“I represent your resident and I want a copy of her medical records.” If you work in a nursing facility or assisted living community and you’ve never heard these words, something’s seriously wrong with your ears. About once a week, I get a call from a provider asking for guidance on these types of requests, often from lawyers but not always.

Here’s what creates the issue – most of you know that under the Omnibus Budget Reconciliation Act (OBRA) regulations for nursing facilities, and state licensure law for both SNFs and assisted living communities, residents have a right to see and obtain a copy of their medical records. But you also know that HIPAA precludes or restricts the disclosure of residents’ protected health information (PHI), which includes virtually anything in a medical record, except in very limited situations. And where HIPAA does permit a disclosure, it requires an array of procedures designed to limit the information disclosed to the minimum necessary under that particular HIPAA exception.

So you get a letter from a lawyer or some family member demanding a copy of the resident’s record and your HIPAA alarm goes off immediately. Ah, we’ve trained you well, but now what?