Let me give you a hypothetical situation. Resident A has no known family and very few visitors. A longtime neighbor visits the resident regularly, is very involved in her care, and attends care planning meetings. One day, she appears at the nurses’ station, visibly upset, and demands a copy of the resident’s medical records, pronto! What do you do?

Providers call us with this question on a regular basis. Part of the confusion centers on the whole “responsible person” concept that is embodied in federal law, but is never defined. Under federal law, a resident’s responsible person stands in the shoes of the resident and has his or her rights, if and when the resident is incompetent. This is clear from the federal Interpretive Guidelines of FTag 152. So, if an incompetent resident’s responsible person requests the resident’s medical records, that person is entitled to obtain them. Also, a competent resident may give consent for any person to obtain their medical records (referred to in the Interpretive Guidelines of FTag 152 as a “surrogate”). However, those same guidelines stress that providers must determine that an apparent surrogate actually has the authority to make the decision or obtain the records at issue. The guidelines give as an example a surrogate (whether court-appointed or appointed by the resident) who has been given legal authority to make financial decisions, but not health care decisions. In such a situation, the surrogate does not have authority to make medical decisions for the resident.

Providers faced with determining who has access to a resident’s medical records should remember several resident rights contained in federal law. First, a resident has the right of privacy in his medical records. Second, a resident has the right to object to the release of his medical records to anyone, unless the release is related to transferring the resident to another health care setting or is otherwise required by law (e.g., a subpoena is issued for the records). Third, privacy rights under HIPAA and state privacy laws prohibit releasing protected health information about a resident without the resident’s consent or another authorized reason for release stated in the law.

How, then, do providers solve the riddle of who has the power to request a resident’s medical records? The recent revisions to North Carolina’s advance directives laws contain a related provision at N.C.G.S. § 90-21.13, entitled Informed Consent to Health Care Treatment or Procedure. That section is not limited to decisions affecting life-prolonging care at the end of life, but addresses informed consent for medical care in general.

Subsection (c) of this statute creates a list, in order of priority, of individuals who are authorized to make health care decisions for a patient (or resident) “who is comatose or otherwise lacks capacity to make or communicate health care decisions.” This list is technically a “decision tree” that tells providers who to look to when there is no clear, legally designated surrogate, such as designated in a health care power of attorney or guardianship document, who has authority over the question at issue. The beauty of this decision tree is that it gives providers guidance on where to turn for medical care decisions and offers providers some protection from liability if they honor the hierarchy of potential decision makers.

The decision tree statute does not specifically reference the right to obtain medical records. However, absent any other definition or provision in state or federal law defining who can obtain a resident’s medical records on behalf of the resident, this statute provides the best guidance on how providers should determine who, other than the resident himself, is authorized to access his medical records. The theory behind this approach is that if a designated individual is authorized by this statute to give consent to medical care for the resident, that person would also be authorized to access the resident’s medical records that contain information needed to make care decisions or to oversee the resident’s care.

Having said that, here is a recommended analytical approach for deciding whether a person requesting a resident’s medical records is actually authorized to obtain them. Providers should ask the following questions to make that decision.

1. Is the resident competent? If so, ask the resident whether the individual requesting the records is authorized to see them. If the answer is no, do not give the records to that individual, regardless of his or her relationship to the resident.

2. Is the resident incompetent (i.e., unable to make or communicate health care decisions, including agreeing to a release of his medical records)? If so, then look to the statutory decision tree in N.C.G.S. § 90-21.13 (c) to determine if the individual requesting the records is authorized to obtain them.

3. Is the person seeking the records the highest-ranking “reasonably available” person on the list? The order of priority in the statute is as follows.

• A guardian of the person appointed by a court, with one caveat: If there is a health care agent appointed by the resident under a health care power of attorney, then the health care agent has priority over the guardian unless the court has expressly suspended the authority of the health care agent. In that case, the guardian has authority and can obtain the records. If not, only the health care agent can access the records.

• A health care agent appointed pursuant to a health care power of attorney (unless the court has suspended that agent’s authority when appointing a guardian of the person)

• An agent appointed pursuant to a durable power of attorney (non-health care specific) who appears from the document to have general authority to act for the resident

• The resident’s spouse

• A majority of the resident’s reasonably available parents and children over the age of 18

• A majority of the resident’s reasonably available siblings over the age of 18

• An individual who has an established relationship with the resident, who is acting in good faith on behalf of the resident, and who can reliably convey the resident’s wishes - this is a catchall category in which no individuals higher on the list exist or are reasonably available.

If the individual requesting the resident’s records is on the decision tree list, but there is another individual higher up on the list, the individual(s) who ranks higher on the list alone has the authority to access the resident’s records. In such cases, the facility should tell the person seeking the records who is not authorized to obtain them that the request must come from the individual who is higher on the priority list.

Requests for the records of residents who have passed away present a somewhat unique situation. In that case, the decision tree statute really is not applicable for one simple reason. Under North Carolina law, once an individual dies, the legal title to all assets of that person’s estate vests automatically in the executor or personal representative of the deceased resident. As such, only the executor or personal representative has the authority to obtain, collect or access any asset of the estate, including the deceased resident’s medical records. Therefore, providers should require that any individual seeking records of a deceased resident to present either letters testamentary from the clerk of court showing they have been appointed executor of the deceased resident’s estate, or at least a copy of the resident’s will naming that individual as executor (or a co-executor) of the estate.

Providers often feel enormous pressure to give resident medical records to family members upon request and fear aggravating families if they say no. However, providers should remember that privacy rights of medical records belong to the resident or the individual either appointed by the resident to act on his or her behalf or cloaked with authority under state law to act for the resident. As such, the balance must tip in favor of resident privacy and confidentiality. The North Carolina statute summarized above gives providers an objective basis to explain to family members why they can or cannot access a resident’s medical records and, if they cannot, who can properly request those records on behalf of the resident.