Georgia Skin Biopsy Pathology Reports: A Privacy Laws Checklist

What records are included in a skin biopsy pathology report?

A skin biopsy pathology report records what the laboratory and pathologist found in the tissue sample. It typically includes patient and specimen identifiers, the biopsy site and collection details, a gross description, microscopic findings, and the final diagnosis. Depending on the case, it may also include comments or results from additional tests. The National Cancer Institute’s pathology report guide explains these common sections.

The report is only one part of the biopsy record. Related records may include the laboratory test request, clinical information sent with the specimen, the report and any addenda, and documentation identifying which tissue or specimens were submitted for examination. A pathology report and the physical slides or tissue blocks are separate items; the laboratory may hold the slides and blocks even when the ordering clinician keeps a copy of the report.

For a HIPAA-covered provider or laboratory, a covered entity, a patient’s access rights generally extend to their health information in designated record sets, including clinical laboratory reports and records held on the covered entity’s behalf. HHS guidance on the HIPAA right of access explains what information is covered and the limited exceptions.

How can patients request copies of biopsy records and slides?

Send a written request to the dermatologist or other ordering provider and, if needed, the pathology laboratory that holds the materials. Identify yourself and provide the approximate biopsy date, biopsy site, and ordering clinician. Specify whether you want the final report, any addenda, related records, or a copy of the report sent to another provider.

Georgia law generally requires the provider with custody and control of a patient record to furnish a complete and current copy upon a qualifying written request. It sets a 30-day timeframe and provides for a patient to designate another recipient. Georgia Code Title 31, Chapter 33, including O.C.G.A. § 31-33-2, describes these requirements. HIPAA also generally requires a covered entity to act on an access request within 30 days, with one additional 30-day extension when the required notice is provided. HHS explains the HIPAA response deadlines.

If you need slides for a second opinion, ask the laboratory about its process for reviewing, copying, or transferring physical slides and tissue blocks. A request for the report is not the same as a request to transfer physical pathology materials. Georgia law says the records remain the provider’s property, while providing patients access to copies under applicable requirements; confirm any laboratory procedures and costs before requesting a transfer. Georgia Code § 31-33-3 addresses copying costs and ownership of records.

When may a provider restrict direct access to medical records?

HIPAA allows a covered entity to deny access only on limited grounds. Examples include psychotherapy notes, information prepared for a legal proceeding, and a licensed professional’s determination that access is reasonably likely to endanger someone’s life or physical safety. Some denials must be reviewed by another licensed professional if the patient asks. The provider generally must give a written denial explaining the basis and any review or complaint rights. HHS summarizes the permitted grounds and denial process.

Georgia’s medical-records statute separately says a provider may refuse to furnish a record to the patient if the provider reasonably determines disclosure would be detrimental to the patient’s physical or mental health; upon the patient’s written request, the record must then be furnished to another provider the patient designates. See O.C.G.A. § 31-33-2(c). Because federal access rules and state law can interact, ask the provider to identify the specific basis for any refusal and the available review process. A provider should not treat a general preference to discuss results first as an automatic HIPAA ground for denying access.

How long must Georgia providers retain biopsy reports and slides?

Georgia medical record retention requirements depend on the type of record and who holds it. For providers covered by O.C.G.A. § 31-33-2, evaluations, diagnoses, laboratory reports, and biopsy slides generally must be retained for at least 10 years from the date each item was created. The statute has an exception for hospitals, which retain patient records under the applicable hospital rules. Georgia Code § 31-33-2(a) sets out these distinctions.

Georgia’s clinical laboratory rule separately requires records of surgical pathology to be kept for at least 10 years. It also requires histopathology stained slides to be retained for at least 10 years and tissue blocks for at least two years. These pathology slide retention rules apply to laboratory materials and are distinct from a physician’s general treatment-record retention period. Georgia Rule 111-8-10-.26 and -.15 covers laboratory records and histopathology materials.

A Georgia-licensed physician must maintain a patient’s complete treatment records for at least 10 years from the patient’s last office visit. Hospitals have a separate general patient-record rule requiring retention for at least five years after discharge, or, for a minor, at least five years after the age of majority. Separate laboratory rules may still apply to surgical pathology reports and slides held by the laboratory. Georgia Rule 360-3-.02 covers physician treatment records, and Georgia Rule 111-8-40-.18 covers hospital records.

When can biopsy information be disclosed without patient authorization?

Written authorization for medical record disclosure is not required for every lawful use or disclosure. Under HIPAA, covered entities may use or disclose protected health information for treatment, payment, and health care operations without a patient’s authorization. For example, a provider may share relevant biopsy information with another provider for the patient’s treatment. HHS explains these HIPAA permissions.

HIPAA also permits disclosures in certain circumstances involving public health, health oversight, law enforcement, and other legally recognized purposes. A court order may authorize disclosure of the information specifically described in the order. A subpoena for medical records is different from a court order: a provider may disclose in response to a subpoena only when the Privacy Rule’s notice or qualified protective-order requirements are met. HHS guidance distinguishes court orders from subpoenas.

A patient can also direct records to another person through a written, signed HIPAA access request that identifies the recipient and where to send the information. Georgia’s records statute separately addresses written requests and authorizations for furnishing records to designated recipients. For a patient-directed transfer, ask the provider which form it requires and how federal and state rules apply. HHS describes third-party access requests, and Georgia Code § 31-33-2 describes state requirements.

What rules apply to pathology reports in office-based surgery records?

For office-based surgery settings covered by Georgia Rule 360-41, the physician must maintain a legible, complete, comprehensive, and accurate medical record for each patient. The required record includes appropriate diagnostic reports, a procedure narrative, and pathology reports when relevant. It must also document which tissues and specimens were submitted for histopathologic diagnosis, along with postoperative care, outcome, and follow-up plans. Georgia Rule 360-41-.03 lists these office-based surgery clinical records.

The rule’s record-content requirements do not replace the separate retention rules that may apply to physician records, hospital records, or laboratory-held surgical pathology materials. A practice should identify which entity holds each report, slide, or block and apply the retention requirement for that record and setting.

How are biopsy records protected from public disclosure?

The Georgia public records medical privacy exemption applies to records held by public agencies when disclosure of medical or similar records would invade personal privacy. O.C.G.A. § 50-18-72(a)(2) provides that public disclosure is not required for those records. The exemption concerns public access; it does not prevent a patient from requesting their own records under applicable access laws. The Georgia Attorney General’s text of O.C.G.A. § 50-18-72 sets out the medical-records exemption.

Public-records rules do not make every record held by a government entity automatically confidential. The custodian must apply the relevant privacy law and determine whether protected information should be withheld or redacted. HIPAA separately limits how covered entities may disclose protected health information to the public. The Georgia Composite Medical Board identifies medical records as exempt under the Open Records Act, and HHS summarizes HIPAA’s disclosure limits.

In short, identify who holds the report and slides, submit a clear written request, and distinguish patient access from disclosure to a third party or the public. Georgia retention periods vary by provider and record type, while HIPAA and state privacy rules limit when biopsy information may be shared.

FAQs.

Can a Georgia patient request a copy of a skin biopsy pathology report?

Yes. Georgia law generally allows a patient to request a complete and current copy of their medical record, which can include a skin biopsy pathology report. Make the request in writing to the provider or laboratory that holds the report. HIPAA-covered entities generally must act within 30 days, subject to a permitted extension or limited denial ground. Georgia Code § 31-33-2 and HHS access guidance describe the applicable requirements.

Can a provider send biopsy records directly to another provider at the patient’s request?

Yes. A patient may direct a covered entity to send their information to a designated recipient through a written, signed request that identifies the recipient and where to send the records. HIPAA also permits provider-to-provider disclosures for treatment without the patient’s authorization. Georgia law has separate written-request and authorization language for records sent to a designated recipient, so ask the provider which form applies. HHS guidance on third-party access and Georgia Code § 31-33-2 explain these routes.

How long must Georgia providers retain biopsy slides and reports?

Georgia law generally requires covered providers to retain biopsy slides, laboratory reports, evaluations, and diagnoses for at least 10 years from creation. Clinical laboratories must retain surgical pathology records for at least 10 years and histopathology stained slides for at least 10 years; tissue blocks have a separate minimum retention period of two years. Hospital patient-record retention rules differ, so the record holder and record type matter. Georgia Code § 31-33-2 and Georgia laboratory rules provide the relevant periods.

Can skin biopsy records be released without written authorization?

Sometimes. HIPAA permits disclosures for treatment, payment, and health care operations without written authorization, as well as certain disclosures allowed by law. A court order or a subpoena that meets HIPAA’s requirements may also support disclosure. These exceptions do not authorize unrestricted release to the public; a subpoena is not automatically the same as a court order. HHS’s disclosure guidance and HHS’s court-order and subpoena guidance explain the limits.