Law / United States / 
Indiana
Health records: a provider's duty to protect the confidentiality of records it uses and discloses
In force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Disclosure
- Audit expectation
- none
As of .
What it requires
- If you are a provider using a patient's original health record for a legitimate business purpose without specific written authorization, protect the confidentiality of the record at all times and disclose the patient's identity only when disclosure is essential to your business use or to quality assurance and peer review (Ind. Code 16-39-5-3(c) and (d)).
- If you disclose a health record to another provider or to a nonprofit research organization for a scientific, statistical or educational project, make sure each party that receives information protects the confidentiality of the record and does not disclose the patient's identity except as the article allows (16-39-5-3(e)).
- Disclose a patient's identity to the Indiana hospital trade association for a data aggregation project only when the disclosure is essential to the project (16-39-5-3(f)).
These lines are LexLint's reading of the law's text, as of .
What this law does
Section 3(c) of IC 16-39-5 provides that the original health record of the patient is the property of the provider and may be used by the provider without specific written authorization for legitimate business purposes, including claims, collection of accounts, litigation defense, quality assurance, peer review, and scientific, statistical and educational purposes.
Section 3(d) of IC 16-39-5 requires a provider to protect the confidentiality of the health record at all times in a use under subsection (c), and permits disclosure of the patient's identity only when disclosure is essential to the provider's business use or to quality assurance and peer review.
Section 3(e) of IC 16-39-5 lets a provider or the Indiana archives and records administration disclose a health record to another provider or to a nonprofit research organization for a scientific, statistical or educational project, and requires each party that receives information to protect the confidentiality of the record and not to disclose the patient's identity except as the article allows.
Section 3(f) of IC 16-39-5 lets a provider disclose a health record to an Indiana hospital trade association for a data aggregation project, and permits disclosure of a patient's identity to the association only when the disclosure is essential to the project. Section 3(j) of IC 16-39-5 makes a person who recklessly violates or fails to comply with subsections (e) through (h) guilty of a Class C infraction, with each day a violation continues a separate offense.
When LexLint raises it
When your app profile says your app handles health records.