Alaska Guide to Privacy Laws for Plasma Exchange Treatment Records

How can patients access plasma exchange treatment records in Alaska?

Alaska Statute 18.23.005 entitles a patient to inspect and copy records developed or maintained by a health care provider or another person that concern care rendered to the patient. The statute applies generally to health records; it does not establish a separate access rule just for plasma exchange treatment records. Alaska Statutes, AS 18.23.005

To request records, contact the facility’s medical-records department or privacy officer. In a written request, identify the dates of treatment and the records you want—such as treatment notes, lab results, medication records, consent forms, or billing records—and say whether you want to inspect them, receive copies, or both.

If HIPAA applies, a covered provider generally must act on an access request within 30 calendar days. It may take one additional 30-day period if it gives you written notice within the initial period explaining the delay and the expected response date. HIPAA also limits any copying fee to specified reasonable, cost-based charges. HHS guidance on access-request deadlines

When may a facility disclose patient records without written consent?

A facility does not need a patient’s written authorization for every disclosure. Under HIPAA, covered providers may generally use or disclose protected health information for treatment, payment, and health care operations. The rules also permit or require certain disclosures for purposes such as public health, health oversight, and legal requirements, subject to the conditions that apply to each category. HHS summary of the HIPAA Privacy Rule

HIPAA distinguishes voluntary consent from a formal written authorization. A provider generally needs a valid written authorization for a use or disclosure that is not otherwise permitted or required by the Privacy Rule. HHS explanation of consent and authorization

Alaska’s health information exchange (HIE) has additional rules. Under AS 18.23.310, as amended by SB 272, individually identifying information in the statewide exchange may be released for treatment, payment, limited health care operations of a participant, public health activities, or uses and disclosures authorized by the individual. Whether a particular disclosure is permitted depends on the purpose and applicable state and federal requirements. Alaska SB 272 text amending AS 18.23.310

AS 18.23.010 is not a general authorization to disclose a patient’s treatment records. It concerns information furnished to a review organization: it limits liability for furnishing information unless it is knowingly or negligently false in the statutory sense, and says physician-patient privilege cannot be used to withhold pertinent information from such a review. Alaska Statutes, AS 18.23.010

What safeguards must medical facilities use to protect records?

HIPAA requires covered entities to use appropriate administrative, physical, and technical safeguards to protect protected health information. These medical record security safeguards should be reasonable for the organization and the information it handles; they are intended to prevent impermissible access, use, or disclosure and to limit incidental disclosures. HHS guidance on HIPAA safeguards

For electronic protected health information, the HIPAA Security Rule requires safeguards that protect its confidentiality, integrity, and availability. Facilities can use measures such as access controls, secure storage and transmission, workforce procedures, and appropriate monitoring; HIPAA does not prescribe one identical technical setup for every facility. HHS overview of the HIPAA Security Rule

Alaska’s HIE law specifically requires privacy and security standards for individually identifiable information in the exchange, including controls over access and a secure, traceable electronic audit system. Alaska law also permits patients to request an audit report through the exchange’s established procedures. Alaska SB 272 text amending AS 18.23.310

How do Alaska health information exchange privacy rules apply?

An HIE allows participating organizations to exchange health information for specified purposes; it does not make patient records public information. Alaska’s law restricts release of individually identifying information in the statewide exchange to purposes listed in AS 18.23.310, including treatment, payment, limited health care operations, public health activities, and uses or disclosures authorized by the individual. Alaska SB 272 text amending AS 18.23.310

The law requires procedures through which a patient can opt out, authorize distribution when additional authorization is required, receive notice of a confidentiality violation, and request an audit report. Contact the provider or the HIE designee to learn how to use those procedures. Opting out of the exchange is distinct from requesting a copy of records held by a treating provider.

These rules protect health information exchange confidentiality while allowing specified sharing. The HIE rules operate alongside HIPAA and other applicable privacy laws; they do not turn the exchange into a public database or permit unrestricted disclosure.

What records may patients inspect and copy?

Under Alaska Statute 18.23.005, patients are entitled to inspect and copy records developed or maintained by a provider or another person that pertain to the health care they received. Depending on what the facility maintains, a request for plasma exchange records may include treatment notes, laboratory results, medication and procedure records, consent forms, and related billing records. Alaska Statutes, AS 18.23.005

HIPAA generally gives patients access to protected health information in designated record sets maintained by or for covered providers, including medical and billing records. Limited exceptions apply, such as separately maintained psychotherapy notes and certain information prepared for legal proceedings. If a provider denies all or part of your request, ask it to identify the records withheld and explain the basis for the denial. HHS guidance on information patients may access

What should patients do if records are lost or disclosed without authorization?

Contact the facility’s privacy officer or medical-records department promptly. Describe what happened, when you learned of it, and which records may be involved. Ask the facility to investigate, explain what information was affected and what steps it is taking, and tell you how to request an HIE audit report if the records were in the exchange.

A lost record or suspected disclosure does not by itself establish that HIPAA requires breach notification. If an incident involves a reportable breach of unsecured protected health information, covered entities generally must notify affected individuals without unreasonable delay and no later than 60 days after discovery. Alaska’s HIE law also requires procedures for notifying patients about confidentiality violations. HHS guidance on breach notification and Alaska SB 272 text amending AS 18.23.310

Keep copies of your request and any response. If you believe a covered entity violated HIPAA, you may file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. A complaint generally must be filed within 180 days after you knew of the alleged violation, though OCR may extend that period for good cause. HHS Office for Civil Rights complaint process

In short, Alaska’s general access law covers plasma exchange records, HIPAA and state law govern permitted disclosures and safeguards, and patients can ask providers or the HIE about access, audit procedures, and suspected incidents.

FAQs

Are plasma exchange treatment records specifically protected by an Alaska privacy statute?

The cited Alaska statutes do not create a separate privacy statute specifically for plasma exchange records. General patient-access law and applicable privacy requirements—including HIPAA for covered entities and Alaska’s HIE confidentiality rules for information in the exchange—may apply.

Can I request a copy of my plasma exchange treatment records in Alaska?

Yes. Alaska Statute 18.23.005 entitles patients to inspect and copy records pertaining to health care rendered to them. Contact the provider or record holder and identify the records and treatment dates you are requesting.

When can a provider disclose my records without written consent?

HIPAA permits certain disclosures without written authorization, including many disclosures for treatment, payment, and health care operations, as well as specified disclosures required or permitted by law. Records in Alaska’s HIE are subject to the additional purposes and procedures in AS 18.23.310.

Are records in an Alaska health information exchange public information?

No. Individually identifying information in the statewide exchange is subject to statutory privacy and security controls and may be released only for purposes allowed by law. The HIE is not a public database.