HIPAA Compliance Guide for Long-Term Care Ombudsman Programs

When HIPAA applies to long-term care ombudsman access

HIPAA regulates how covered entities and their business associates use and disclose protected health information (PHI). Many long-term care providers are covered entities, but HIPAA does not automatically apply to every facility or every record custodian. A provider generally falls under HIPAA when it conducts certain health care transactions electronically. The HHS overview of the HIPAA Privacy Rule explains which organizations the rule covers.

For State Long-Term Care Ombudsman Programs, HIPAA is not a blanket bar to record access. The Older Americans Act (OAA) treats the Ombudsman and representatives of the Office as a “health oversight agency” for HIPAA purposes, and federal regulations state that HIPAA does not preclude covered entities from releasing resident health information to the program when the applicable access requirements are met. See 42 U.S.C. § 3058g and 45 CFR § 1324.11(e)(2).

That distinction matters: HIPAA permits disclosure in the circumstances described by federal law and regulation; the OAA and its implementing rules establish the program’s access rights and conditions. A facility should not rely on a general claim that “HIPAA forbids it” without considering those provisions.

What federal law allows ombudsmen to access in resident records

The OAA provides for appropriate access to files, records, and other information concerning a resident when the required permission or applicable exception is in place. The implementing regulation describes access to medical, social, and other records relating to the resident, regardless of format, and includes copies upon request. Records relevant to a resident’s concern may include care plans, medication records, incident reports, or care notes, depending on the complaint and applicable program procedures.

Federal rules also address other records separately. Ombudsmen have access to facility administrative records, policies, and documents that residents or the public may access, and the State Ombudsman may obtain state licensing and certification records concerning long-term care facilities. These are distinct from confidential resident records. See 45 CFR § 1324.11(e)(2) and OAA § 712(b).

Access is tied to the Ombudsman Program’s authorized duties, such as investigating and resolving complaints about residents’ health, safety, welfare, or rights. The relevant federal provisions do not give every person who identifies as an ombudsman unrestricted access to every resident’s complete file.

How resident consent affects disclosure of protected health information

When a resident or the resident’s representative communicates informed consent to access, federal regulations allow the Ombudsman representative to review the resident’s medical, social, and other records. Consent may be written, or it may be communicated orally, visually, or through auxiliary aids and services and documented contemporaneously according to program procedures. Check the State Ombudsman Program’s policies for the required steps and documentation.

Federal rules also provide limited routes when consent is unavailable. If the resident is unable to communicate consent and has no legal representative, a representative of the Office may access the records with the Ombudsman’s approval. If a resident representative refuses consent, access may be available when it is necessary to investigate a complaint, the representative has reasonable cause to believe the resident representative is not acting in the resident’s best interests, and the Ombudsman approves access. These conditions appear in 45 CFR § 1324.11(e)(2)(iv).

Consent to a facility’s release of records for access is different from consent to the Ombudsman Program’s later disclosure of identifying information. The OAA and federal regulations separately protect information maintained by the program and restrict its disclosure. See 42 U.S.C. § 3058g(d).

What access rules apply to state long-term care ombudsman programs

The Older Americans Act sets federal requirements for State Long-Term Care Ombudsman Programs, while 45 CFR Part 1324 describes how programs must carry out access and other responsibilities. Under 45 CFR § 1324.11(e)(2), State policies and procedures must provide for timely access to facilities, residents, and appropriate records, including copies upon request. The same provision identifies the circumstances in which resident records may be reviewed.

States may have laws, regulations, and program procedures that explain how federal access requirements are implemented, including how ombudsmen establish their authority, document consent, obtain Ombudsman approval, and handle records. Guardian status and other representative relationships can also depend on state law. The Administration for Community Living notes that state law may provide additional options or authorities; consult the applicable state requirements as well as federal law. See the ACL Long-Term Care Ombudsman FAQ.

The HIPAA minimum necessary guidance from HHS explains the general rule and its exceptions, including disclosures made under an individual’s authorization and disclosures required by law. Because the applicable exception and access authority depend on the circumstances, an ombudsman should identify the complaint-related purpose and the authority for the specific request rather than assume that either a full record or a narrow excerpt is always required.

How to respond to facility privacy objections

When a facility objects on privacy grounds, explain that federal rules specifically state that HIPAA does not preclude covered entities from releasing resident private health information or other identifying information to the Ombudsman Program when the applicable requirements are met. Provide the relevant federal citation, identify the records sought, and state whether access is based on resident consent or on a specific no-consent provision. The key citation is 45 CFR § 1324.11(e)(2)(vii).

If the facility still denies access, ask it to identify the specific legal or procedural basis for the objection and document the request, response, records at issue, and any time-sensitive risk to the resident. Follow State Ombudsman Program escalation procedures, which may include consulting a supervisor, the State Ombudsman, or program counsel. Do not characterize every denial as a HIPAA violation; assess the applicable federal and state access rules and the facts of the request.

Where a resident’s consent is required, present and document it using the program’s approved process. Where an exception is relied on, document how each condition is met, including any required Ombudsman approval. Keep requests and records within the scope of the program’s authorized work and protect information obtained during the investigation.

Documentation and limits on ombudsman access

Document the reason for the request, the resident or complaint involved, the records requested, the legal basis for access, and the steps taken to obtain consent or satisfy an exception. Record how consent was communicated and, when required, the contemporaneous documentation and Ombudsman approval. Follow state policies on copies, secure handling, retention, and destruction.

Federal access rules do not erase the separate confidentiality restrictions on information maintained by the Ombudsman Program. Nor do they authorize access unrelated to the Program’s duties. The minimum necessary standard may apply depending on the legal basis for a disclosure; HHS describes its scope and exceptions in its minimum necessary guidance. When the applicable law requires access or an individual authorizes disclosure, the relevant exception may apply. When it does not, covered entities generally must take reasonable steps to limit PHI to what is necessary for the purpose.

In practice, distinguish the facility’s disclosure of records to an authorized ombudsman from the Ombudsman Program’s later disclosure of resident-identifying information. Confirm the governing federal rule, state requirements, and program policy at each stage; document the basis and limits of access. That approach supports resident advocacy while protecting confidentiality.

FAQs

Can a long-term care ombudsman access a resident’s medical records without consent?

Sometimes. Federal rules permit access without resident consent when the resident is unable to communicate consent and has no legal representative, with approval from the Ombudsman. They also provide a limited exception when a representative refuses consent, access is necessary to investigate a complaint, there is reasonable cause to believe the representative is not acting in the resident’s best interests, and the Ombudsman approves access. See 45 CFR § 1324.11(e)(2)(iv).

Does HIPAA prevent facilities from sharing records with ombudsmen?

No, not categorically. The OAA treats the Ombudsman and representatives of the Office as a health oversight agency for HIPAA purposes, and federal regulations state that HIPAA does not preclude covered entities from releasing resident information when applicable access requirements are met. That does not mean every record request is automatically authorized; the relevant access conditions still apply. See 42 U.S.C. § 3058g(b)(3) and 45 CFR § 1324.11(e)(2)(vii).

What information may an ombudsman access under federal rules?

With the required consent or an applicable exception, an ombudsman may review medical, social, and other records relating to a resident, regardless of format, and request copies. Federal rules also provide access to facility administrative records and policies that residents or the public may access, as well as state licensing and certification records for the State Ombudsman. The precise request must relate to the Program’s authorized work and comply with the applicable access conditions.

Can a resident limit an ombudsman’s access to their records?

A resident who can communicate consent can choose whether to provide it for access to their records. If the resident does not consent, the federal no-consent exceptions are limited and must meet their stated conditions; they do not create general authority to disregard a resident’s wishes. If a resident has a legal representative, the rules and applicable state law may also affect consent and access. Contact the State Ombudsman Program for help applying those requirements to a specific situation.