State confidentiality laws anticipate that medical information must be shared when taking care of the patient. (Some states enacted restrictions on entering information about AIDS/HIV into the medical chart that made it very difficult to care for these patients.) This is assumed to include quality assurance activities and accreditation, and the review of medical records and confidential patient information by private accrediting associations such as the Joint Commission. Interestingly, there is no clear legal mandate for this release of confidential medical information to a private group. In many states it could be argued that this release comes under the exception for quality assurance review.

This exception is not an unlimited right to use medical information for all administrative purposes. In one case, plaintiffs sued a hospital for releasing records to its law firm so that the attorneys could determine if any patients were eligible for additional federal benefits. The hospital moved for summary judgment, claiming that the general consent patients sign on admission covered this release of information. The court disagreed, noting that the general consent mentioned only releases to insurers. The court also rejected the defendant’s claim that this release was allowable under their attorney–client relationship. The court held that the hospital could be sued for releasing the records. [Biddle v. Warren Gen. Hosp., 86 Ohio St.3d 395, 715 N.E.2d 518 (Ohio 1999)]

Perhaps most interestingly, the court also found that the law firm may have improperly induced the hospital to violate its fiduciary duty toward the patient by releasing confidential medical information. The court applied a standard drawn from a case involving an improper disclosure of psychiatric information to an employer, who was alleged to have induced the psychiatrist to disclose the information: “(1) [T]he defendant knew or reasonably should have known of the existence of the physician–patient relationship; (2) the defendant intended to induce the physician to disclose information about the patient or the defendant reasonably should have anticipated that his actions would induce the physician to disclose such information; and (3) the defendant did not reasonably believe that the physician could disclose that information to the defendant without violating the duty of confidentiality that the physician owed the patient.” [Alberts v. Devine, 479 N.E.2d 113, 121 (Mass. 1985).] Such a standard raises questions about many consulting schemes designed to increase billing by reviewing records and tuning up the billing.