Utah Guide to Privacy Laws for Bone Marrow Biopsy Reports

How HIPAA Protects Bone Marrow Biopsy Reports

A bone marrow biopsy report may include pathology findings, laboratory results, and other details about your health. When an identifiable report is held by a HIPAA-covered health care provider or its business associate, it is protected health information (PHI). HIPAA generally covers providers that electronically transmit health information in connection with certain standard transactions, such as claims; using email alone does not make a provider covered. See the HHS Summary of the HIPAA Privacy Rule.

HIPAA requires covered providers to safeguard PHI and limits when they may use or disclose it. It does not make a report absolutely secret: the Privacy Rule allows certain disclosures without your authorization, while requiring written authorization for uses and disclosures that are not otherwise permitted or required. A final clinical laboratory report is generally among the health records you can request.

Who Can Access a Bone Marrow Biopsy Report

You generally have the right to access your report. A personal representative may also have access to the extent their legal authority covers the relevant health care decisions. Depending on the circumstances, that person could be someone with a health care power of attorney or a court-appointed guardian. A parent or guardian often acts for a minor, but state-law rules and exceptions for certain minor health care may affect access. HHS explains these categories in its guidance on personal representatives under HIPAA.

A relative is not automatically entitled to your complete medical record simply because they are family. A provider may share information directly relevant to a family member’s involvement in your care or payment when HIPAA’s conditions are met, such as when you agree or do not object. You can also direct a provider in writing to send a copy to someone you choose.

Utah law provides that a provider may recognize a deceased patient’s surviving spouse or adult child as a personal representative. A provider may ask for documents showing the requester’s identity and authority before releasing a report. See Utah Code §§ 78B-5-618 and 78B-5-619.

How Patients Can Request or Obtain Copies of Records

Contact the hospital, hematologist, pathology department, or laboratory that maintains the report. Use its medical-records request process or patient portal, and identify the biopsy date and the specific report you want. If a representative is making the request, include documentation of their authority.

HIPAA generally requires a covered provider to act on an access request within 30 days. It may take one additional 30-day extension if it gives you a written explanation and the expected response date within the original period. Utah law ties patient-record requests to these HIPAA deadlines. See HHS guidance on the right of access and Utah Code § 78B-5-618.

You may request an electronic copy when available. Utah law allows a reasonable, cost-based fee for a patient’s copy, limited to copying costs and postage when you request mailing; a provider may not deny access because you have an unpaid bill for care. If you believe the report is inaccurate or incomplete, you can request an amendment. If the provider denies the request, you can submit a statement of disagreement for the record. These are medical record amendment rights, not a right to require a provider to change a finding simply because you disagree with it. See HHS guidance on medical records, fees, and corrections.

When Providers May Disclose Reports Without Authorization

A permitted disclosure under HIPAA can include sharing relevant information with another provider for treatment, or using and disclosing information for payment and health care operations. For example, a pathologist or laboratory may share a report with the clinician coordinating your care, and a provider may share appropriate information to process a claim. HIPAA also allows certain disclosures for public health, health oversight, and other purposes specified by law. See the HHS summary of permitted uses and disclosures.

Other legal processes may permit or require disclosure in specific circumstances. A provider may disclose the information expressly covered by a court order. A subpoena issued by an attorney or another non-judge is different from a court order; HIPAA generally requires specified safeguards, such as notice to you or a qualified protective order, before a provider responds. The rules also allow certain limited disclosures to law enforcement and public authorities. See HHS guidance on court orders and subpoenas.

These exceptions do not give every requester unrestricted access to your entire record. The applicable HIPAA provision and any other relevant law determine what may be disclosed and to whom.

How Utah Law Protects Genetic Information

Some bone marrow evaluations may include genetic or molecular testing, but not every biopsy report contains genetic information. Utah’s Genetic Testing and Procedure Privacy Act defines “private genetic information” and excludes, among other things, information derived from a test performed because of signs, symptoms, or other manifestations of a disease or disorder. Whether a particular result falls within the statute depends on the test and circumstances. See Utah Code §§ 13-60-203 through 13-60-205.

Utah restricts employers from accessing or considering private genetic information in certain employment decisions, subject to statutory exceptions. Health insurers also face restrictions involving private genetic information about asymptomatic individuals, with exceptions related to claims and payment for care. These provisions are not a blanket ban on every disclosure of medical or genetic information.

Utah separately requires a direct-to-consumer genetic testing company to obtain written consent before disclosing a consumer’s genetic data to an employer or to an entity offering health, life, or long-term care insurance. That Utah genetic testing disclosure consent rule applies to direct-to-consumer companies; the statute says it does not apply to PHI collected by a HIPAA-covered entity or business associate. A clinical biopsy report is therefore not automatically governed by the same rules as genetic data held by a consumer testing company.

Exceptions and Limits on Medical Record Privacy

HIPAA access rights have limited exceptions. For example, certain information prepared for legal proceedings may be excluded from the right of access, and a provider may deny access in specified situations where a licensed professional determines that access is reasonably likely to cause serious harm. A denial must follow HIPAA’s applicable procedures; it is not a general option to withhold a report because a provider expects you may find it upsetting.

You may ask a provider to restrict certain uses or disclosures, but HIPAA generally does not require the provider to agree to every restriction request. Other laws may also govern particular records or disclosures. If a provider refuses your request for a report or you are concerned about a disclosure, ask for the reason and the provider’s privacy contact.

In short, HIPAA and Utah law generally give you a way to obtain your biopsy report while limiting who else may receive it. Access for representatives, disclosures without authorization, and genetic-information protections depend on the person requesting the report, the purpose, and the specific information involved.

FAQs

Can I obtain a copy of my bone marrow biopsy report in Utah?

Generally, yes. Request the report from the provider, hospital, or laboratory that maintains it. HIPAA usually requires a response within 30 days, with one possible 30-day extension if the provider gives you the required written notice. Utah law permits reasonable cost-based copying and mailing fees for a patient’s copy.

Can a Utah provider share my biopsy report without my consent?

Sometimes. HIPAA permits certain disclosures without your authorization, including for treatment, payment, health care operations, specific public health purposes, and certain legal processes. A family member does not automatically have a right to your full report, and a subpoena is not always the same as a court order.

Who may access my bone marrow biopsy report as my personal representative?

A person with legal authority to make relevant health care decisions for you may qualify, such as a health care agent or court-appointed guardian. A parent or guardian often acts for a minor, subject to applicable law and exceptions. For a deceased patient, Utah law says a provider may recognize the surviving spouse or an adult child as a personal representative.

Does Utah law restrict disclosure of genetic information to insurers or employers?

Yes, but the restrictions have defined scope and exceptions. Utah restricts certain employer uses of private genetic information and certain health-insurer access or use involving asymptomatic individuals. A separate rule bars direct-to-consumer genetic testing companies from disclosing genetic data to employers or specified insurers without written consent. The rules do not automatically apply in the same way to every clinical biopsy report.