You are on page 1of 6




Confidentiality of Health Record Information

South Carolina Freedom of Information Act- S.C. Code § 30-4-10, et seq; Confidentiality of Sexually Transmitted Disease Records- S.C. Code § 44- 29-135 and S.C. Code Reg. 61-21; Court orders for disclosure of records for law enforcement purposes; confidentiality safeguards- S.C. Code § 44- 29-136 ; South Carolina Physician’s Patient Records Act- S.C. Code § 44-115-10, et seq.; Social Worker Disclosure of Client Information- S.C. Code § 40-63-190; Confidentiality of Mental Health Records- S.C. Code § 44-22-100; Access to Mental Health Information- S.C. Code § 44-22-110; Confidentiality of Family Planning Services in Medical Records- 42 CFR § 59.11, Confidentiality of Substance Abuse Records- 42 U.S.C.A. § 90dd-2; Health Insurance Portability and Accountability Act- 45 CFR Part 160 and Part 164; Contagious and Infectious Diseases, S.C. Code § § 44-29- 150 - 170.

Policy Statement: Confidentiality of Agency information is determined by its exempt, nonexempt or confidential status as defined by the Freedom of Information Act and other applicable laws. Generally, health information is “exempt” from the Freedom of Information Act and is not released via FOI request. As required by HIPAA and other federal and state laws, DHEC provides for the confidentiality of health information. HIPAA defines protected health information as individually identifiable health information that is or has been electronically maintained or transmitted by a covered entity, as well as such information when it takes any other form that is created or received by a health care provider, health plan, employer or health care clearinghouse and relates to the past, present or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present or future payment for the provision of health care to an individual.




a. Employees of the Department of Health and Environmental Control are responsible for ensuring that the confidentiality of client health information is maintained. Information about clients will be held confidential and will not be divulged without the authorization of the individual to whom it pertains except as needed for the continuation of care in providing health services or as otherwise required by law.

b. When using or disclosing protected health information (PHI) or when requesting PHI from another agency or organization covered by HIPAA, DHEC employees must make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure or request.

c. DHEC employees, volunteers and other personnel working with DHEC clients (students, contract staff, etc.) will sign an appropriate confidentiality statement.


d. Should copies of health record information be made by DHEC staff for uses such as the provision of services off-site, the copies will be kept secure and the information will be kept confidential at all times, and shredded once no longer needed.

e. Any employee who does not adhere to the Agency's policies concerning confidentiality will be disciplined in accordance with the Agency's Progressive Discipline Policy and may risk legal prosecution.


a. The protected health information that identifies individuals

b. The social and economic conditions or circumstances of any person served

c. Agency evaluation of information about a person or health facility

d. An individual’s medical information, including diagnosis and past history of disease or disability

e. Confidential facts pertaining to health facilities. (ie- Medicare/ Medicaid provider numbers, incident reports, etc.)

f. The identity of persons or institutions that provide health services to an individual

g. Federal program information identified as confidential by appropriate federal authority

h. Client’s social security number

i. The names of persons other than the client when they appear in the client’s record, unless needed by a health care provider for the purpose of treatment for that person. In that case, the information released is the minimum necessary for the intended purpose of the release. The names of these individuals are not released upon receipt of a subpoena for the client’s record.


All employees of DHEC are bound by DHEC’s Confidentiality of Information Policy, A.561. A DHEC employee must not disclose confidential information to other DHEC employees unless those employees have a legitimate need for the information in the performance of their official duties.


Information about immunizations may be shared with Health Care Providers (defined as DHEC staff, physicians and their office staff) for treatment purposes, and with other


persons having the responsibility and authority to inquire into and/or verify immunization status such as school and day care providers, parents, legal guardians, the client, health plans (during the period of eligibility), and the Centers for Disease Control and Prevention (CDC), without parental, guardian or client authorization in accordance with 45 CFR Section 164.512 of HIPAA Regulations. Such information may include which vaccinations or immunizations an individual has received, the dates each was given, and other history information essential for a health care provider to determine an individual's need for an immunization, or other essential history information, such as prior reactions. The Certificate of Immunization (DHEC 1148) and the Personal Immunization Record (printed from CARES) are considered public health records and do not require a signed authorization to release information. Refusal to share information is appropriate in cases where it is believed that releasing the information would not benefit that client.

Immunization Certificates may be released to a child’s parent or legal guardian, or to school principals and day care providers as required by law.

Any disclosure concerning immunosuppression, if related to HIV infection, or other information related to HIV or STD should be disclosed in strict compliance with S.C. Code § 44-29-135 and applicable regulations such as 24A S.C. Code Reg. 61-21.


a. South Carolina Code § 44-29-135 states: All information and records held by the Department of Health and Environmental Control and its agents relating to a known or suspected case of sexually transmitted disease are strictly confidential except as provided in this section. The information must not be released or made public, upon a subpoena or otherwise, except under the following circumstances:

Release is made of medical or epidemiologic information for statistical purposes in a manner that no individual person can be identified.

Release is made of medical or epidemiologic information with the authorization of all persons identified in the information released.

Release is made of medical or epidemiologic information to the extent necessary to enforce the provisions of this chapter and related regulations concerning the control and treatment of sexually transmitted disease.

Release is made of medical or epidemiologic information to medical personnel to the extent necessary to protect the health or life of any person.

In cases involving a minor (“minor” is defined as under age 18), the name of the minor and medical information concerning the minor must be reported to appropriate agents if a report is required by the Child Protection Act of 1977. No further information is required to be released by the department. If a


minor has Acquired Immune Deficiency Syndrome (AIDS) or is infected with Human Immunodeficiency Virus (HIV) and is attending public school in kindergarten through fifth grade, the department shall notify the superintendent of the school district and the nurse or other health professional assigned to the school the minor attends. The notification and information contained in the notification must not be recorded in the child’s permanent school record. However, if this information is in the child’s permanent school record, the information must be purged from the child’s record before the child enters the sixth grade.

b. All information regarding individuals with STD’s and their identified contacts shall be maintained with utmost confidentiality within DHEC in accordance with established statutes, laws and policy pertaining to sexually transmitted diseases. This includes refusal of subpoenas to share client information in court. STD information may be disclosed if the client specifically authorizes its disclosure pursuant to a HIPAA-compliant authorization.

c. Only a proper court order permits release of DHEC records of this type without the patient’s authorization. Hepatitis B, STD and HIV test results may be released as directed by court order pursuant to South Carolina Code § 16-3-740, Testing of offenders for Hepatitis B, STD and HIV. (See “Testing Offenders for Human Immunodeficiency Virus, Hepatitis B Virus and Sexually Transmitted Diseases” policy in the Health Services Policy Manual). In addition, STD test results may be released to a solicitor pursuant to a court order under procedures set forth in S.C. Code Section 44-29-136. If an order directing disclosure of STD information is received, immediately contact the Office of General Counsel.

d. If disclosure of STD/HIV information to medical personnel is necessary to protect the health or life of any person pursuant to Section 44-29-135(d), the relevant portion of a client’s STD record may be released to a physician who needs to know the information in order to plan and develop a necessary course of treatment. When the Department refers a client who has tested positive for an STD to a physician and/or health professional for medical care, the Department may provide the STD information to the physician and/or health professional directly involved in the client’s medical care if the physician and/or health professional has a need to know the information in order to plan and develop a necessary course of treatment. For referral of a pregnant client, the Department may provide the STD information to the physician and/or health professional directly involved in the client’s medical care if the physician and/or health professional have a need to know the information in order to plan and develop a necessary course of treatment for the pregnant female and/or her newborn(s). In all cases, the procedures for disclosure of STD/HIV information set forth in S.C. Regulation 61-21(G)(2)must be followed.



Information regarding Family Planning services on minors is always kept confidential pursuant to the requirement of 42 C.F.R. § 59.11. No disclosure of information is permitted without the written authorization of the minor, except by subpoena or court order. If a parent or guardian requests the minor's record, the minor should be contacted without notifying the parent or guardian. It will be left to each Region Health Director’s discretion as to the procedure of contacting the minor. This does not preclude disclosure of relevant information for required reporting for known or suspected child abuse.


Client information acquired by licensed social workers during the course of service must not be disclosed except in accordance with S.C. Code § 40-63-190. This section allows disclosure:

a. As mandated by law for child abuse and neglect reporting and reporting suspected abuse, neglect or exploitation of a vulnerable child.

b. to prevent a clear and immediate danger to a person or persons in cases where the information is necessary to prevent the client from causing harm to himself/herself or others.

c. where the licensed social worker is a defendant in a civil, criminal or disciplinary action arising from service to a client, in which case confidences may be disclosed only in the course of that action.

d. where the client is a party in a criminal or civil proceeding and the client introduces his/her mental condition as an element of a claim or defense.

e. where there is a waiver of confidentiality previously obtained in writing as set forth in the statute.

f. where otherwise required by law or an order signed by a judge of a court of competent jurisdiction.









a. Psychiatric Records: From time to time, information related to a client’s mental health or substance abuse may be contained in the comprehensive health record. Normally this is secondary information, as DHEC does not provide services in these areas. All information directly or indirectly related to or identifying a mentally ill patient or former patient or whose commitment has been sought must be kept confidential and must not be disclosed unless:


the individual identified or his or her guardian authorizes (unless the physician determines in writing in the record that the information is detrimental to the patient’s treatment regimen).

a court order directs that disclosure is necessary for the conduct of proceedings before it and that failure to make the disclosure is contrary to the public interest.

disclosure is necessary to cooperate with law enforcement, health, welfare, and other state or federal agencies or when furthering the welfare of the patient and his family.

b. All information directly or indirectly related to alcohol or drug abuse (identity, diagnosis, prognosis, or treatment) contained in the comprehensive health record (normally this is secondary information) must be kept confidential and be disclosed only under the following circumstances pursuant to S.C. Code § 44-22-100:

authorization of the patient.

disclosure made to other medical personnel to the extent necessary to meet a bona fide medical emergency.

court order showing good cause; on assessing good cause the court must weigh the public interest and the need for disclosure against injury to the patient, the physician-patient relationship and the treatment service.


The School Employee/Individual Certificate of Examination for Tuberculosis (DHEC 1420) may be released without the patient’s authorization as required by law.