Louisiana Privacy Laws Checklist for Performing Arts Medicine Clinics

Which Louisiana privacy laws apply to performing arts medicine clinics?

Louisiana does not create a separate privacy category for clinics serving dancers, musicians, actors, or other performers. The rules that apply depend on the clinic’s providers, services, care setting, and the information it holds—not the patient’s profession.

For clinics that meet HIPAA’s definition of a covered entity, the federal HIPAA Privacy, Security, and Breach Notification Rules govern protected health information. A health care provider generally becomes a covered entity when it electronically conducts a transaction for which HIPAA has adopted a standard, such as certain insurance claims. HIPAA protects individually identifiable health information in paper, electronic, and oral form; its Security Rule specifically covers electronic protected health information. See the HHS HIPAA Privacy Rule summary and HHS HIPAA Security Rule summary.

Louisiana law adds requirements concerning medical-record confidentiality, patient access, record retention, and subpoenas. The state’s telehealth statute also requires licensing boards to apply confidentiality protections and patient rights to records created during telehealth interactions. For physicians, relevant rules include Louisiana Revised Statutes 40:1165.1, 13:3734, and 40:1223.4, along with the physician telemedicine rules in Title 46 of the Louisiana Administrative Code.

In practice, a performer’s injury notes, rehabilitation plans, imaging, and treatment communications are medical information—not information a dance company, production, school, or employer may automatically obtain. Use an appropriate authorization or another legally permitted basis before sharing it.

How should clinics protect paper and electronic medical records?

HIPAA-covered clinics must use reasonable safeguards to protect health information in any form. The Security Rule requires covered entities and business associates to implement administrative, physical, and technical safeguards for electronic health information security. The specific measures should reflect the clinic’s size, systems, and risks; HIPAA does not prescribe one identical technology setup for every practice.

• Paper records: Store charts and imaging media in access-controlled areas, avoid leaving records visible in treatment rooms or backstage settings, and securely destroy information when it is eligible for disposal.
• Electronic records: Limit user access to job-related needs, use unique user accounts, review system access, and maintain a plan for backups and security incidents.
• Devices and communications: Assess risks involving laptops, phones, remote access, email, and file transfers. Depending on that assessment, safeguards may include encryption, multifactor authentication, and secure messaging.
• Service providers: If a vendor creates, receives, maintains, or transmits protected health information for a HIPAA-covered clinic, determine whether the vendor is a business associate and put a business associate agreement in place when required.

These steps are operational controls, not a claim that any single product or “HIPAA certification” makes a clinic compliant. Review the current HIPAA Security Rule requirements and conduct a documented, risk-based assessment of the clinic’s systems and workflows.

When may patient records be disclosed?

A clinic may generally use or disclose protected health information for treatment, payment, and health care operations without a separate HIPAA authorization, subject to the Privacy Rule’s requirements. Other disclosures usually need a valid authorization or a specific legal basis. For example, a performer’s employer or artistic director does not become entitled to treatment records simply because the clinic is treating an injury that affects rehearsals or work. See HHS guidance on treatment, payment, and health care operations.

For an authorized disclosure of health information, verify the requester’s identity, authority, purpose, and requested scope. Apply the minimum-necessary standard when it applies, and document the disclosure as required by the clinic’s policies and applicable law. HIPAA does not apply its minimum-necessary standard to disclosures to health care providers for treatment, but it does apply it to many other routine disclosures.

A health care records subpoena is not automatically permission to send an entire chart. Louisiana Revised Statute 13:3715.1 sets requirements for subpoenas seeking medical records, including patient notice and service timing in specified litigation situations. HIPAA separately permits disclosures in response to a court order only for information the order authorizes; a subpoena or other lawful process must meet applicable Privacy Rule conditions. Review the request, scope, notice, and any objection or protective order before producing records. See Louisiana Revised Statute 13:3715.1 and HHS guidance on court orders and subpoenas.

Louisiana law also recognizes patient authorization for certain disclosures and addresses provider-patient confidentiality and privilege. Clinics should route subpoenas, court orders, and other disputed requests to a designated records custodian or legal counsel rather than treating every request as routine. See Louisiana Revised Statute 13:3734.

How can patients or authorized representatives access treatment records?

Louisiana Revised Statute 40:1165.1 gives patients and certain authorized representatives a right of access to obtain copies of treatment records. A patient can submit a written request; an authorized representative should provide documentation of authority and any required signed authorization. A clinic should verify identity and authority before releasing records, particularly when the request concerns a minor or a deceased patient.

Louisiana law generally requires a provider to furnish requested records within a reasonable period, no later than 15 days after receiving the request and written authorization. The statute covers treatment records and provides for copies of imaging media as well. HIPAA independently provides a right of access and generally sets a 30-calendar-day response limit, so clinics should follow the shorter applicable Louisiana deadline. See Louisiana Revised Statute 40:1165.1 and HHS guidance on HIPAA access deadlines.

The statute allows limited denial of access where the provider reasonably concludes that access could harm the patient’s health or welfare or endanger another person’s safety. If a request raises that issue, the clinic should follow the governing law and its review procedures instead of issuing an informal blanket refusal.

How long must medical records and diagnostic images be retained?

Under Louisiana’s physician medical record retention statute, physicians must retain medical and dental records for at least six years from the date the patient was last treated. Diagnostic imaging retention requirements are different: physicians must retain diagnostic images, X-ray films, and similar materials for at least three years from the last treatment date, and for longer when the patient requests this in writing. See Louisiana Revised Statute 40:1165.1(A)(3).

The Louisiana State Board of Medical Examiners advises physicians to retain a minor’s records until the patient turns 21 or for six years after the last treatment, whichever period is longer. The Board also emphasizes arranging for patient access if a physician leaves, relocates, retires, or closes a practice. See the Board’s April 2025 records-retention guidance.

Hospital records may have a different schedule from a physician’s office records: Louisiana law generally requires hospitals to retain hospital records for at least 10 years after discharge, while diagnostic images are generally retained for at least three years after discharge. Check the rule that matches the record custodian and care setting. HIPAA itself does not set a general medical-record retention period, although it requires appropriate safeguards for records while they are maintained. See Louisiana’s Hospital Records and Retention Act and HHS guidance on HIPAA and medical-record retention.

What privacy steps are required for telemedicine?

Louisiana’s telehealth statute applies health-information confidentiality laws and patient rights to information created during telehealth interactions. For physicians, Louisiana Administrative Code Title 46, Part XLV, Chapter 75 includes specific telemedicine privacy, recordkeeping, disclosure, and consent rules. Check the Louisiana Administrative Code and the Louisiana State Board of Medical Examiners rules page for the applicable provisions and current compilation.

Before using telemedicine, physicians must ensure that specified information has been disclosed to the patient and documented in the medical record. This includes the physician’s name, Louisiana license number and contact information; specialty or practice area; how to obtain follow-up or emergency care; how to obtain or transfer records; what to do if technology fails; and notice of privacy practices. The rules also require physicians to inform patients of the physician-patient relationship and other providers’ roles, and that patients may decline telemedicine or withdraw from it.

Use secure communication technology and protect telehealth notes, images, and other encounter data as confidential medical information. Document the visit in the record according to the applicable standard of care. For technology and workflow choices, HHS recommends assessing privacy and security risks, confirming who is present, and using vendors that meet applicable HIPAA requirements and enter into business associate agreements when required. See Louisiana Revised Statute 40:1223.4 and HHS telehealth privacy and security guidance.

Physician-specific rules may not be identical to rules for physical therapists, athletic trainers, or other clinicians. Clinics offering services through multiple professions should check the licensing requirements that apply to each provider.

What are the limits of Louisiana-specific requirements for performing arts medicine clinics?

Louisiana’s cited record, confidentiality, subpoena, and telehealth requirements do not create a distinct privacy regime for a clinic because it treats performing artists. The same core duties apply whether the patient is a touring musician, a professional dancer, an actor, or another patient. The practical focus is protecting medical information and disclosing it only when authorized or otherwise permitted by law.

Requirements can still vary by the provider’s license, whether the clinic is part of a hospital, the patient’s age, the type of record, and the reason for disclosure. Certain specially protected records, such as federally protected substance-use-disorder treatment records, may have additional rules. This checklist is general information, not a substitute for legal advice about a particular request, retention plan, or clinic structure.

For a practical review, confirm which privacy rules cover the clinic, protect paper and electronic records, verify each disclosure request, meet access deadlines, follow the retention schedule for the relevant record type, and apply the telemedicine rules for each provider’s license.

FAQs.

Do Louisiana privacy rules apply specifically to performing arts medicine clinics?

No separate Louisiana privacy regime applies solely because a clinic serves performing artists. General state and federal health-information rules apply based on the clinic’s providers, services, records, and care setting.

How long must Louisiana physicians retain patient medical records?

Physicians generally must retain medical records for at least six years after the patient’s last treatment. Diagnostic images and similar materials generally have a three-year minimum, with longer retention when a patient requests it in writing. For a minor, the Louisiana State Board of Medical Examiners advises retaining records until age 21 or six years after the last treatment, whichever is longer.

When can a Louisiana clinic disclose records in response to a subpoena?

A clinic should disclose records only after confirming the subpoena is lawful, applicable notice and service requirements have been met, and any HIPAA conditions are satisfied. A court order authorizes disclosure only of the information it specifies. A subpoena alone does not automatically permit release of the entire chart.

What privacy information must physicians provide to telemedicine patients?

Louisiana’s physician telemedicine rules require disclosure of the physician’s identity, Louisiana license number and contact details, specialty or practice area, follow-up and emergency-care options, how to obtain or transfer records, what to do if technology fails, and privacy-practices information. Physicians must also explain the provider relationship and that the patient may decline or withdraw from telemedicine care.