Alaska EMS Run Sheet Privacy Laws for Patient Care Reports: What Providers Need to Know

Patient Care Report Requirements

Alaska requires a Patient Care Report (PCR) for every patient you treat outside the hospital. At a minimum, the PCR must document the patient’s vital signs and all medical care rendered during the encounter. ([regulations.justia.com](https://regulations.justia.com/states/alaska/title-7/part-2/chapter-26/article-2/section-7-aac-26-245/))

EMS Medical Director Access is built into state rules. Your PCR must be made available to your service’s medical director, who is responsible for periodically reviewing reports to evaluate the appropriateness of care. ([regulations.justia.com](https://regulations.justia.com/states/alaska/title-7/part-2/chapter-26/article-2/section-7-aac-26-245/))

Report Submission and Retention

You must make a copy of the completed PCR available to the receiving treatment facility no later than 24 hours after patient delivery. In addition, the PCR must be submitted to the Alaska Department of Health as part of statewide data collection. ([regulations.justia.com](https://regulations.justia.com/states/alaska/title-7/part-2/chapter-26/article-2/section-7-aac-26-245/))

Patient Care Report Retention: keep each PCR for the longer of seven years or three years past the patient’s 18th birthday (for minors). Maintain retrievable records—electronic or paper—for the full retention period, and ensure they remain accessible for EMS Medical Director review and regulatory audits. ([regulations.justia.com](https://regulations.justia.com/states/alaska/title-7/part-2/chapter-26/article-2/section-7-aac-26-245/))

Compliance with NEMSIS Standards

NEMSIS Compliance is mandatory in Alaska. A PCR must conform to the National Emergency Medical Services Information System (NEMSIS) standard and be submitted to the department; the Alaska Office of EMS currently uses the NEMSIS v3.5 dataset. ([regulations.justia.com](https://regulations.justia.com/states/alaska/title-7/part-2/chapter-26/article-2/section-7-aac-26-245/))

Use NEMSIS-compliant ePCR software validated through the NEMSIS Technical Assistance Center’s compliance testing process to ensure your system captures required elements and passes state and national validation rules. ([nemsis.org](https://nemsis.org/technical-resources/version-3/v3-compliance/?utm_source=openai))

Confidentiality and Privacy Protections

Your PCR contains Protected Health Information and must be safeguarded under HIPAA and Alaska rules. State regulations allow the department to provide de-identified EMS data (without patient, physician, or hospital identifiers) to researchers and planners for epidemiologic studies, supporting privacy while enabling system improvement. ([regulations.justia.com](https://regulations.justia.com/states/alaska/title-7/part-2/chapter-26/article-2/section-7-aac-26-245/))

Limit access to workforce members who need the information to perform their jobs, including quality assurance staff and the medical director. When records are disclosed for performance evaluation, Alaska law prohibits the recipient from further disclosing those records to anyone not entitled to receive them. ([law.justia.com](https://law.justia.com/codes/alaska/title-18/chapter-08/section-18-08-087/))

• Confidentiality Safeguards: role-based access, audit logging, encryption of ePCR data in transit and at rest, secure device management, and routine privacy training.
• Data minimization: include only necessary details; avoid unnecessary identifiers in attachments and narratives.

Authorized Release of Patient Information

Legal Disclosure Exceptions allow certain disclosures without written consent. In Alaska, these include: providing the PCR to the receiving facility within 24 hours; making it available to the medical director and submitting it to the Department of Health; limited, necessary disclosures of medical records for provider performance evaluation; public health reporting of specified conditions; and sharing de-identified data for research and planning. ([regulations.justia.com](https://regulations.justia.com/states/alaska/title-7/part-2/chapter-26/article-2/section-7-aac-26-245/))

Outside these exceptions and routine treatment, payment, and health care operations, do not release PCR details without a valid authorization from the patient or an authorized representative.

Written Consent Procedures

When a disclosure is not otherwise permitted, obtain Written Consent Documentation before releasing information (for example, to an attorney, employer, school, insurer beyond billing, or media). A strong authorization should:

• Identify the patient and the recipient; specify the records to be released (date range, incident number, or data elements).
• State the purpose of disclosure and an expiration date or event.
• Acknowledge the patient’s right to revoke in writing and note that information disclosed may be re-disclosed by the recipient.
• Include signature, date, and relationship/authority if signed by a representative (e.g., parent or legal guardian).
• Be stored with the PCR and logged in a disclosure record for audit purposes.

Safeguarding Confidential Information

Protect PCRs across their lifecycle. Implement administrative safeguards (policies, workforce training, sanctions), technical safeguards (unique user IDs, MFA, device encryption, secure messaging instead of SMS), and physical safeguards (locked areas, clean desk, controlled disposal/shredding). Regularly test backups and incident-response plans.

For ePCR systems, use least-privilege access, enable automatic log-off, and perform routine validation to catch errors before state submission. Avoid using personal devices for PHI unless they are enrolled in mobile device management with remote wipe capability.

Conclusion

Alaska EMS run sheet privacy laws center on complete, timely NEMSIS-compliant PCRs, strict Patient Care Report Retention rules, and clear boundaries for who may access or receive patient information. When in doubt, limit disclosures to what the law allows, document written consent, and apply robust confidentiality safeguards. ([regulations.justia.com](https://regulations.justia.com/states/alaska/title-7/part-2/chapter-26/article-2/section-7-aac-26-245/))

FAQs.

What are the retention requirements for Alaska EMS run sheets?

Keep each PCR for the longer of seven years or three years past the patient’s 18th birthday. Make a copy available to the receiving facility within 24 hours and ensure the report remains available to your medical director for review. ([regulations.justia.com](https://regulations.justia.com/states/alaska/title-7/part-2/chapter-26/article-2/section-7-aac-26-245/))

When can patient information be disclosed without consent?

Without a written authorization, you may disclose as permitted by law, including: to the receiving facility within 24 hours; to the medical director and to the Department of Health for mandated submissions; for limited provider performance evaluation under state statute; for required public health reporting; and in de-identified form for research and planning. ([regulations.justia.com](https://regulations.justia.com/states/alaska/title-7/part-2/chapter-26/article-2/section-7-aac-26-245/))

How must EMS services comply with NEMSIS?

Document care in an ePCR that meets the NEMSIS standard, use software that has passed NEMSIS compliance testing, and submit data to the state in the current Alaska dataset (v3.5). Monitor state and NEMSIS guidance for validation and version updates. ([nemsis.org](https://nemsis.org/technical-resources/version-3/v3-compliance/?utm_source=openai))