New Hampshire Guide to Privacy Laws for Blood Pressure Screening Logs

When does a blood pressure screening log qualify as medical information?

A blood pressure screening log is more likely to qualify as medical information when it connects readings to an identifiable person and is kept by a healthcare provider as part of that person’s care or medical record. New Hampshire law addresses medical information in records held by healthcare providers and by vendors contracted to store, handle, or provide copies of those records. New Hampshire RSA 332-I:1

If a log includes a name, date of birth, contact details, or another identifier alongside blood pressure readings, it may contain protected health information (PHI) when a HIPAA-covered provider or business associate maintains it. Whether HIPAA applies depends on the organization and its role—not just on the fact that the log contains health data. A one-time community screening organizer that is not a covered entity or business associate may not be covered by HIPAA, although other privacy obligations may apply.

These distinctions matter for New Hampshire medical records confidentiality: a provider’s patient-specific log may be part of the patient’s medical record, while an anonymous tally used for general statistics may not identify a patient.

Who may access screening logs and under what conditions?

Within a HIPAA-covered organization, access should be limited according to staff members’ job duties. For example, a clinician involved in a patient’s care may need relevant readings, while other staff should see them only when needed for their authorized work. HIPAA requires covered entities to set role-based access policies; when its minimum-necessary rule applies, they must also limit information to what is reasonably needed for the purpose. HHS Summary of the HIPAA Privacy Rule

New Hampshire law generally says a healthcare provider may not reveal a patient’s confidential communications or information without consent, unless disclosure is provided for by law or needed to protect the individual’s welfare or the public interest. HIPAA also permits certain uses and disclosures without an individual’s authorization, including for treatment, payment, and healthcare operations, as well as for specific public-interest purposes. The rules depend on the circumstances, and an exception is not blanket permission to disclose a whole record. New Hampshire RSA 332-I:2 · HHS Summary of the HIPAA Privacy Rule

Patients and their legally recognized personal representatives can also have access rights. New Hampshire law identifies certain representatives, including a person authorized through a valid power of attorney, as requestors for medical records. A provider should verify a representative’s authority before releasing identifiable screening information.

When can a healthcare provider disclose screening log information?

A provider may disclose screening information without patient consent when a disclosure is permitted or required by applicable law. Under HIPAA, permitted situations include treatment, payment, healthcare operations, certain public-health activities, and disclosures required by law. Some exceptions have specific conditions, so a provider should confirm the purpose, recipient, and applicable requirements before sharing a log. HHS Summary of the HIPAA Privacy Rule

For a disclosure that does not fit a permitted or required exception, the provider generally needs the patient’s valid written HIPAA authorization. The authorization should identify the information to be disclosed, who may disclose it, the recipient, and other required details. New Hampshire law specifically prohibits using or releasing identifiable patient medical information for sales or marketing of services or products without written authorization. New Hampshire RSA 332-I:1 · HHS Summary of the HIPAA Privacy Rule

For most disclosures where HIPAA’s minimum-necessary rule applies, the provider should share only the information reasonably needed for the stated purpose. The rule has exceptions, including disclosures to another provider for treatment and disclosures to the patient. A patient’s consent or authorization should not be treated as permission for unrelated uses.

How can patients request copies of screening records?

Send a request to the provider or its medical-records department, clearly identifying the blood pressure screening log, relevant dates, and preferred delivery format. You may be asked to verify your identity. If someone is requesting the record for you, the provider may ask for documentation showing that person’s legal authority.

New Hampshire law entitles patients or qualifying requestors to copies of medical records held by a healthcare provider or its contracted records vendor. If the record is available electronically, the provider must supply it in that format unless you specifically request paper. The statute sets a 30-day timeframe for providing records and requires healthcare-provider-to-provider transfers within 14 days. It also sets fee limits and requires qualifying provider-to-provider transfers at no cost. New Hampshire RSA 332-I:1

HIPAA also generally gives individuals the right to inspect or obtain copies of PHI in a covered entity’s designated record set, subject to limited exceptions. If a log is maintained by a vendor on the provider’s behalf, the provider remains responsible for fulfilling the patient’s access rights; its contract should require the vendor to make the information available as needed. HHS Summary of the HIPAA Privacy Rule · HHS Guidance on Business Associate Obligations

How do health information exchange rules affect access to screening logs?

New Hampshire law allows protected health information to be transmitted through the state’s health information organization. Under RSA 332-I:3, access to information transmitted through that organization is limited to healthcare providers for treatment, care coordination, or quality assurance, and to the patient or the patient’s legal representative with respect to that patient’s information. The law also requires an opportunity to opt out of sharing through the health information organization. New Hampshire RSA 332-I:3

The health information organization and participating parties must maintain audit logs that record specified access details, including the provider, patient, date, and area of the record accessed. These rules set health information exchange access restrictions; they do not make every exchange participant eligible to view every patient’s information. Patients who want to opt out should ask their provider how to submit the choice and confirm which exchange it covers.

Opting out of sharing through the health information organization is distinct from requesting deletion of the provider’s own medical record. The statute addresses sharing through that exchange, so ask the provider how the choice affects other systems or exchange arrangements.

What privacy safeguards should providers use for screening logs?

Providers should secure paper logs from public view and store them in controlled areas. For electronic logs, safeguards can include unique user accounts, access controls, secure transmission, and audit logs. HIPAA requires covered entities to use reasonable administrative, technical, and physical safeguards to protect PHI, and to limit workforce access according to job responsibilities. HHS Summary of the HIPAA Privacy Rule

When a vendor stores, handles, or issues copies of provider records, the provider should define the vendor’s permitted uses and disclosures in a written agreement. HIPAA business associate agreements must address safeguards, reporting unauthorized uses or disclosures, and making records available to help the provider meet patient-access obligations. These medical records vendor obligations do not transfer the provider’s responsibility for responding to a patient’s request. HHS Business Associate Contract Guidance

In short, a blood pressure log’s privacy depends on whether it identifies a patient, who maintains it, and why it is accessed or shared. Providers should protect identifiable records, honor applicable access and consent rules, and explain available HIE choices to patients.

FAQs

Are blood pressure screening logs confidential under New Hampshire law?

They may be. When an identifiable log is part of a healthcare provider’s medical record, New Hampshire’s confidentiality and medical-record rules may apply, along with HIPAA when the organization is covered by that law. A log collected outside a covered healthcare setting may be treated differently, so the organization’s role and the record’s use matter.

Can a provider disclose screening log information without patient consent?

Sometimes. New Hampshire law allows disclosure in circumstances provided for by law or needed to protect a person’s welfare or the public interest. HIPAA also permits certain disclosures without authorization, including for treatment, payment, healthcare operations, and specified public-interest purposes. Other disclosures may require written patient authorization.

Can patients request a copy of their blood pressure screening records?

Generally, yes, if the log is part of the patient’s medical record or PHI in a covered entity’s designated record set. New Hampshire law provides for copies on request, electronic delivery when the record is available electronically, and a 30-day response timeframe, subject to statutory terms and exceptions. Contact the provider’s medical-records department to make a patient medical record copy request.

Who can access protected health information in a health information exchange?

Under New Hampshire RSA 332-I:3, healthcare providers may access PHI transmitted through the state’s health information organization for treatment, care coordination, or quality assurance. The patient or the patient’s legal representative may access that patient’s information. New Hampshire law also requires an opportunity to opt out of sharing through the organization.