Skip to Content

Privacy and Confidentiality in Indiana

The State of Indiana requires all health providers to maintain the privacy and confidentiality of patients’ medical information.  In order to release a patient’s health record, the provider must obtain written consent from the patient.1 However, providers may share patient information with one another without consent for the purposes of providing treatment to the patient.2  Additionally, a person who is authorized to consent for a patient is also authorized to receive health care information on behalf of the patient.3  Health information may also be disclosed to a law enforcement official for the purposes of identifying or locating a missing person.4 An accident and sickness insurance company may obtain a patient’s health information with written consent. However, a copy of health records obtained by the insurance company must be furnished to the patient upon request.5

The law requires that all Medicaid and CHIP applications, investigation reports, information and records be kept confidential.  Additionally, information obtained by a health provider regarding an individual's eligibility for Medicaid is confidential and may not be disclosed to any person.6  However, general information may be released in order to develop the Medicaid program and CHIP.7  In fact, the law requires that Medicaid participating providers fully disclose Medicaid records to the Office of Medicaid Policy and Planning if requested.8

There are also specific laws that govern the confidentiality of information before a peer review committee.  The law requires that all peer review information, communications and proceedings be kept confidential.9   Furthermore, any person attending a peer review hearing is also required to maintain the confidentiality of the peer review information.10  The law provides exceptions to the general rule of confidentiality, by permitting a peer review committee to disclose records and information to the patient safety agency.11  Additionally, peer review information that is otherwise discoverable or admissible from original sources is not immune from use in judicial proceedings.12  The law provides that a peer review committee of one institution is permitted to disclose records to the peer review committees of other health care entities, such as hospitals or health plans, to the disciplinary authority of the professional board, and to the state board of registration, to be used for a legitimate business purpose.13

 

The law maintains that all information and records obtained by the state for use in the registry must also be kept confidential.14  The law, however, does allow release of summary statistics as long as the summary does not reveal the identity of the individuals.15   All information relating to causes of death is confidential and may be used only for research and education, or for the improvement of the quality of medical care.16

The state protects many other aspects of health information as well.  Any health information that is exchanged as part of Indiana’s statewide health information exchange network is subject to the federal Health Information Portability and Accountability Act (HIPAA).17  There is much protection given to the confidentiality of a patient’s identity.  To that end, Indiana prohibits health care entities from disclosing patient identifying information, in the case of hospital medical staff reports or hospital fiscal or patient information reports.18

 

Footnotes

  • 1. Ind. Code § 16-39-1-4
  • 2. Ind. Code § 16-39-5-1
  • 3. Ind. Code §16-36-11-1
  • 4. Ind. Code § 16-39-10-4
  • 5. Ind. Code § 16-39-5-2
  • 6. Ind. Code §12-15-27; Ind. Code §12-17.6-9-2
  • 7. Ind. Code § 12-17.6-9-3 ; Ind. Code § 12-15-27
  • 8. 405 Ind. Admin. Code 1-5-2
  • 9. Ind. Code §34-30-15-1
  • 10. Ind. Code §34-30-15-2
  • 11. Ind. Code §34-30-15-1
  • 12. Ind. Code §34-30-15-3
  • 13. Ind. Code §34-30-15-8; Ind. Code §34-30-15-21
  • 14. Ind. Code § 16-38-6-1
  • 15. Ind. Code § 16-38-5
  • 16. Ind. Code § 16-37-3
  • 17. Ind. Code §5-31-6-3
  • 18. Ind. Code §16-39-6-5; Ind. Code §16-21-6-7

 

Privacy and Confidentiality in Indiana

Subtopic Statute/Regulation Description
Disclosure of medical information for research purposes (Cross reference Research) Hospital Medical Staff Access to Records – Ind. Code Ann.§ 16-39-6-1 Hospital Medical Staff Access to Records The state of Indiana finds it in the public interest to give hospital medical staff committees access to...
Requirements for Ability to Make Health Care Decisions – Ind. Code Ann.§ 16-36-1-4 An individual may consent to health care or treatment unless the health care provider finds that the person is incapable of making a health care...
Requirements for Disclosure of Medical Information to Individuals Authorized to Consent – Ind. Code Ann.§ 16-36-1-11 A person who is authorized to consent for another individual has the same rights of receiving health care information and consenting to the release...
Confidentiality of substance abuse records Confidentiality and Disclosure Requirements for Alcohol and Drug Abuse Records – Ind. Code Ann. § 16-39-1-9 All substance abuse treatment records are confidential and may only be disclosed as permitted by Part 2.
Privacy and Confidentiality Confidentiality Requirements for CHIP Eligibility Information Obtained by Providers – Ind. Code Ann.§ 12-17.6-9-7 Any CHIP eligibility information obtained by a provider on an individual must remain confidential and cannot be disclosed. Related Laws: Ind. Code...
Confidentiality Requirements for General Information Under the CHIP Program – Ind. Code Ann.§ 12-17.6-9-2 The following information concerning CHIP applicants and recipients under the CHIP program are confidential: Applications Investigation...
Ind. Code Ann. § 12-11-13-10 - Statewide waiver ombudsman maintaining confidentiality and providing coordination The statewide waiver ombudsman receives, investigates and attempts to resolve complaints made by individuals with developmental disabilities who...
Ind. Code Ann. § 12-11-13-9 - Agency providing access to relevant records to statewide waiver ombudsman The statewide waiver ombudsman receives, investigates and attempts to resolve complaints made by individuals with developmental disabilities who...
Ind. Code Ann. § 12-12-9-3 - Confidentiality of reports on blind or visually impaired persons This law requires that all reports made on blind or visually impaired persons to the office of the secretary be kept confidential and allows use of...
Ind. Code Ann. § 16-19-10-6 - Confidentiality of State Health Department Surveys This law allows the state department of health to conduct surveys about the health of Indiana residents and to monitor the department’s...
Ind. Code Ann. § 16-19-10-7 - Disclosure and Consent for Epidemiological Information This law requires that released public health surveillances, public health investigations and epidemiological investigations protect the identities...
Ind. Code Ann. § 16-38-4-12 - Requests for additional information from the birth problems registry This law allows researchers to use the names of individual patients when requesting additional information for state purposes as long as they get the...
Ind. Code Ann. § 16-38-4-13 - Release of confidential information from the birth problems registry This law allows the state department of health to release individual patient’s confidential information to other states’ birth problems...
Ind. Code Ann. § 16-38-4-9 - Confidentiality of information in birth problems registry This law requires that certified nurse midwives, certified direct entry midwives, hospitals, physicians, local health departments, and other health...
Ind. Code Ann. § 16-39-2-10 - Decedent’s mental health records; consent to release This law allows a deceased patient’s personal representative to consent to the release of the deceased patient’s mental health record,...
Ind. Code Ann. § 16-39-2-3 - Confidentiality of mental health records This law states that mental health records are confidential and can only be disclosed with the patient’s consent.
Ind. Code Ann. § 16-39-2-5 - Access to mental health records by patient’s designee or legal representative This law allows private and public mental health care providers to give access to a patient’s mental health record to an individual or...
Ind. Code Ann. § 16-39-2-6 - Disclosure of mental health records without the patient's consent This law allows a patient’s mental health records to be disclosed without the patient’s consent, when the disclosure is being made:...
Ind. Code Ann. § 16-39-2-8 - Court ordered release of mental health records This law allows a court to order the release of patient’s mental health records without the patient’s consent as long as there is a...
Ind. Code Ann. § 16-39-3-10 - Confidentiality of court record containing evidence of mental health records This law requires that any court admitting into evidence in a legal proceeding a patient’s mental health record or testimony about patient...
Ind. Code Ann. § 16-39-3-3 - Petition for release of patient’s mental health records This law allows a person to petition in a circuit or superior court requesting the release of a patient’s mental health record, as long as the...
Ind. Code Ann. § 16-39-3-6 - Confidential hearing record for hearing on release of mental health records This law requires that the hearing record for a hearing on the release of a patient’s mental health record without the patient’s consent...
Ind. Code Ann. § 16-39-3-7 - Release of mental health records in investigations and legal proceedings This law allows a court to order the release of a patient’s mental health record in an investigation or legal proceeding without the patient...
Ind. Code Ann. § 16-39-3-8 - Child in need of services; petition for emergency hearing on request for mental health records of parent, guardian, or custodian This law allows the department of child services to file a verified petition seeking access to the mental health records of a parent/guardian/...
Ind. Code Ann. § 16-39-3-9 - Requisites for a court order authorizing release of records This law requires that whenever a court authorizes the release of a patient’s mental health record, the court must limit disclosure to only the...
Ind. Code Ann. § 16-39-4-2 - "Primary caregiver"; written request from relative or guardian for information; provision of mental health records to a school This law allows a provider to give access to a patient’s mental health records to a patient’s spouse/parent/adult child/sibling/guardian...
Ind. Code Ann. § 16-39-4-3 - Confidentiality of child mental health records provided to school principal This law specifies what information a provider must disclose once s/he receives a written request from a parent/guardian to disclose a child’s...
Ind. Code Ann. § 16-39-4-5 - Disclosure of information from mental health records to insurer This law states that when a patient consents in writing to the release of his/her mental health records to a health insurer covering the patient, the...
Ind. Code Ann. § 16-39-6-2 - Right of hospital to provide records to medical staff committee In order to allow medical staff committees to evaluate the care and treatment of patients, the law allows hospitals or employees of hospitals to...
Ind. Code Ann. § 16-39-6-4 - Use or publication of obtained information from hospital medical records by hospital medical staff committees This law states that hospital medical staff committees are allowed to use the confidential hospital records made available to them only to evaluate...
Ind. Code Ann. § 16-39-7.1-4 - Court orders regarding access to autopsy records This law allows a court to issue an order authorizing a person to view/copy a photograph or video of an autopsy, and to listen/copy an audio...
Ind. Code Ann. § 16-39-7.1-6 - Violations of law by mishandling of autopsy records This law declares those who commit the following violations guilty of a Class A misdemeanor: A provider who is the custodian of a photograph/...
Ind. Code Ann. § 16-40-1-6 - Confidentiality of reports on persons with disabilities This law requires that all reports made on persons with disabilities be used solely by departments of state government in the performance of duties...
Ind. Code Ann. § 16-40-4-7 - Confidentiality of information collected for health care quality indicator data program This law makes all the information collected through the health care quality indicator data program that can identify an individual confidential, and...
Ind. Code Ann. § 16-41-13-3 - Confidentiality of information about a deceased individual’s communicable disease Attending physicians or health care providers are required to attach to the body of a deceased individual a notice stating “observe bodily...
Ind. Code Ann. § 16-41-14-15 - Confidentiality of information related to testing of semen for communicable diseases This law prohibits a person from disclosing information collected while testing donated semen for communicable diseases, and states that such...
Ind. Code Ann. § 16-41-2-3 - Reporting of HIV/AIDS cases This law requires that every licensed physician/hospital/medical laboratory/department of corrections report each confirmed case of HIV infection and...
Ind. Code Ann. § 16-41-6-4 - HIV testing of newborns This law allows a physician overseeing the care of a newborn infant to order a confidential HIV test on the infant within 48 hours of birth, if the...
Ind. Code Ann. § 16-41-6-9 - Information on confidential part of birth certificate This law states that the state department of health requires that every birth/stillbirth certificate’s confidential portion retained by the...
Ind. Code Ann. § 16-41-9-5 - Detention of and reports on mentally ill or gravely disabled carriers of communicable diseases This law allows a designated health official who determines that a carrier of a dangerous communicable disease is mentally ill/gravely disabled to...
Ind. Code Ann. § 27-13-31-1 - Confidentiality of information obtained by HMOs This law states that any information related to the diagnosis, treatment or health of any enrollee of a health maintenance organization (HMO) that is...
Ind. Code Ann. § 27-13-31-3 - Information and records held by health care review committees that are subject to subpoena or discovery This law states that the information considered by and the records of proceedings held by health care review committees are confidential and cannot...
Limits on Information Available to CHIP Participating Providers – Ind. Code Ann.§ 12-17.6-9-6 While the law grants CHIP participating providers access to participants’ eligibility information, the information that can be released to...
Requirements for the Establishment and Maintenance of a Chronic Disease Registry – Ind. Code Ann.§ 16-38-6-1 For certain chronic diseases, including asthma, diabetes, congestive heart failure, coronary heart disease, hypertension, kidney disease, and other...
“Release of Mental Health Records to Patient and Authorized Persons; Release of Mental Health Records in Investigations and Legal Proceedings” - Ind. Code § 16-39-2-6-1—16-39-3-13 Records and information relating to the mental health of an individual are confidential and privileged to the patient, and may only be disclosed in...
Disclosure of health information pursuant to court order or subpoena Confidentiality Requirements of Records, Proceedings, and Information Reports by a Hospital Staff Committee – Ind. Code Ann.§ 16-39-6-3 Confidentiality Requirements of Records, Proceedings, and Information Reports by a Hospital Staff Committee This regulation states that a hospital...
Requirements for Confidentiality of Proceedings and Use of Otherwise Discoverable Information – Ind. Code Ann.§34-30-15-3 Any information that is otherwise discoverable or admissible from original sources is not automatically immune from use in judicial proceedings due...
Requirements for Disclosure of Medicaid Patient Medical Records – 405 Ind. Admin. Code 1-5-2 Requirements for Disclosure of Medicaid Patient Medical Records All records maintained by Medicaid participating providers must be fully disclosed to...
Requirements for Disclosure of Patient Information to Locate or Identify a Missing Person – Ind. Code Ann.§ 16-39-10-4 A provider or health plan may disclose protected health information to a law enforcement official who requests the protected health information for...
Confidentiality and disclosure requirements of public health reporting information (disease specific information/registry data) (Cross reference to Public Health Reporting) Establishment and Requirements of the Indiana Cancer Registry – Ind. Code Ann. § 16-38-2 The state maintains a cancer registry for the recording of all cases of malignant disease and other tumors and precancerous diseases that are...
Health Maintenance Organization Quality Management Program Requirements – Ind. Code Ann.§ 27-13-6-3 The health maintenance organization’s (HMO) quality management program must include the following: 1.      A written...
Hospital Reporting Requirements for Fiscal and Patient Information – Ind. Code Ann. § 16-21-6-7 Fiscal and patient information reports; personal identification of patients; public inspection; copies Fiscal reports filed by hospitals may not...
Requirements for Access to Autopsy Records by Surviving Family, Government Entities and Other Providers – Ind. Code Ann.§ 16-39-7.1-3 A surviving spouse may view and copy photographs, video recordings, or audio recordings of the deceased spouse’s autopsy.  If there is no...
Requirements for Access, Maintenance, and Requests for Health Records (Excluding Records for Mental Health, Communicable Diseases, and Drug and Alcohol Abuse) – Ind. Code Ann. § 16-39-1-1 This section applies to all health records except mental health records, records regarding communicable diseases, and records pertaining to drug and...
Requirements for Certificates of Birth – Ind. Code Ann. § 16-37-2 A licensed physician, a midwife or a nurse midwife in attendance at a live birth shall file with the local health officer a certificate of birth and...
Requirements for Certificates of Death and Stillbirth – Ind. Code Ann. § 16-37-3 The individual in charge of interment of a stillborn child or dead body must file a certificate of death or of stillborn with the local health...
Requirements for Hospital Patient Information Reports to the State Department of Health – Ind. Code Ann.§ 16-21-6-6 Each hospital must file with the State Department of Health, inpatient and outpatient discharge data reports that include the following information...
Requirements for Maintenance and Confidentiality of Records of Proceedings for Health Maintenance Organizations – Ind. Code Ann.§ 27-13-6-8 A health maintenance organization (HMO) record all proceedings related to quality management activities and maintain the confidentiality of those...
Requirements for Medical Record Maintenance and Administration in Hospitals – 410 Ind. Admin. Code 15-1.5-4 The medical record services has administrative responsibility for the medical records that are maintained for every individual evaluated or treated...
Requirements for the Establishment and Maintenance of an Immunity Data Registry – Ind. Code Ann.§ 16-38-5 The state maintains an immunization data registry to collect, store, analyze, release and report immunization data.  Providers may provide...
Confidentiality of registry data Establishment and Requirements of the Indiana Cancer Registry – Ind. Code Ann. § 16-38-2 The state maintains a cancer registry for the recording of all cases of malignant disease and other tumors and precancerous diseases that are...
Requirements for Certificates of Birth – Ind. Code Ann. § 16-37-2 A licensed physician, a midwife or a nurse midwife in attendance at a live birth shall file with the local health officer a certificate of birth and...
Requirements for Certificates of Death and Stillbirth – Ind. Code Ann. § 16-37-3 The individual in charge of interment of a stillborn child or dead body must file a certificate of death or of stillborn with the local health...
Confidentiality and disclosure requirements of peer review information (Cross reference to Medical Peer Review) Hospital Requirements for the Protection of a Patient’s Identity – Ind. Code Ann. § 16-39-6-5 Hospital medical staff committee reports or publications must not disclose the identity of  a patient.  In fact, the hospital medical staff...
Requirements and Rights for a Health Care Provider Under Investigation – Ind. Code Ann.§34-30-15-4 A health care provider who is under investigation may see peer review records related to the provider’s practice at any time.  The...
Requirements for Confidentiality of Proceedings and Disclosure of Communications, Records and Determinations of a Peer Review Committee – Ind. Code Ann.§34-30-15-8 Requirements for Confidentiality of Proceedings and Disclosure of Communications, Records and Determinations of a Peer Review Committee This...
Requirements for Confidentiality of Proceedings and Matters Allowed to be Disclosed – Ind. Code Ann.§34-30-15-1 All proceedings, communications and records of a peer review committee must be confidential.  However, the governing board of a hospital,...
Requirements for Confidentiality of Proceedings and Use of Otherwise Discoverable Information – Ind. Code Ann.§34-30-15-3 Any information that is otherwise discoverable or admissible from original sources is not automatically immune from use in judicial proceedings due...
Requirements for Confidentiality of Proceedings for Persons Attending – Ind. Code Ann.§34-30-15-2 Any person attending a peer review proceeding is not allowed to disclose information acquired in the course of the proceeding, any opinion of the...
Requirements for the Use of Information for Internal Business Purposes – Ind. Code Ann.§34-30-15-21 The following entities may use information obtained by a peer review committee for a legitimate business purpose: Health care provider; Peer...
Authorization for disclosure and exceptions to authorization requirements Inter-Provider Exchange of Records Without Patient’s Consent – Ind. Code Ann.§ 16-39-5-1 Providers are allowed to obtain a patient’s health records from another provider without the patient’s consent if the health records are...
Requirements for the Disclosure of Authorized Information Under the CHIP Program – Ind. Code Ann.§ 12-17.6-9-3 The disclosure and use of CHIP information is authorized for the following purposes: Financial audits; Legislative investigations; ...
Disclosure requirements (what providers can disclose, prohibition on further disclosure) Inter-Provider Exchange of Records Without Patient’s Consent – Ind. Code Ann.§ 16-39-5-1 Providers are allowed to obtain a patient’s health records from another provider without the patient’s consent if the health records are...
Requirements for a Provider's Use of Records and Violations of Use of Records – Ind. Code Ann.§ 16-39-5-3 The law provides that a patient’s health record is the property of the provider, and may be used by the provider for legitimate business...
Requirements for Disclosure of Information of General Nature Under the CHIP Program – Ind. Code Ann.§ 12-17.6-9-4 The release and use of information of a general nature will be provided as needed for adequate interpretation or development of the CHIP program....
Requirements for Disclosure of Patient Information to Locate or Identify a Missing Person – Ind. Code Ann.§ 16-39-10-4 A provider or health plan may disclose protected health information to a law enforcement official who requests the protected health information for...
Patient’s right to confidentiality of medical records/medical information Required Contents of a Patient’s Written Consent for Release of Records – Ind. Code Ann.§ 16-39-1-4 When a patient’s written consent for release of the patient’s health record is required, the release must include the following: The...
Requirements for Medical Record Maintenance in Interactive Internet Medical Practice Sites – 844 Ind. Admin. Code 5-3-7 Interactive internet medical practice sites are practice locations, and must clearly disclose to patients the following: ·   ...
Requirements for Patient’s Written Consent to Insurer to Obtain Records or Medical Information – Ind. Code Ann.§ 16-39-5-2 An accident and sickness insurance company may obtain health records or medical information about a patient with a written consent executed at the...
Confidentiality of medical records Requirements for Access, Maintenance, and Requests for Health Records (Excluding Records for Mental Health, Communicable Diseases, and Drug and Alcohol Abuse) – Ind. Code Ann. § 16-39-1-1 This section applies to all health records except mental health records, records regarding communicable diseases, and records pertaining to drug and...
Confidentiality of genetic information Requirements for Certificates of Birth – Ind. Code Ann. § 16-37-2 A licensed physician, a midwife or a nurse midwife in attendance at a live birth shall file with the local health officer a certificate of birth and...