal and state requirements dealing with redisclosure make it essential that entities carefully manage medical records originating from outside sources so as to ensure that redisclosure is only made when permitted. The following general recommendations may help your entity decide whether or not to redisclosure patient health information:

  • Ask patients to sign an authorization for redisclosure at the outset of the patient/provider relationship.
  • All patient health information can generally be redisclosed pursuant to a valid authorization or court order. 
  • If there is no patient authorization for the redisclosure of patient health information, disclose only that information which is necessary for the health and safety of the patient, or which meets another statutory exception discussed above.
  • Be particularly cautious when redisclosing mental health, developmental disability, and alcohol or drug abuse treatment records. Do not disclose treatment records without consent unless redisclosure is required by an emergency situation or a court order. 
  • Always consult legal counsel when in doubt about a particular redisclosure.