A Guide to Privacy Laws for Alaska Hospital Health Information Management Departments

Alaska hospital health information management (HIM) departments must apply federal privacy and security rules alongside state statutes and licensing regulations. The HIPAA Privacy Rule governs uses and disclosures of protected health information (PHI), while Alaska rules address matters such as record security, retention, and health information exchange (HIE) safeguards.

When can Alaska hospitals disclose medical records without written consent?

A hospital does not need written authorization for every disclosure. Under HIPAA, covered entities may generally use or disclose PHI for treatment, payment, and health care operations without the patient’s authorization. For example, a hospital may send relevant records to another provider for treatment or submit information needed to process a claim. The HHS guidance on treatment, payment, and health care operations explains these permissions.

Other disclosures may be permitted or required by law, subject to the conditions that apply to the specific purpose. Examples can include certain public health reports, health oversight activities, and responses to a court order. A court-ordered medical record disclosure must be limited to the information the order authorizes. A subpoena that is not a court order is not automatically sufficient; HIPAA’s requirements for notice or a qualified protective order may apply. See HHS guidance on court orders and HHS guidance on court orders and subpoenas.

Alaska’s hospital regulation requires written consent for releases that are not otherwise authorized without consent and incorporates applicable HIPAA disclosure rules. For requests outside a recognized permission or legal requirement—such as many disclosures to employers or for marketing—obtain a valid authorization before releasing PHI. Review the applicable rule, any more protective state requirement, and the scope of the request before sending records. See Alaska Department of Health information quoting 7 AAC 12.770 and the HHS summary of the HIPAA Privacy Rule.

How should HIM departments protect records from unauthorized access or alteration?

The HIPAA Privacy Rule applies to PHI in all forms; the HIPAA Security Rule specifically covers electronic PHI. The Security Rule requires appropriate administrative, physical, and technical safeguards to protect electronic PHI’s confidentiality, integrity, and availability. Alaska’s 7 AAC 12.770 also requires facilities to maintain procedures to protect medical records from loss, defacement, tampering, and unauthorized access. See the HHS overview of the HIPAA Security Rule and Alaska Department of Health information quoting 7 AAC 12.770.

For HIM operations, translate those requirements into documented controls: assign access according to job responsibilities, promptly change or remove access when roles change, authenticate users, review audit activity, and use procedures that detect and address improper access or changes. Maintain reliable backups and recovery procedures, Train staff on relevant security policies, and document incident response. These are practical ways to implement the rule’s safeguards; the HIPAA administrative safeguards and technical safeguards set out the applicable standards.

Protect paper files and other physical media as well as electronic records. Secure storage, controlled work areas, approved record transport, and authorized disposal procedures help reduce risks of loss, alteration, or disclosure. Document the policies that apply to each record format and review whether they remain effective as systems and workflows change.

How long must Alaska hospitals retain adult and minor patient records?

Alaska’s hospital medical-record regulation generally requires facilities to preserve patient records for at least seven years after discharge. For a patient who was a minor, retain the records until the patient reaches age 21 or for seven years after discharge, whichever period is longer. The regulation specifies a separate minimum of five years after discharge for X-ray films or reproductions of films. These are Alaska retention periods; other applicable requirements, legal holds, or organizational policies may require longer retention. See the Alaska Department of Health information quoting 7 AAC 12.770.

Build retention schedules around the patient’s discharge date and, for minors, the age-based deadline. Include processes for preserving records during a facility closure or ownership change, as Alaska’s regulation addresses safe preservation in those circumstances. Avoid treating HIPAA as a general medical-record retention schedule: its documentation-retention provisions do not replace the specific state hospital retention requirements. Check applicable law and organizational obligations before destruction.

What privacy and security rules apply to health information exchanges?

HIE participation does not remove HIPAA duties. A hospital’s disclosures through an HIE must still have a permitted purpose or another valid legal basis, and the hospital must meet applicable privacy and security requirements. HIPAA does not generally require authorization for provider-to-provider exchange for treatment, payment, or health care operations, but an exchange for a purpose not otherwise permitted by the Privacy Rule may require a valid authorization. See HHS guidance on authorizations in electronic health information exchange.

Alaska Statutes Title 18 sets out additional HIE safeguards. AS 18.23.310 calls for controls over access to and management of records, secure and traceable electronic audit systems, and protections that meet the most stringent applicable federal or state privacy law. It also directs the state to establish procedures concerning patient opt-outs, consent to distribution, notices of confidentiality violations, and access to audit reports. These requirements do not mean every HIE disclosure has the same authorization rule; HIM teams should verify the exchange’s purpose, applicable procedures, and the patient’s status before release. See Alaska Statutes Title 18, including AS 18.23.310.

Use written agreements and operational controls to clarify each participant’s role, permitted uses, access limits, audit responsibilities, and incident reporting steps. When an HIE performs services on a hospital’s behalf involving PHI, determine whether a business associate agreement and related safeguards are required. HHS describes HIE roles and HIPAA rules in its guidance on HIPAA, HIEs, and public health disclosures.

How do confidentiality rules apply to mental health records?

Mental health information generally remains PHI subject to the HIPAA Privacy Rule, but additional protections may apply depending on the record and the service. Alaska Statute 47.30.845 makes specified records from screening, evaluation, examination, or treatment confidential and limits disclosure to authorized circumstances, including disclosures to involved care providers, the patient or a person the patient has authorized in writing, and a person authorized by court order. Apply the statute to the types of records and services it covers rather than assuming that it governs every mental health record in the same way. See Alaska Statutes Title 47, including AS 47.30.845.

Keep psychotherapy notes distinct from ordinary mental health documentation. HIPAA generally treats separately maintained psychotherapy notes differently from information in the patient’s medical record; most uses or disclosures of those notes require authorization, with limited exceptions. See HHS guidance on medical records and psychotherapy notes.

A parent or guardian does not automatically have unrestricted access to every minor’s mental health record. HIPAA generally treats a parent as a minor’s personal representative, but exceptions may apply when the minor lawfully consents to care, another person or court authorizes care, a confidential relationship is agreed to, state law limits access, or the provider has a qualifying safety concern. Alaska’s AS 47.30.590 addresses community mental health services and requires regulations to provide for disclosure to parents or guardians in defined best-interest circumstances. HIM staff should verify the type of service, the minor’s consent and representative status, and the applicable Alaska rule before responding. See HHS guidance on parental access to children’s records and Alaska Statutes Title 47.

If records are subject to federal substance use disorder confidentiality rules under 42 CFR Part 2, apply those requirements in addition to HIPAA and relevant Alaska law. HHS states that compliance with its 2024 Part 2 final rule was required by February 16, 2026. See HHS guidance on Part 2 records.

What documentation and workflows support compliant disclosures?

A consistent disclosure workflow helps you establish who requested records, what authority permits release, and what was actually disclosed. Before sending information, verify the requester’s identity and authority, identify the request’s purpose, confirm that the disclosure is permitted or required, and check whether special rules apply to the record. For court orders, compare the requested material with the order and disclose only what it authorizes.

Document the request, the authority or authorization relied on, the records released, the recipient, the date, and the method of transmission. Where HIPAA’s minimum necessary standard applies, limit the release to information reasonably needed for the purpose; remember that the standard does not apply to certain disclosures, including disclosures to a provider for treatment. See the HHS summary of the HIPAA Privacy Rule.

Maintain current procedures for authorizations, subpoenas and court orders, personal-representative requests, HIE transmissions, sensitive records, and patient access requests. Train staff on the hospital’s own policies, escalation paths, and documentation expectations. Periodically review completed disclosures and audit logs to identify errors, inappropriate access, or process gaps.

Summary: Alaska hospital HIM teams should align disclosure decisions with HIPAA and applicable Alaska law, protect records against unauthorized access or alteration, follow Alaska’s retention periods, and document the authority and scope for each release.

FAQs

When is written consent required to release a hospital medical record in Alaska?

Written consent or a valid HIPAA authorization is generally required when a disclosure is not otherwise permitted or required by law. It is not generally required for disclosures for treatment, payment, or health care operations, although additional rules may apply to particular records or purposes. For a court order, disclose only the information the order authorizes; do not assume that a subpoena alone is sufficient.

How soon must a hospital complete a medical record after discharge?

Under Alaska’s 7 AAC 12.770, a hospital record must be completed within 30 days after discharge and authenticated or signed by the responsible practitioner. Federal hospital requirements also call for completion of medical records within 30 days following discharge. See Alaska Department of Health information quoting 7 AAC 12.770 and 42 CFR § 482.24.

How long must Alaska hospitals retain records for minor patients?

Retain a minor patient’s hospital records until the patient reaches age 21 or for seven years after discharge, whichever is longer. Check for other applicable retention obligations or legal holds before destroying records. See the Alaska Department of Health information quoting 7 AAC 12.770.

Can a parent or guardian access a minor’s mental health records?

Sometimes, but access is not automatic for every mental health record. HIPAA generally allows a parent to act as a minor’s personal representative, subject to exceptions involving minor-consented care, state law, court-authorized care, agreed confidentiality, and safety concerns. Alaska law also sets confidentiality and disclosure rules for certain mental health services, including provisions concerning parents or guardians in community mental health programs. Determine which rules apply to the specific care and record before granting access.