Daniel Schulte discusses consent to view a patient’s health information from other providers when using shared software platforms for The Journal of the Michigan Dental Association (June 2023).
Question: Our eScribe software allows us to access a patient’s prescription history. We are able to see what medications have been prescribed by other health care providers. MAPS also allows us to do this. When requesting prescription information on eScribe a disclosure now comes up stating “By requesting this patient’s prescription history, you confirm that you are directly involved in the care of this patient and have received the patient’s consent to view this information.” Do I need to specifically ask for my patient’s consent before viewing their prescription history using eScribe or MAPS?
Answer: Prescriptions are “protected health information” (as defined by HIPAA). HIPAA therefore governs the use and disclosure of this information. Generally, HIPAA allows use and disclosure of protected health information by a “covered entity” to other covered entities for “treatment, payment and healthcare operations” purposes. Dentists and other health care providers are covered entities and therefore must comply with HIPAA.
HIPAA further allows disclosures of protected health information by dentists and other covered entities to “business associates.” Business associates are entities that utilize protected health information in connection with the goods and services they provide but do not meet HIPAA’s definition of covered entities and therefore are not subject to HIPAA. Covered entities disclosing protected health information to business associates are required to enter into a business associate agreement with them. That agreement contractually makes many of HIPAA’s requirements applicable to the business associate. eScribe and other e-prescribing platforms are business associates.
It should also be mentioned here that the storage and transmission of this electronic protected health information is subject to various other HIPAA security and other rules applicable to the prescribers, eScribe, and your practice. A discussion of those transmission and storage rules is beyond the scope of this column.
To definitively answer your question, I would need to know more about how the prescription information you are accessing was obtained by eScribe and the documentation entered in by your practice and eScribe. I am going to make the following assumptions: (1) that all the prescription information eScribe is making available to you was obtained by eScribe in its capacity as a “business associate” of the prescribers; (2) eScribe has a business associate agreement with all these prescribers allowing it to make this information available to you and other health care providers involved in the patient’s care; and (3) there is a business associate agreement in place with your practice and eScribe governing the prescription and other protected health information you disclose to it, if any.
If these assumptions are correct, it appears that eScribe has legally obtained the prescription information and can legally provide access to it to you for your use in treating a patient. It further appears that you may disclose your prescription and other protected health information in accordance with your business associate agreement with eScribe. HIPAA does not require you to obtain specific consent from your patients to either access or disclose this information. The only other source of such a requirement would be your business associate agreement with eScribe. You should carefully review that agreement to determine if there is such a requirement.
The Michigan Automated Prescription System (“MAPS”) is operated by the state of Michigan and was created pursuant to Michigan law. MAPS records and makes available information related to schedule 2 – 5 controlled substances prescribing. The purpose of MAPS is to assist in the prevention of controlled substance abuse by tracking these prescriptions and enabling prescribers to determine when patients are receiving controlled substances from other prescribers. Prescribers are allowed access to this information by Michigan law and there is no requirement to obtain patient consent.
