HIPAA Access Reports Could Aid Malpractice Attorneys

The right to request an "access report" as outlined in the Office for Civil Rights' proposed HIPAA accounting of disclosures rule could be an asset to attorneys in HIPAA civil suits and malpractice cases, privacy experts say.

Under the  proposed accounting of disclosures rule, "patients could request an accounting of who accessed their electronic health information in a designated record set, for any reason. It covers both uses and disclosures.

The proposed rule could help the case of a malpractice and other lawyers , says Jeff Drummond, health law partner in the Dallas office of Jackson Walker LLP and author of HIPAA Blog.

"And it doesn't even have to be a HIPAA or data breach or confidentiality case," Drummond says. "In a medical malpractice case, the plaintiff's lawyer can say, 'X looked at the file and didn't say anything.' "

Through the new provision, patients would be able to obtain access reports for the purpose of sharing the report with their malpractice attorneys.

"In practice, I think that these reports will be useful to malpractice attorneys, but not necessarily serve as a smoking gun," said Adam Greene, JD, MPH, a lawyer in the Washington, DC, office of Davis Wright Tremaine LLP. Greene is a  former OCR senior health information technology and privacy specialist. "This is because the access report will not provide the purpose of the access; so much of the access that a malpractice attorney suspects to be impermissible may prove to be for a valid purpose, such as for a valid administrative or quality improvement purpose."