Skip to Content

Privacy and Confidentiality in Pennsylvania

        Pennsylvania requires hospitals1 and birthing centers 2 to establish policies that protect the privacy of their patients and classifies the following health information as confidential: (1) client records maintained by area agencies on aging;3 (2) information obtained through the hearing screening program;4 (3) patient safety reports;5 (4) disease, condition, and infection case reports;6 (5) cancer reports;7 (6) information from the newborn screening program;8 (7) clinical records maintained by long term care facilities;9 (8) clinical records maintained by home health care service providers;10 (9) lab records and reports;11 (9) medical records maintained by ambulatory surgical facilities;12 (10) patient records maintained by hospitals;13 (11) vital statistics records;14 (12) HIV information;15 (13) personally identifiable information maintained by managed care plans and utilization review entities;16 (14) records maintained by osteopathic physicians;17 (15) patient records maintained by psychologists;18 and (16) mental health service records.19 In most instances, individuals that are the subject matter of such records must consent to its release unless the law authorizes release for quality, investigative or research purposes. For example, the department of health may access HMO enrollee information for quality assessment and investigation20 may access the patient records of providers of HIV services to assess compliance with HIV reporting requirements.21

 

Footnotes

  • 1. 28 Pa. Code § 103.22 (2012)
  • 2. 28 Pa. Code § 103.22 (2012)
  • 3. 6 Pa. Code § 21.60 (2012)
  • 4. 11 Pa. Stat. Ann. § 876-7 (West 2001)
  • 5. 6 Pa. Code § 11.16 (2012); 35 Pa. Stat. Ann. §10210.505 (West 2012); 35 Pa. Stat. Ann. §10225.306 (West 2012); 35 Pa. Stat. Ann. § 10225.705 (West 2012); 35 Pa. Stat. Ann. § 448.806a (West 2012); 40 Pa. Stat. Ann. § 1303.308 (West 2012); 40 Pa. Stat. Ann. § 1303.311 (West 2012); 6 Pa. Code § 11.16 (2012)
  • 6. 28 Pa. Code § 27.5a (2012) 40 Pa. Stat. Ann. § 1303.907 (West 2012)
  • 7. 28 Pa. Code  § 27.31 (2012)
  • 8. 28 Pa. Code § 28.5 (2012)
  • 9. 28 Pa. Code § 211.5 (2012)
  • 10. 28 Pa. Code § 601.36 (2012)
  • 11. 28 Pa. Code Chapter 5 (2012)
  • 12. 28 Pa. Code Chapter 563
  • 13. 28 Pa. Code Part IV: Health Facilities, Subchapter B: General and Special Hospitals
  • 14. 35 Pa. Stat. Ann. § 450.801 (West 2012)
  • 15. 35 Pa. Stat. Ann. § 7607 (West 2012)
  • 16. 40 Pa. Stat. Ann. § 991.2131 (West 2012)
  • 17. 49 Pa. Code § 25.213
  • 18. 49 Pa. Code § 41.57 (2012)
  • 19. 50 Pa. Stat. Ann. § 7111 (West 2012)
  • 20. 28 Pa. Code Chapter 9 (2012)
  • 21. 28 Pa. Code Chapter 27, Subchapter B (2012)

 

Privacy and Confidentiality in Pennsylvania

Subtopic Statute/Regulation Description
Confidentiality of medical records 28 Pa. Code § 115.27, Confidentiality of Medical Records Classifies hospital medical records as confidential. Limits access to authorized personnel. Requires the patient’s written authorization to...
28 Pa. Code § 563.9, Confidentiality of Medical Records Classifies ambulatory surgical facility medical records as confidential. Limits access to authorized personnel. Requires the patient’s written...
Disclosure requirements (what providers can disclose, prohibition on further disclosure) 28 Pa. Code § 115.27, Confidentiality of Medical Records Classifies hospital medical records as confidential. Limits access to authorized personnel. Requires the patient’s written authorization to...
28 Pa. Code § 563.9, Confidentiality of Medical Records Classifies ambulatory surgical facility medical records as confidential. Limits access to authorized personnel. Requires the patient’s written...
28 Pa. Code § 711.53, Client Records Requires SUD treatment projects to maintain client records. Specifies the information that such records must include (e.g., medical history, consent...
28 Pa. Code § 711.62, Client Records Requires SUD treatment projects to maintain client records. Specifies the information that such records must include (e.g., medical history, consent...
28 Pa. Code § 711.72, Client Records Requires SUD treatment projects to maintain client records. Specifies the information that such records must include (e.g., medical history, consent...
28 Pa. Code § 711.83, Client Records Requires SUD treatment projects to maintain client records. Specifies the information that such records must include (e.g., medical history, consent...
28 Pa. Code § 711.93, Confidentiality Requires SUD treatment projects to maintain client records. Specifies the information that such records must include (e.g., medical history, consent...
29 Pa. Code § 709.28, Confidentiality Requires project directors to create a written procedure for maintaining client confidentiality in compliance with 4 Pa. Code § 255.5. Requires...
4 Pa. Code § 255.5, Projects and Coordinating Bodies Regulates the disclosure of information about persons receiving substance use disorder services from a project. 28 Pa. Code. 701.1 defines ‘...
Privacy and Confidentiality 28 Pa. Code § 115.34, Medical records review Requires health care facilities to periodically conduct medical records review.  
28 Pa. Code § 563.6, Preservation of medical records Requires ambulatory surgical facilities to maintain a patient’s medical record for at least seven years following the patient’s date of...
Access - 6 Pa. Code § 11.197 Clients of older adult daily living centers will have access to their own records and the information contained therein, unless, in the opinion of...
Authorization required for disclosure of nonpublic personal health information - 31 Pa. Code § 146b.11 A licensed insurer may disclose nonpublic personal health information about a consumer in the following circumstances: Upon authorization from...
Cancer registry - 35 Pa. Stat. Ann. § 5636 The Department of Health maintains a system to collect and disseminate data on cases of cancer in the state by anatomical site, medical and...
Clinical records - 28 Pa. Code § 211.5 Long term care facility’s clinical records must conform to the following requirements: Information contained in the resident’s record...
Clinical records - 28 Pa. Code § 601.36 Providers of home health care services must maintain a clinical record containing pertinent past and current findings for every patient receiving...
Confidentiality - 28 Pa. Code § 28.5 Identifying information relating to any newborn screened in the newborn screening program may be released in the following circumstances:  ...
Confidentiality - 28 Pa. Code § 5.53 Records and reports of examinations of specimens are confidential. 28 Pa Code Chapter 5, “Confidentiality” § 5.53
Confidentiality - 40 Pa. Stat. Ann. § 991.2131 Managed care plans and utilization review entities must ensure that all identifiable information regarding enrollee health, diagnosis and treatment...
Confidentiality and compliance - 40 Pa. Stat. Ann. § 1303.311 Any documents, materials or information prepared by or received by the patient safety committee or governing board of a medical facility related to...
Confidentiality of and access to confidential reports - 35 Pa. Stat. Ann. § 10225.705 Reports made about abuse of an adult over age 60 who receives services in or from any of the following facilities are confidential:   ...
Confidentiality of and access to confidential reports - 35 Pa. Stat. Ann. §10210.505 Information contained in reports of abuse that are made to local protective service agencies, the department of public welfare and law enforcement...
Confidentiality of case reports - 28 Pa. Code § 27.5a Case reports submitted to the department of health or to a local morbidity reporting office (LMRO) related to diseases, conditions and infections are...
Confidentiality of information - 28 Pa. Code § 15.16 The director of a local health department must directly report to the department of health’s commissioner of local health whenever he becomes...
Confidentiality of medical records - 28 Pa. Code § 115.27 Medical record confidentiality
Confidentiality of medical records - 28 Pa. Code § 563.9 Records should be confidential
Confidentiality of records - 11 Pa. Stat. Ann. § 876-7 Information obtained in relation to the hearing screening program may not be disclosed by any person, employee or agent of such person to anyone...
Confidentiality of records - 35 Pa. Stat. Ann. § 7607 No individual who obtains confidential HIV-related information in the course of providing any health or social service may disclose, or be compelled...
Confidentiality of records - 35 Pa. Stat. Ann. §10225.306 Information contained in reports, records of investigation, client assessment and service plans relating to abuse or neglect of service recipients...
Confidentiality of records - 50 Pa. Stat. Ann. § 7111 All documents concerning individuals receiving mental health services must be kept confidential. Documents may be released or disclosed under the...
Confidentiality of records - 71 Pa. Stat. Ann. § 1690.108 Substance abuse treatment information is confidential and privileged to the patient, and may only be disclosed pursuant to the statute. Substance...
Confidentiality of records of licensure boards - 40 Pa. Stat. Ann. § 1303.907 All documents, materials or information utilized solely for investigation undertaken by the state board of medicine or the state board of osteopathic...
Confidentiality of reports and records - 35 Pa. Stat. Ann. § 521.15 State and local health authorities may disclose reports of diseases or records of actions taken in response to such reports under the following...
Confidentiality of review organization's records - 63 Pa. Stat. Ann. § 425.4 The proceedings and records of a peer review committee will be confidential and may not be subject to discovery or introduction into evidence in any...
Consent of minor - 71 Pa. Stat. Ann. § 1690.112 A minor may consent to substance abuse treatment on his or her own behalf, and providers are permitted but not obligated to disclose treatment...
Contents - 28 Pa. Code § 115.32 Medical record contents
Contents of records - 28 Pa. Code § 5.52 The record must identify the person from whom the specimen was taken and include the result of the test. 28 Pa Code Chapter 5, “Contents of...
Department authority to require complete reporting - 28 Pa. Code § 27.32d The department of health may access and review patient records maintained by physicians, hospitals and persons providing HIV services for the...
Department investigations - 28 Pa. Code § 9.605 The department of health may investigate plans to determine their compliance with regulations; the department may access enrollees’ medical...
Form and content of record - 28 Pa. Code § 563.12 Ambulatory surgical facilities must maintain a separate medical record for each patient that includes the following information:1   ...
Health record transfer, retention and confidentiality - 28 Pa. Code § 501.62 Birth centers must comply with the following requirements pertaining to patient medical records: If a patient is transferred or referred to...
HMO external quality assurance assessment - 28 Pa. Code § 9.654 Within 18 months of enrollment, and every three years thereafter, an HMO must use an acceptable external quality review organization to conduct a...
Implementation - 28 Pa. Code § 103.22 All hospitals must establish a Patient’s Bill of Rights that contains the following provisions relating to patients: The right, upon...
Medical facility reports and notifications - 40 Pa. Stat. Ann. § 1303.313 Medical facilities must report to the department of health and the patient safety authority an occurrence of a serious event involving the clinical...
Medical records - 49 Pa. Code § 25.213 Every osteopathic physician must maintain a medical record for each patient that identifies the patient and provides pertinent clinical information,...
Operational standards - 40 Pa. Stat. Ann. § 991.2152 Utilization review entities must do the following: Protect the confidentiality of enrollee medical records; Conduct utilization reviews based...
Ownership - 28 Pa. Code § 563.10 Ambulatory surgical facilities must maintain a separate medical record for each patient that includes the following information: 28 Pa. Code Chapter...
Patient medical records - 28 Pa. Code § 115.31 All hospitals must maintain patient records in accordance with the following provisions:         A medical...
Patient’s rights - 28 Pa. Code § 501.46 Birthing centers must have written policies and procedures that provide the following rights to patients: Right to confidentiality, anonymity and...
Plan reporting requirements - 28 Pa. Code § 9.604 A plan must annually submit to the department of health a detailed report of its activities, including the following provisions: ...
Preservation of medical records - 28 Pa. Code § 115.23 Preservation of medical records
Professional records - 49 Pa. Code § 41.57 Psychologists must maintain a record for each client, which includes, at a minimum: The name and address of the client/patient and, if the client...
Quality assurance standards - 28 Pa. Code § 9.674 A managed care plan must have an ongoing quality assurance program that includes review, analysis and assessment of the access, availability and...
Record audits - 28 Pa. Code § 27.32e The department may audit records dating back to January 1, 2000 maintained by physicians, hospitals and persons providing HIV services for purposes...
Recordkeeping - 6 Pa. Code § 21.60 Each area agency on aging providing domiciliary care services must maintain a case record for each client receiving services; these records must...
Records: Disclosure in general - 35 Pa. Stat. Ann. § 450.801 Vital statistics records of the department of health and local registrars may not be made open to public inspection, except as otherwise authorized;...
Release of information - 6 Pa. Code § 11.198 Release of information about a client of an older adult daily living center to a person or entity without legal authorization is prohibited unless...
Report of findings - 28 Pa. Code § 5.47 A clinical laboratory may only report its findings to the person who submitted the specimen or requested the analysis, or to health officials as...
Reportable diseases - 28 Pa. Code § 5.49 The director of the laboratory must report to the department of health all findings which indicate the presence of any reportable disease. 28 Pa....
Reporting - 28 Pa. Code § 15.17 The director of a local health department must directly report to the department of health’s commissioner of local health whenever he becomes...
Reporting and notification - 40 Pa. Stat. Ann. § 1303.308 Any health care worker who reasonably believes that a serious event or incident has occurred must report the event according to the patient safety...
Reporting cases of cancer - 28 Pa. Code § 27.31 Each case of cancer must be reported in accordance with the following: To the cancer registry maintained by the department of health’s...
Reporting Incidents of Professional Misconduct - 35 Pa. Stat. Ann. § 448.806a All health care facilities and hospitals must report to the applicable state board within 60 days of the occurrence of any of the following events...
Reporting of unusual incidents - 6 Pa. Code § 11.16 Older adult daily living centers must establish written policies and procedures on the recording, reporting and management of unusual incidents which...
Reports to department and coroner - 35 Pa. Stat. Ann. § 10225.702 The local provider of protective services must transmit to the department of aging written reports involving sexual abuse, serious physical injury,...
Retention of reports - 28 Pa. Code § 5.51 Each laboratory must keep a record of test results for each specimen; if the laboratory is part of a hospital, the permanent laboratory record may be...
Right-to-Know Law and access to council data - 35 Pa. Stat. Ann. § 449.10 The Right-to-Know law enables the health care cost containment council to make determinations on requests for its information and data in favor of...
Unprofessional and immoral conduct - 49 Pa. Code § 16.61 A Board-regulated practitioner who engages in unprofessional or immoral conduct is subject to disciplinary action. Unprofessional or immoral conduct...
Confidentiality of substance abuse records 28 Pa. Code § 710.23, Patient Records Requires providers of substance use disorder treatment to maintain patient records in compliance with federal drug and alcohol regulations and...
28 Pa. Code § 711.43, Client Records Requires SUD treatment projects to maintain client records. Specifies the information that such records must include (e.g., medical history, consent...
28 Pa. Code § 711.53, Client Records Requires SUD treatment projects to maintain client records. Specifies the information that such records must include (e.g., medical history, consent...
28 Pa. Code § 711.62, Client Records Requires SUD treatment projects to maintain client records. Specifies the information that such records must include (e.g., medical history, consent...
28 Pa. Code § 711.72, Client Records Requires SUD treatment projects to maintain client records. Specifies the information that such records must include (e.g., medical history, consent...
28 Pa. Code § 711.83, Client Records Requires SUD treatment projects to maintain client records. Specifies the information that such records must include (e.g., medical history, consent...
28 Pa. Code § 711.93, Confidentiality Requires SUD treatment projects to maintain client records. Specifies the information that such records must include (e.g., medical history, consent...
29 Pa. Code § 709.28, Confidentiality Requires project directors to create a written procedure for maintaining client confidentiality in compliance with 4 Pa. Code § 255.5. Requires...
4 Pa. Code § 255.5, Projects and Coordinating Bodies Regulates the disclosure of information about persons receiving substance use disorder services from a project. 28 Pa. Code. 701.1 defines ‘...
55 Pa. Code § 5100.37, Drug and alcohol abuse records Clarifies that information in the record of a patient receiving mental health services is subject to Pennsylvania’s drug and alcohol abuse...
55 Pa. Code § 5230.17, Confidentiality