A Guide to Privacy Laws for Neurosurgery Practices in South Carolina

Neurosurgery practices handle sensitive information across consultations, imaging, surgery, referrals, and follow-up care. The rules that apply depend on whether the practice is a HIPAA-covered entity, whether the record is held by a physician’s office or a health care facility, and whether a request is for the patient’s own access or a disclosure to someone else.

What confidentiality duties apply to neurosurgery practices in South Carolina

A physician practice that conducts covered electronic transactions is generally subject to the HIPAA Privacy Rule. It must use and disclose protected health information (PHI) only as HIPAA permits or requires, or as authorized in writing by the patient or their personal representative. South Carolina’s Physicians’ Patient Records Act also governs physician-held records, including medical bills, and places limits on releasing copies. See the HHS summary of the HIPAA Privacy Rule and South Carolina Code Chapter 44-115.

Build your privacy procedures around permitted purposes, patient rights, workforce access, and safeguards. HIPAA generally allows a practice to use or disclose PHI for its own treatment, payment, and health care operations, and to disclose it to another provider for treatment. The minimum necessary standard generally applies to payment and operations disclosures, but not to a provider’s treatment disclosure. A practice must also maintain reasonable safeguards, provide required privacy information, and train its workforce on applicable policies. See HHS guidance on permitted uses, minimum necessary, and administrative requirements.

HIPAA does not replace more protective state privacy requirements. For example, South Carolina law requires express written consent for a physician’s release of copies of medical records, except where another law provides otherwise. That specific records-release rule should not be confused with HIPAA’s separate rules for routine permitted disclosures.

When can a practice disclose patient records without written consent

HIPAA allows certain uses and disclosures without a separate written authorization. Common examples include treatment, payment, and health care operations; disclosures required by law; and specific public-health, health-oversight, or law-enforcement purposes when applicable conditions are met. The practice should confirm the legal basis and disclose only what the applicable rule permits. See HHS’s list of permitted uses and disclosures.

A neurosurgeon may generally share relevant PHI with another provider for treatment, such as sending operative notes or imaging reports to a specialist managing the same patient. HIPAA does not apply its minimum-necessary rule to provider disclosures for treatment, though reasonable safeguards still apply. See HHS guidance on treatment, payment, and health care operations.

For a patient’s request to send copies to another person or organization, including another physician, follow South Carolina’s written-consent requirement unless a law provides an exception. Verify the recipient, the patient’s identity or representative authority, and the scope of the release. A valid authorization should identify the information and recipient and meet applicable federal requirements. See South Carolina Code §§ 44-115-30 and 44-115-40.

How can patients request or transfer their medical records

Patients or their legal representatives can request copies of physician-held records or ask that the records be transferred to another physician. South Carolina law calls for the request to be accompanied by written authorization. A practice can provide a form that identifies the records requested, the intended recipient, the preferred delivery method, and the patient’s signature or the signature of an authorized representative. See South Carolina Code § 44-115-30.

HIPAA gives individuals a right to access PHI in a designated record set, including relevant medical and billing records maintained by the practice or on its behalf by a business associate. If records are maintained electronically, the patient may request an electronic copy in a readily producible format. A covered entity may require a written access request if it tells patients that it does so. See HHS guidance on the right of access.

When a provider refers a patient to another provider for continuation of treatment for a specific condition, South Carolina law requires the records to be provided at no charge. Confirm the request is for continuing care and document the transfer. See South Carolina Code § 44-115-80(B).

What deadlines apply to medical-record requests

For a HIPAA-covered practice, the federal access rule generally requires action within 30 calendar days after receiving a patient’s request. If the practice cannot meet that deadline, it may take one additional 30-day period only after giving the patient a written explanation of the delay and the date by which it will complete the request within the original 30 days. See HHS’s explanation of HIPAA access deadlines.

South Carolina’s health care facility statute separately sets a deadline of 45 days after discharge or 45 days after receipt of the request, whichever is later, and says a facility is not compelled to release the record before 30 days after discharge. Because HIPAA generally requires a covered entity to act within 30 days on an individual access request, a covered facility should not treat the state facility deadline as extending the federal access deadline. The state deadline also applies to health care facilities; it is not a general deadline written into the physician-records statute for every standalone physician practice. See South Carolina Code § 44-7-325 and HHS guidance on HIPAA preemption.

What fees can practices charge for searching and copying records

For an individual’s HIPAA access request, a covered practice may charge only a reasonable, cost-based fee for permitted costs: labor to make the copy, supplies for a requested paper copy or portable media, postage if the patient requests delivery by mail, and labor to prepare a summary or explanation if the patient agrees to it in advance. HIPAA does not allow a practice to add search-and-retrieval, system maintenance, or compliance costs to the patient-access fee. See HHS guidance on fees for copies of PHI.

South Carolina law also sets annually adjusted caps for record search and duplication. The current schedule, effective July 1, 2026, lists maximum amounts of $0.90 per page for the first 30 pages and $0.68 per additional page, with a clerical-fee maximum of $34.76. The combined cap is $208.63 for electronic copies per request and $278.16 for paper copies per admission; actual postage and applicable sales tax may be added. These state caps are not automatically the amount a practice may charge a patient for a HIPAA access request: the more limited federal cost-based fee rules still apply, and South Carolina bars a search-and-handling fee when the patient makes the request. Check the South Carolina Department of Public Health’s medical-record fee schedule and its 2026 annual adjustment document before applying a rate.

Practices may not withhold records because a patient has an unpaid medical bill. South Carolina also limits charges for X-ray reproduction to actual reproduction costs and requires no charge for copies sent to another provider for referred continuing care. See South Carolina Code §§ 44-115-70 and 44-115-80.

How should a practice respond to a breach of patient information

When an incident may involve unsecured protected health information, promptly contain it, preserve relevant evidence, involve the privacy and security leads, and assess what information and how many people may be affected. Under HIPAA, an impermissible use or disclosure is presumed to be a breach unless the practice documents an applicable exception or a risk assessment demonstrates a low probability that the PHI was compromised. See the HHS Breach Notification Rule.

For a reportable breach of unsecured PHI, the covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. It must also notify HHS; for a breach affecting 500 or more individuals, that notice is due without unreasonable delay and no later than 60 days. If more than 500 residents of a state or jurisdiction are affected, media notice is also required. A business associate must notify the covered entity of a breach without unreasonable delay and no later than 60 days, although the business associate agreement may require faster reporting. See HHS breach-notification requirements.

South Carolina’s breach law may also apply when the incident involves specified personal identifying information and the statutory risk-of-harm conditions are met. It requires notice in the most expedient time possible and without unreasonable delay, subject to a permitted law-enforcement delay; it does not set a general fixed number of days. A business that gives notice to more than 1,000 people at one time must also notify the South Carolina Consumer Protection Division and nationwide consumer reporting agencies. Assess the state and federal rules separately because a health-information incident may trigger one, both, or neither. See South Carolina Code § 39-1-90.

What safeguards and retention policies should practices maintain

The HIPAA Security Rule requires covered entities and business associates to use appropriate administrative, physical, and technical safeguards to protect electronic protected health information. Practices must conduct an accurate and thorough risk analysis, manage identified risks, assign security responsibility, control workforce access, and periodically evaluate and update their protections. See HHS’s summary of the HIPAA Security Rule.

For a neurosurgery practice, practical electronic protected health information safeguards may include role-based access, secure authentication, audit-log review, protected backups, secure transmission, workforce training, and a documented incident-response process. Choose and maintain measures based on the practice’s risk analysis rather than treating any single technology as a substitute for compliance. Contracts with vendors that handle PHI should also address their business-associate obligations.

South Carolina requires physicians to retain records for at least 10 years for adult patients and at least 13 years for minors, measured from the last date of treatment. HIPAA does not set the retention period for patient medical records, but it does require covered entities to retain required HIPAA policies, procedures, and other compliance documentation for six years from creation or from the date it was last in effect, whichever is later. Apply the clinical-record retention rule and the compliance-documentation rule separately, and protect records for as long as they are maintained, including during disposal. See South Carolina Code § 44-115-120, HHS guidance on medical-record retention, and HHS guidance on Security Rule documentation.

In short, practices should pair careful access controls and incident planning with clear procedures for disclosures, patient requests, fees, and retention. Check current state requirements and apply HIPAA’s more specific limits whenever they govern.

FAQs

Do patients need written authorization to obtain or transfer neurosurgery records?

South Carolina law requires a patient’s or legal representative’s written authorization for a physician to provide copies or transfer records to another physician, except where another law provides otherwise. A signed records-request form can document the request and authorization. Transfers for referred continuing care must be provided at no charge. See South Carolina Code §§ 44-115-30, 44-115-40, and 44-115-80.

How long does a South Carolina health care facility have to respond to a records request?

South Carolina law gives a health care facility up to 45 days after discharge or 45 days after receiving the request, whichever is later, and does not compel release before 30 days after discharge. For a HIPAA-covered facility responding to an individual’s access request, the federal deadline is generally 30 calendar days, with one properly documented extension of up to 30 additional days. See South Carolina Code § 44-7-325 and HHS access-timing guidance.

Can a practice charge patients for copies of medical records?

Yes, but a HIPAA-covered practice may charge only a reasonable, cost-based fee for permitted copying labor, supplies, postage when requested, and an agreed-upon summary or explanation. It may not charge the patient for searching for or retrieving PHI, and it cannot withhold records over an unpaid medical bill. South Carolina also requires free copies for referred continuing care. See HHS fee guidance and South Carolina Code §§ 44-115-70 and 44-115-80.

When must a neurosurgery practice notify patients about a data breach?

If a breach of unsecured PHI is reportable under HIPAA, the practice must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. South Carolina’s separate breach law requires notice without unreasonable delay when its personal-identifying-information and risk-of-harm conditions are met. A practice should assess both laws promptly after an incident. See the HHS Breach Notification Rule and South Carolina Code § 39-1-90.