Question:

An adult patient recently requested a copy of her birth records. She was adopted as an infant and her birth records, while still maintained by the hospital, include information about her birth mother.  Should we release the records?  If so, should we redact information about the birth mother?

Answer:

The federal Health Insurance Portability and Accountability Act (“HIPAA”) privacy regulations require covered entities (including hospitals) to provide patients with access to their protected health information in a designated record set.  45 C.F.R. §164.524(a).  This includes a copy of any medical record that is used to record and make decisions about the patient’s care.  In the case of an infant, the birth record would be included.

There are exceptions to patients’ right of access under HIPAA.  One of those exceptions applies when the information to be disclosed could harm the person mentioned in the record. Specifically, the HIPAA regulations provide:

Reviewable grounds for denial.  A covered entity may deny an individual access, provided that the individual is given a right to have such denials reviewed, as required by paragraph (a)(4) of this section, in the following circumstances:

 ***

(ii) The protected health information makes reference to another person (unless such other person is a health care provider) and a licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to cause substantial harm to such other person;

45 C.F.R. §164.524(a)(3).

In the case of parents who relinquish custody of an infant for adoption purposes, it is well within a licensed health care professional’s (e.g., social workers, CMOs, nursing supervisors) discretion to determine that access by the now-grown infant is reasonably likely to cause harm (e.g., mental anguish, anxiety) to the relinquishing parents.  In reaching that conclusion, the health care professional could point to the state’s adoption procedures.  Most states have detailed statutes and regulations that outline the procedures that courts and adoption agencies must follow when managing adoption records.  The obvious intent of those laws is to protect adopted children and relinquishing parents from discovering each other’s identities without mutual consent.

Note that if access to the birth records is denied by the hospital pursuant to the HIPAA regulations’ exception at 45 C.F.R. §164.524(a)(3), the hospital must:

• Give the adopted individual a copy of any information in the record that is not likely to harm the birth parents (probably, a copy of the entire record with all identifying information about the parents removed).  45 C.F.R. 164.524(d)(1).
• Provide a timely, written denial to the individual, including the basis for the denial, a statement of the individual’s right to request review, an explanation of how the individual can exercise that right, and a description of how the individual can complain to the hospital (including the name or title and telephone number of the contact person) or to the Secretary of the Department of Health and Human Services. 45 C.F.R. 164.524(d)(2).
• If the patient appeals the denial, the hospital must appoint a licensed health care professional who was not involved in the original decision to deny access to review the request for access.  The hospital must then promptly inform the patient of the reviewing professional’s decision and take other action as required to carry out the reviewing professional’s decision.  45 C.F.R. 164.524(d)(4).

Finally, though it is not legally required, if you intend to deny access to a birth record, consider referring the requestor to the local courts or child welfare agency to obtain more information about lawfully obtaining the identity of the birth parents.  Many states have amended their adoption procedures in recent years to provide a process for adoptees or birth parents to seek each other’s consent to share their identities and contact information.