Medical records contain many private details about our lives, most importantly about our health, but also usually our address, contact information, and often our Social Security Number. To protect the privacy of patients, federal and state laws on medical records have been developed. The main federal law on this issue is HIPAA (Health Insurance Portability and Accountability Act). If you’ve been to a doctor’s office recently, you may recall receiving a HIPAA notice and the receptionist or medical assistant required you sign an acknowledgment that you received the notice.
Exceptions to Medical Records Privacy in Iowa
Generally, your health care providers can’t release your records to anyone, but you can authorize others, such as for your personal injury attorney or spouse to receive a copy of the records. To provide permission to view your private medical records, you will need to sign a HIPAA-compliant release of health care information authorization form. To participate in a research study, you will likely have to sign some medical waiver forms. Medical records can be released for a limited number of other reasons. For example, public health officials must track communicable diseases, like HIV/AIDS or tuberculosis, however, no more information than necessary can be released. Also, parents typically can review their minor children’s medical records as their legal guardian.
The following table details the main medical records privacy laws in Iowa.
| Code Sections | Iowa Code Sections 139A.3 – Reports to Health Department, Immunity, and Confidentiality 141A.9 – Confidentiality of Information 217.30 – Confidentiality of Records |
| Who Has Access to Records? | Medical and psychiatric records held by Department of Human Services are confidential and may only be distributed to other agencies in the course of official business or certain data may be shared with researchers for statistical purposes so long as no patient’s identity is disclosed. |
| Penalty | Violating the confidentiality of Department of Human Services records is a serious misdemeanor that can be penalized by up to one year in jail and a $315 to $1,875 fine. Public employees who share these confidential records can be suspended without pay. |
| What Privileges Apply to Medical Records? | Doctor-patient (includes surgeons, physician assistants, and ARNPs) and mental health professional-patient privileges apply to the release of medical records. This means your health care providers can’t testify or disclose confidential communications they received in their professional capacity. However, if the health care professional is being sued by the patient for their professional activities, they can share confidential communications or medical records that relate to the lawsuit. |
| Mandatory Reporting Requirements | Confidential reports of sexually transmitted diseases or infections, including the identity of the infected persons, must be filed with the Public Health Department. However, this can’t be accessible to the public. Note that the Department of Public Health can designate diseases as reportable as needed. |
| Patient Consent and Waiver | Patients have to supply a waiver or authorization form to consent to the release of their medical records, such as when required to apply for armed forces or peace corps service. |
| Provisions Related to HIV/AIDS | All reports and information related to HIV status and tests are strictly confidential medical information. However, the information can be released by in certain circumstances, such as to a sexual assault victim, employees of a correctional facility, for epidemiological research (without identifying information), or by court order for another compelling reason. |
If you have reason to believe that your medical records were disclosed without your consent, you should contact the health care provider who leaked them to request your records are returned to you and that any unauthorized copies are destroyed. You can also contact an experienced Iowa health care lawyer about your other legal options, such as suing for any negative outcomes from the unlawful sharing of your medical records. If the records were Department of Human Services records, you can sue for actual damages or losses, court costs, attorney fees, and the minimum award, if you win, is $100.
Note: State laws are revised regularly, so it’s best to contact an attorney or conduct your own legal research to verify these and other medical records laws.
Research the Law
Related Resources
