Medical Records Ownership and the Information Blocking Rules

Patients may think they own their medical records. While patients certainly have the right to access and, in many cases, control how their health information is used and disclosed, medical records ownership can be murky. Often, a conflict arises over the ownership of medical records and the rights and responsibilities of physicians and group practices or other facilities with regard to such records. This issue especially occurs when a physician separates from a medical practice. Unless the issue is addressed by state law or an employment contract or another agreement, some group practices are reluctant to share medical records with the departing physician.

Under Florida law, a healthcare practitioner who generates a medical record after making a physical or mental examination of, or administering treatment or dispensing legend drugs to, any person is considered the "records owner."¹ A healthcare practitioner's employer may be considered the records owner if the employment contract or agreement between the employer and the healthcare practitioner designates the employer as the records owner.² If no agreement designates the employer as the records owner, then by law the employed physician is deemed the records owner.³ Therefore, when an employed physician who is considered the records owner leaves a group practice, the physician is entitled to obtain copies of such medical records. Even where an employer is considered the records owner in the employer-physician employee relationship, Florida law requires the employer to release certain records to the healthcare practitioner. Specifically, the employer must release to the former employed physician those records that such physician actually created or generated when providing treatment to a patient during the course of their employment.⁴ However, the employer is only required to release upon the former employee's request for the notes, plans of care, and orders and summaries that were actually generated by the former employee.⁵

While Florida law provides direction as to the ownership of medical records and the obligations to share certain records once an employed physician leaves a group practice, the laws vary in other states and several do not have a provision that governs the ownership of medical records.⁶ Thus, in those states where the law is silent, this may lead to disagreement regarding the access to – and release of – the medical records to physicians when leaving a group practice. But new federal regulations prohibiting "information blocking" may make ownership of medical records less important as it relates to granting requests to access medical records in electronic form.

The Information Blocking Rule promulgated by the Office of the National Coordinator for Health Information Technology (ONC), implemented provisions of the 21st Century Cures Act (Cures Act) is designed to prohibit information blocking and to foster the interoperable exchange of health information between stakeholders.⁷ The Rule prohibits healthcare providers from engaging in any practice that is likely to prevent, interfere with or materially discourage access to, use or exchange of electronic health information (EHI), where the provider knows that such practice is unreasonable and is likely to interfere with, prevent or materially discourage access, exchange or use of the information.⁸ For purposes of the Rule, a "health care provider" includes a group practice, a physician, a practitioner and any other category of a healthcare facility, entity, practitioner or clinician determined by the secretary of the U.S. Department of Health and Human Services (HHS).⁹ A "physician" is defined to include, among other types of professionals, a doctor of medicine or osteopathy.¹⁰ An individual physician, as well as a group practice or other facility, is subject to the Information Blocking provisions. Therefore, regardless of who has ownership of the medical records, the Rule will likely prevent a group practice from denying or unreasonably delaying the release of EHI to a physician when he or she separates from the practice where the physician needs the records for treatment or payment purposes, or for certain healthcare operations activities.¹¹

The Information Blocking Rule may be implicated where an actor engages in a practice that imposes terms or conditions that are objectively unreasonable and, therefore, they amount to a refusal to provide access.¹² Also, the provisions may be implicated where an actor imposes onerous additional privacy requirements for access, exchange or use of EHI beyond what is required by law.¹³ For example, if a physician who separates from a group practice makes a request for copies the EHI of a patient and the disclosure is permitted under the Health Insurance Portability and Accountability Act (HIPAA) and state law, a group practice would be required to comply with the request and disclose the information.¹⁴ Under such circumstances, the group practice would not be permitted to impose additional privacy requirements or require the physician to agree to certain conditions beyond what is required by law before granting the access. Such a policy would likely constitute information blocking under the Rule unless the group practice can demonstrate the practice comes within one of the Rule's exceptions.

A healthcare provider's practice or policy will not be considered as information blocking if it falls within one of the eight exceptions under the Rule: 1) Preventing Harm, 2) Privacy, 3) Security, 4) Infeasibility, 5) Health IT Performance, 6) Content and Manner, 7) Fees and 8) Licensing.¹⁵ These exceptions fall into two categories with the first five being applicable to circumstances where the actor does not fulfill the request for access, exchange or use of EHI, and the last three involving procedures for fulfilling such requests. An actor must meet all of the conditions of a particular exception in order to come within the exception. However, the failure to meet conditions of an exception will not automatically constitute information blocking. Instead such practices will be evaluated on a case-by-case basis to determine whether information blocking has occurred.¹⁶

Physicians and group practices will need to become compliant with the Information Blocking Rule and their obligations thereunder. Providers should also review and adjust their policies and applicable contractual agreements that govern the right of access to patient medical records. Although the potential penalties for healthcare providers who engage in information blocking are not clear at this time, the secretary of the HHS is authorized to impose appropriate disincentives for violations of the Rule.

¹ Section 456.057(1), Fla. Stat.

² Id.

³ Pain Care First of Orlando, LLC v. Edwards, M.D., 84 So.3d 351 (Fla. 5th DCA 2012).

⁴ Section 456.057(19), Fla. Stat.

⁵ Id.

⁶ Health Information & the Law. Who Owns Medical Records: 50 State Comparison.

⁷ 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program, 85 Fed. Reg. 25642 (May 1, 2020), now codified at 45 C.F.R. Part 171.

⁸ 45 C.F.R. § 171.103.

⁹ 42 U.S.C. § 300jj(3).

¹⁰ 42 U.S.C. § 1395x(r).

¹¹ Prior to Oct. 6, 2022, EHI is limited to data elements represented in the United States Core Data for Interoperability (USCDI). On or after Oct. 6, 2022, the Information Blocking Rule will apply to EHI to the extent it would be included in a designated record set as defined under HIPAA.

¹² 85 Fed. Reg. 25642, 25811 (May 1, 2020).

¹³ Id. at 25850.

¹⁴ "If an actor is permitted to provide access, exchange, or use of EHI under the HIPAA Privacy Rule (or any other law), then the information blocking provision would require that the actor provide that access, exchange, or use of EHI so long as the actor is not prohibited by law from doing so (assuming that no exception is available to the actor)." 85 Fed. Reg. 25812.

¹⁵ 45 C.F.R. §§ 171.201-205 and 171.301-303.

¹⁶ 85 Fed. Reg. 25820.