Analysis of State Laws
Summary of State Laws
Preserving the privacy and confidentiality of an individual’s medical or health information is a legal obligation in most states.15 The limits on the use of patient information vary widely among states, but health providers, employers, and insurers who obtain an individual’s health information are generally required to restrict its release.16
Research on human tissue samples and associated data requires that researchers comply with state laws governing access to and use of medical information, since tissue specimens are usually considered “health care information” or “patient information.” This is true even though specimens (like X rays, radiographic films, tracings, etc.) were not traditionally considered part of the medical record. In certain states, the definition of health care information specifically references tissue samples as part of health information. For example, North Dakota has one of the broadest definitions of protected health information, including the following definition of identifiable medical, genetic, or demographic information:
“Any fluid or tissue samples collected from an individual, diagnostic and test results, whether oral or recorded in any form or medium, which…relates to the past, present, or future physical or mental health or condition of an individual, including individual cells and their components; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and (2)(a) Identifies an individual; or (b) With respect to which there is a reasonable basis to believe that the information can be used to identify an individual.”
While state laws often restrict the use of medical or health information, exceptions to the rules against disclosure are commonly made for releases of information to law enforcement authorities for determination of paternity, or to scientists for research purposes. These “research exceptions” often permit disclosures of health information, and even genetic information,17 without the requirement to obtain individual permission when the data are anonymous, when the patient is not identified, or when an IRB has approved the research.
The exceptions are common, but they are not identical or uniform. More than half of the states have research exceptions in their medical records laws permitting disclosures to scientific researchers without specific individual consent under certain conditions.18 The conditions differ from state to state; however, they all reflect the underlying notion that if individual privacy is protected, the use of tissue samples by researchers is valid and ethical.19
Alaska uses a common method of prohibiting most disclosures of health information, while permitting disclosures for research when patient privacy is protected:
“For research that is subject to federal law and regulations protecting the rights and welfare of research participants; or (B) using health information that protects the confidentiality of participants by coding or encryption of information that would otherwise identify the patient.”
At the other end of the spectrum, a few states (e.g., Vermont), have enacted patients’ rights laws requiring informed consent and notice when hospital patients are also subjects of human research studies. Others, like Maryland,20 Oregon,21 and Minnesota,22 specify the form and content of the patient authorization required for disclosure of health information. Minnesota imposes perhaps the strictest restrictions on disclosures, establishing an elaborate mechanism for releases of patient information, even for research purposes. Minnesota law states that health records may be released to an external researcher solely for purposes of medical or scientific research, and only as follows:
“(1) Health records generated before January 1, 1997, may be released if the patient has not objected or does not elect to object after that date; (2) for health records generated on or after January 1, 1997, the provider must: (i) disclose in writing to patients currently being treated by the provider that health records, regardless of when generated, may be released and that the patient may object, in which case the records will not be released; and (ii) use reasonable efforts to obtain the patient’s written general authorization that describes the release of records in item (i), which does not expire but may be revoked or limited in writing at any time by the patient or the patient’s authorized representative.23”
Connecticut passed a highly detailed statute pertaining to veterans’ health information and access to clinical health care information that specifies the process for requesting, providing, examining, and retaining tissue slides and pathology blocks. Connecticut law requires that patients or their designated health provider have the right to examine slides with their retained tissue, and specifies procedures for requesting, safeguarding, cutting, and returning tissue slides.24
