![[ Visit Client Website ]](images/banner.png)
BACKGROUND: Review of patient medical records is an important and well-established component of public health (PH) investigations. State and federal regulations authorize PH authorities’ access to protected health information to investigate and control potential PH threats. As part of an outbreak investigation of nosocomial hepatitis C virus centered at a local hospital, the New Hampshire (NH) Department of Health and Human Services conducted electronic medical record (EMR) review.
METHODS: For patients potentially related to the outbreak, PH identified 549 variables as relevant to define the extent of the outbreak, identify and test exposed persons, and determine the outbreak’s source to prevent additional infections. EMRs for these patients were systematically reviewed on-site at the hospital by trained and supervised PH epidemiologists and nurses. Relevant data were extracted and entered into a secure, electronic database.
RESULTS: From May 31 – July 27, 2012, on-site EMR reviews were conducted on ten dates with review of 135 patient records. In August, the hospital refused to provide continued access to medical records by PH staff and eventually filed petition for a protective order on August 29. The hospital’s two primary arguments were that PH’s access to the entire EMR was inconsistent with statutory obligations to obtain the minimum amount of information necessary, and violated various privacy laws. Following a hearing in superior court and submission of supplemental briefs, the judge denied the hospital’s request for protective order on October 31 and affirmed PH authority to review and access entire medical records as necessary during this investigation. Additional EMR reviews ensued, which allowed PH to identify infected patients and ensure there were no other hospital units, and therefore patients, affected by the outbreak.
CONCLUSIONS: NH PH’s authority to review medical records was challenged in an unprecedented court case that delayed effective outbreak investigation for three months. While patient privacy rights are well-protected under current law, these rights must be balanced with the societal interest in disclosure of health information used to protect patients and prevent the spread of disease. Rather than risking delay in outbreak investigation such as occurred in NH, PH jurisdictions should review local laws and regulations prior to events, strengthen statutory language if needed, and foster common understandings of this authority and roles among PH partners.