Legal review: AIDS patient records--legal issues of access and disclosure.

All 50 states require AIDS cases to be reported to the department of health. Many jurisdictions require HIV and ARC reporting, as well. Many states have also enacted confidentiality provisions that prohibit health care providers from releasing HIV-related information without the patient's consent, although exceptions to the statutes authorize disclosure without consent to other health providers, spouses, and other persons under certain conditions set forth in the legislation. In addition, the patient may obtain access to his or her own records and may authorize release to third parties. Providers who violate the provisions are subject to liability. The patient usually has a private cause of action for damages and costs; in addition, the state may impose fines and jail terms for more egregious violations. Finally, courts may authorize disclosure of confidential HIV information in certain situations. In the absence of a statutory provision governing court-ordered disclosures, courts will balance the patient's privacy interest against the plaintiff's need to know and the public interest involved. Several states have enacted statutes that modify this traditional balancing approach, although it is unclear whether these statutes provide additional protection for health care providers and patients seeking to prevent disclosure of information. Health record practitioners should keep abreast of legislative and regulatory developments in their states that affect use and disclosure of AIDS patient records. Careful discussion with the health institutions' legal counsel of any situation not covered clearly by applicable statue or regulation is strongly recommended.