Q&A: Disclosing PHI in the courtroom

Q: Is a covered entity permitted to disclose PHI for litigation purposes? For example, if a covered entity is being sued for malpractice, can it present information that would qualify as PHI during the trial? If so, what are the limits on the type of information it can disclose?

A: If a covered entity is a party to a legal proceeding, such as a plaintiff or defendant, the covered entity may use or disclose PHI for purposes of the litigation as part of its healthcare operations. The covered entity, however, must make reasonable efforts to limit such uses and disclosures to the minimum necessary to accomplish the intended purpose. (See 45 CFR 164.502(b), 164.514(d).)

If the covered entity is not a party to the proceeding, the covered entity may disclose protected health information for the litigation in response to a court order, subpoena, discovery request, or other lawful process, provided the applicable requirements of 45 CFR 164.512(e) for disclosures for judicial and administrative proceedings are met.

Editor's note: Mary D. Brandt, MBA, RHIA, CHE, CHPS is a healthcare consultant specializing in healthcare regulatory compliance and operations improvement. She is also an advisory board member for BOH. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Opinions expressed are those of the author and do not represent HCPro or ACDIS. Email your HIPAA questions to editor Kevin Duffy at kduffy@hcpro.com.