Question: We received a request for medical records from an attorney who says he is representing one of our former patients in a criminal matter. He included the patient’s signed authorization for the release of the records. What’s unusual is that he is requesting records not only for the patient but also records filed under an alias that the patient alleges to have been using at times. The patient signed the authorization form with his real name and with his alleged alias. Should we release the records?

Answer: Federal law (HIPAA) requires that covered entities verify the identity of an entity or individual requesting protected health information and the authority of that entity/person to have access to that information. 45 C.F.R. §164.514(h)(1).

A person who claims to have used an alias to obtain medical treatment will not, in most circumstances, be able to verify that he or she is – in fact – the person who received treatment under that name. Often, the person will have no government-issued identification with the relevant name. And even if he or she did, since the person has already admitted that the identity is a fraud, you would be unwise to trust it.

Also problematic is the fact that if the person has been using the identity of an existing patient, you could be releasing medical records not only for the requestor, but also for the individual whose identity he or she has stolen.

For these reasons, we recommend that you do not release records filed under the alias without a court order or other lawful process.

Though not directly responsive to your question, we also advise that you take this opportunity to evaluate the medical record filed under the alias’ identity. If it appears that different individuals have been using that identity, you will want to put red flags in the file. This way, if anyone seeks treatment under that name in the future, the hospital will be tipped off immediately to the potential for fraud and the care provider will know that the medical record includes discrepancies. Also take this opportunity to identify and contact any payors who may have been billed for services provided to the individual using an alias. Repayment of those amounts may be required. Lastly, unless the patient is clearly insolvent, consider filing suit against the patient for theft of services.