When can spouses access health records?

HIPAA defines a spouse as any individual in a lawful marriage. The concept of lawful marriage includes marriages sanctioned by states, territories, or foreign jurisdictions as long as they are recognized by U.S. law. While HIPAA recognizes spouses as individuals who can access protected health information under certain circumstances, being a spouse does not automatically confer personal representative status. This means that the spouse cannot make healthcare decisions on behalf of the other. Therefore even though a spouse is recognized for certain disclosures of protected health information (PHI), they may not have unrestricted access to all health records without proper patient authorization.

The circumstances under which spouses can access each other PHI

1. A spouse can access PHI if the patient has provided explicit consent. This typically involves the patient signing a release form that authorizes the healthcare provider to share specific health information with their spouse.
2. Healthcare providers are permitted to disclose PHI to a spouse who is involved in the patient's care. It includes sharing information relevant to treatment, payment, or coordination of care, as long as the disclosure is directly related to the spouse's involvement in the patient's healthcare decisions.
3. In emergencies where the patient is unable to provide consent due to incapacitation, healthcare providers may disclose relevant PHI to a spouse if it is deemed to be in the best interest of the patient.
4. If a state law recognizes spouses as personal representatives for healthcare decisions, they can access PHI without additional consent. The legal status allows spouses to make healthcare decisions on behalf of one another and access all related medical records.
5. Healthcare providers can share information about a patient's location, general condition, or death with a spouse without needing prior consent, as this information is deemed essential for family members.
6. If a patient is present and capable of making healthcare decisions, providers can discuss health information with a spouse if the patient agrees or does not object when given the opportunity.

The implications of state laws on a spouse's ability to access PHI

According to the HHS guidance on HIPAA and marriages, “Under the Privacy Rule, if a state provides legally married spouses with health care decision-making authority on behalf of one another, a covered entity is required to recognize the lawful spouse of an individual as the individual’s representative without regard to the sex of the spouses.” HIPAA provides the federal provision for disclosures of PHI in any instance including to spouses. The implementation of the provision however is still influenced by state laws regarding marital rights and healthcare decision-making authority. For example, if a state recognizes spouses as personal representatives with the authority to make decisions on behalf of one another, healthcare providers have to respect this when disclosing PHI. 

Examples of state laws include: 

• In California, the Health and Safety Code allows spouses to access each other's medical records without needing explicit consent if they are involved in the patient's care. The law recognizes spouses as personal representatives, thus enabling them to make healthcare decisions on behalf of one another.
• Florida law provides that a spouse has the right to access their partner's medical records if they have been designated as a personal representative through a durable power of attorney for healthcare. Without it, the spouse may face challenges in obtaining PHI without explicit consent from the patient.
• In New York, spouses are recognized as personal representatives under the state's Public Health Law, allowing them to access medical records without requiring additional consent, provided they are involved in the patient's healthcare decisions. If a patient is incapacitated, the spouse must have legal authority, such as a healthcare proxy, to access PHI.
• Texas law allows spouses to access each other's health information if they are designated as personal representatives. If there is no advance directive or power of attorney in place, the spouse may need explicit consent from the patient to obtain PHI.
• In Illinois, spouses have the right to access each other's medical records if they are legally married and if one spouse has designated the other as an agent under a healthcare power of attorney. Without it, access may be limited and require patient consent.

Related: HIPAA Compliant Email: The Definitive Guide

FAQs

Are there any limitations or exceptions to a spouse's access to health records under HIPAA?

Yes, when a patient has not provided consent, is incapacitated without prior authorization, or if the information falls under specific exceptions like psychotherapy notes.

How does the HIPAA Privacy Rule protect against unauthorized disclosures of PHI to spouses or family members?

The HIPAA Privacy Rule requires healthcare providers to obtain patient consent before disclosing PHI to spouses or family members. 

What steps should couples take to ensure that both partners have access to each other's health information?

Couples should establish clear communication with their healthcare providers, and complete a HIPAA Release form designating each other as personal representatives.