The Cleveland Clinic received a subpoena that ordered it to appear as a witness before a grand jury and produce certain books, papers, documents and other objects relating to the medical treatment of a patient. The Cleveland Clinic provided the documents. After the patient found out the records had been provided, he sued!

In Turk v. Oiler, Civ. Case No. 09-CV-381 (N.D. Ohio Feb. 1, 2010), the U.S. District Court for the Northern District of Ohio recently stated that the Health Insurance Portability and Accountability Act's (HIPAA) exception permitting disclosure of medical records in response to a grand jury subpoena does not authorize a provider to disclose a patient's medical records when a state statute prohibits such disclosure. 45 C.F.R. § 164.512(f)(1)(ii)(B).

State statutes governing disclosure of medical records to third parties that are more stringent than HIPAA are not preempted by the federal statute. Ohio's physician-patient privilege statute provides that a physician cannot testify as to "a communication made to the physician . . . by a patient in that relation or in the physician's . . . advice to a patient" except under limited circumstances. The plaintiff argued, and the court agreed, that the physician-patient privilege statute does not contain an exemption permitting disclosure in response to a grand jury subpoena.

The court noted that Ohio courts have found the physician-privilege provisions to be more stringent than HIPAA, and thus, the Ohio provisions were not preempted by the HIPAA privacy law. Further, Ohio courts have specifically declined to create a public policy exception to the privilege statute for grand jury subpoenas. Accordingly, the court found that, absent a state law enforcement exception to the physician-patient privilege, a hospital could not provide the patient's medical records to a grand jury.

As a consequence, the Cleveland Clinic may be held liable for providing the patient's mental health and substance abuse records to the grand jury. The court also rejected the Cleveland Clinic's claim that it did not publicly disclose the patient's medical records. The Cleveland Clinic attempted to argue that there was no public disclosure because grand jury proceedings are confidential.

The denial of the hospital's motion for judgment on the pleadings serves as a reminder that, when responding to law enforcement requests for medical records, one cannot rest assured that release is proper -- even if specifically allowed under HIPAA -- without reference to state law. Furthermore, while not a part of the court's decision, it also is important to remember when addressing demands for mental health and substance abuse medical records that such records often are afforded greater protections under federal and state law than other medical records. See e.g., 42 C.F.R. § 2.1 et seq.