A Guide to Privacy Laws for Albinism Clinics in Maine

What health information must Maine albinism clinics keep confidential?

Privacy protections generally depend on the information and the provider—not on whether a clinic specializes in albinism. A patient’s diagnosis, treatment details, test results, family medical history, photographs, and billing information may be protected when they identify the patient and are part of the clinic’s health records. If a genetic test result is included in an identifiable patient record, it may be protected health information under HIPAA and health care information under Maine law.

Maine law treats an individual’s health care information as confidential and limits when a practitioner or facility may disclose it. HIPAA applies to covered entities and their business associates; a health care provider is generally a covered entity if it conducts certain standard transactions electronically. Maine’s health-information confidentiality statute and HHS guidance on covered entities explain these rules.

The HIPAA Privacy Rule does not require written authorization for every use of protected health information. But a clinic generally needs written authorization for a disclosure that is not otherwise permitted or required by HIPAA or Maine law. HHS’s HIPAA Privacy Rule summary describes the federal standard.

When may a clinic disclose patient information without written authorization?

Maine law and the HIPAA Privacy Rule allow certain disclosures without written authorization. For example, a clinic may share information for diagnosis, treatment, or care; for appropriate payment and health care operations; or when a disclosure is required by law. Maine law also allows certain disclosures to family or household members unless the patient has prohibited them, and disclosures to avert a serious threat to health or safety when the legal conditions are met. Maine Revised Statutes, Title 22, section 1711-C sets out state-law exceptions.

Other permitted disclosures may include reports to authorized public health authorities and certain disclosures for law enforcement or legal proceedings. These exceptions have specific requirements; a request from an outside person or organization does not, by itself, permit the clinic to release records. HHS’s summary of permitted HIPAA uses and disclosures explains federal exceptions.

Even when an exception applies, Maine law generally limits a disclosure to the information reasonably required for its purpose. A clinic should not treat an exception as permission to send an entire file when a smaller amount of information will do. Maine’s confidentiality statute includes this limitation.

What must a valid disclosure authorization include?

A Maine written authorization must identify and be signed and dated by the patient, or use the required identifier and authentication date for an electronic authorization. It must describe the type of person authorized to disclose the information, the information to be disclosed, the intended recipient, the specific purpose, and whether further disclosures are allowed. It must also state its duration and explain that refusing authorization may have consequences, such as affecting diagnosis, treatment, coverage, or another matter identified in the statute. Maine Revised Statutes, Title 22, section 1711-C lists these elements.

The authorization must be specific rather than a general permission to share a patient’s whole record for any purpose. Maine authorizations generally may not last longer than 30 months, subject to exceptions for certain insurance-related authorizations. A patient may revoke an authorization, although revocation does not undo a disclosure already made in reliance on it. The Maine statute addresses duration and revocation; HHS guidance describes the additional elements required for a HIPAA authorization.

How do HIPAA and Maine law guide privacy and security safeguards?

The HIPAA Privacy Rule governs how covered clinics may use and disclose protected health information. When it applies, the clinic must use reasonable safeguards to protect that information and limit workforce access according to job responsibilities. HIPAA’s minimum-necessary rule generally calls for limiting information used, disclosed, or requested to what is reasonably needed for the purpose, subject to exceptions such as disclosures for treatment.

The HIPAA Security Rule covers electronic protected health information and requires administrative, physical, and technical safeguards. Clinics must assess risks to electronic information and implement measures that are reasonable and appropriate to their circumstances. The rule is risk-based; it does not prescribe one identical security setup for every clinic. HHS’s HIPAA Security Rule summary describes these requirements.

Maine’s confidentiality law also limits disclosures and applies to health care practitioners and facilities. Where both state and federal rules apply, a clinic must follow the applicable requirements; HIPAA generally preserves state laws that provide greater privacy protection. The federal HIPAA preemption rule explains when state privacy law remains in effect.

How can patients access treatment records and what fees apply?

A patient may request treatment records from an albinism clinic. Maine defines treatment records broadly to include records relating to diagnosis, treatment, and care, including X-rays. A practitioner must provide copies or a narrative containing the relevant information under the state’s access rules, generally within the time required by HIPAA or, for providers not subject to HIPAA’s access time limit, within a reasonable time. Maine Revised Statutes, Title 22, section 1711-B addresses patient access to practitioner records.

For a HIPAA-covered clinic, the HIPAA Privacy Rule generally requires action on an access request within 30 calendar days. In limited circumstances, the clinic may take one additional 30-day period if it gives the patient written notice of the reason for delay and the expected completion date. HHS’s right-of-access guidance explains the federal timeline.

For paper copies of practitioner treatment records, Maine law caps charges at $5 for the first page and 45 cents for each additional page, up to $250 for the complete record or report. When an electronic copy is reasonably possible, the practitioner must provide one if requested; charges are limited to reasonable actual costs of staff time, necessary supplies, and postage, capped at $150. These are maximums, not automatic flat fees. If HIPAA applies, its additional reasonable, cost-based fee restrictions also apply. Maine’s record-copy fee statute and HHS fee guidance explain the limits.

What limits apply when releasing records directly to a patient?

Maine law allows a practitioner to exclude personal notes that are not directly related to the patient’s past or future treatment, as well as certain information related to federally regulated clinical trials. If the practitioner believes that giving the records directly to the patient would be detrimental to the patient’s health, Maine law requires the practitioner to advise the patient and make the records available to the patient’s authorized representative upon written authorization. Maine Revised Statutes, Title 22, section 1711-B describes these limits.

These limits are specific; they do not create a general right to withhold a record simply because it contains genetic information or may be upsetting. Patients may also submit information that corrects or clarifies a treatment record, which the practitioner must retain with the record. Maine’s patient-access law addresses corrections and clarifications.

How does Maine law protect genetic information from insurance discrimination?

If an albinism clinic’s records contain identifiable genetic information, the clinic’s privacy obligations still apply before sharing it. Separately, Maine insurance law restricts how insurers may request, obtain, and use genetic information. For individual and group health, hospital, and dental insurance, a carrier generally may not discriminate based on genetic information or a person’s refusal to take a genetic test or provide its results. Maine law generally bars these carriers from requesting or requiring genetic testing, with a limited exception for voluntary research that meets statutory conditions. Maine Revised Statutes, Title 24-A, section 2159-C sets out these protections.

Rules for life, disability, long-term-care, and certain limited-benefit insurance are not identical to the rules for health insurance. Maine prohibits unfair discrimination involving genetic information or test results in those lines, but the statute does not establish the same broad prohibition that applies to health insurance. It also restricts use of information from direct-to-consumer genetic testing without the individual’s informed written consent. Maine’s genetic-information insurance statute describes the distinctions.

In short, clinics should keep identifiable genetic and treatment information confidential, disclose it only with valid authorization or under a specific legal exception, and apply both Maine and HIPAA safeguards when applicable. Maine law also gives patients access to treatment records and sets limits on record-copy fees, while insurance protections vary by type of coverage.

FAQs.

Can an albinism clinic in Maine disclose genetic information without patient authorization?

Not simply because the information is genetic or because someone requests it. If the information is part of an identifiable health record, the clinic may disclose it without written authorization only when a Maine or HIPAA exception applies—for example, certain disclosures for treatment or disclosures required by law. The clinic must still comply with applicable limits on the scope of the disclosure. Maine’s confidentiality statute explains state-law exceptions.

What information must a written authorization for disclosure include?

It must identify and be signed and dated by the patient, identify who may disclose the information and who may receive it, describe what information may be disclosed and the purpose, state whether further disclosure is permitted, and specify its duration. Maine law also requires a statement about possible consequences of refusing authorization. Maine Revised Statutes, Title 22, section 1711-C lists the state requirements.

How much can a Maine clinic charge for copies of treatment records?

For paper copies, Maine’s statutory maximum is $5 for the first page and 45 cents per additional page, up to $250 for the complete treatment record or report. For electronic copies, the maximum is $150, and the permitted charges are limited to specified reasonable actual costs. HIPAA-covered clinics must also follow HIPAA’s reasonable, cost-based fee rules. Maine’s fee statute and HHS guidance provide more detail.

Can a Maine insurer require genetic testing or discriminate based on genetic information?

For health, hospital, and dental insurance, Maine law generally bars carriers from requiring genetic tests or discriminating based on genetic information, subject to a limited voluntary research exception. Different rules apply to life, disability, long-term-care, and certain limited-benefit insurance: Maine prohibits unfair discrimination in those lines, but the protection is not identical to the health-insurance rule. Maine Revised Statutes, Title 24-A, section 2159-C sets out the distinctions.