12-2294. Release of medical records and payment records to third parties

A. A health care provider shall disclose medical records or payment records, or the information contained in medical records or payment records, without the patient's written authorization as otherwise required by law or when ordered by a court or tribunal of competent jurisdiction.

B. A health care provider may disclose medical records or payment records, or the information contained in medical records or payment records, pursuant to written authorization signed by the patient or the patient's health care decision maker.

C. A health care provider may disclose medical records or payment records or the information contained in medical records or payment records and a clinical laboratory may disclose clinical laboratory results without the written authorization of the patient or the patient's health care decision maker as otherwise authorized by state or federal law, including the health insurance portability and accountability act privacy standards (45 Code of Federal Regulations part 160 and part 164, subpart E), or as follows:

1. To health care providers who are currently providing health care to the patient for the purpose of diagnosis or treatment of the patient.

2. To health care providers who have previously provided treatment to the patient, to the extent that the records pertain to the provided treatment.

3. To ambulance attendants as defined in section 36-2201 for the purpose of providing care to or transferring the patient whose records are requested.

4. To a private agency that accredits health care providers and with whom the health care provider has an agreement requiring the agency to protect the confidentiality of patient information.

5. To a health profession regulatory board as defined in section 32-3201.

6. To health care providers for the purpose of conducting utilization review, peer review and quality assurance pursuant to section 36-441, 36-445, 36-2402 or 36-2917.

7. To a person or entity that provides services to the patient's health care providers or clinical laboratories and with whom the health care provider or clinical laboratory has an agreement requiring the person or entity to protect the confidentiality of patient information and as required by the health insurance portability and accountability act privacy standards, 45 Code of Federal Regulations part 164, subpart E.

8. To the legal representative of a health care provider in possession of the medical records or payment records for the purpose of securing legal advice.

9. To the patient's third party payor or the payor's contractor.

10. To the industrial commission of Arizona or parties to an industrial commission claim pursuant to title 23, chapter 6.

D. A health care provider may disclose a deceased patient's medical records or payment records or the information contained in medical records or payment records to the patient's health care decision maker at the time of the patient's death. A health care provider also may disclose a deceased patient's medical records or payment records or the information contained in medical records or payment records to the personal representative or administrator of the estate of a deceased patient, or if a personal representative or administrator has not been appointed, to the following persons in the following order of priority, unless the deceased patient during the deceased patient's lifetime or a person in a higher order of priority has notified the health care provider in writing that the deceased patient opposed the release of the medical records or payment records:

1. The deceased patient's spouse, unless the patient and the patient's spouse were legally separated at the time of the patient's death.

2. The acting trustee of a trust created by the deceased patient either alone or with the deceased patient's spouse if the trust was a revocable inter vivos trust during the deceased patient's lifetime and the deceased patient was a beneficiary of the trust during the deceased patient's lifetime.

3. An adult child of the deceased patient.

4. A parent of the deceased patient.

5. An adult brother or sister of the deceased patient.

6. A guardian or conservator of the deceased patient at the time of the patient's death.

E. A person who receives medical records or payment records pursuant to this section shall not disclose those records without the written authorization of the patient or the patient's health care decision maker, unless otherwise authorized by law.

F. If a health care provider releases a patient's medical records or payment records to a contractor for the purpose of duplicating or disclosing the records on behalf of the health care provider, the contractor shall not disclose any part or all of a patient's medical records or payment records in its custody except as provided in this article. After duplicating or disclosing a patient's medical records or payment records on behalf of a health care provider, a contractor must return the records to the health care provider who released the medical records or payment records to the contractor.