Last summer, the United States Secretary of Homeland Security announced a new program called Deferred Action for Childhood Arrivals. Under this program, some unauthorized immigrants who entered the United States before the age of 16 may qualify to have immigration enforcement actions against them deferred, meaning that the US will not act to remove them from the country during the deferral period. An individual who qualifies for deferred action may also obtain authorization to work legally.

To be eligible for deferred action, an individual must provide evidence that he or she:

• Arrived in the United States before his or her 16^th birthday;
• Was physically present in the US on June 15, 2012, and was both undocumented and less than 31 years of age on that date;
• Has continuously resided in the US since June 15, 2007;
• Is currently in school or has graduated from high school or obtained a GED, or is an honorably discharged veteran; and
• Has not been convicted of a felony or certain misdemeanors, and does not otherwise pose a threat to national security or public safety.

Demonstrating eligibility for deferred action requires individuals to provide a fair amount of documentary evidence, which may include medical records. US Citizenship & Immigration Services (USCIS) began accepting applications for deferred action in August. Since that time, a number of local health departments in North Carolina have received requests for medical records from individuals who want to apply. For answers to health departments’ most frequently asked questions about releasing medical records for the deferred action program, please keep reading.

How may medical records be used in an individual’s application for the Deferred Action program?

A person who wants to apply for deferred action must document his or eligibility for the program by completing Form I-821D and providing supporting evidence. According to the form’s instructions, medical records may serve as the evidence for any or all of the following:

• That the applicant arrived in the United States before his or her 16^th birthday.
• That the applicant was present in the United States on June 15, 2012.
• That the applicant has continuously resided in the United States since June 15, 2007.

Does HIPAA allow disclosure of medical records for this purpose?

Yes. An individual who is seeking medical records for this purpose may ask for copies of the records to be provided directly to the individual him or herself, or may ask for copies to be provided to a third party who is assisting with the application. In either case, HIPAA allows the disclosure, but certain conditions must be met.

Disclosure directly to the individual. Under HIPAA, individuals have a right to obtain copies of their own medical records. The local health department must verify the individual’s identity before providing a copy of the medical record, if the person’s identity is not already known.

In some cases a person requesting copies of an individual’s record may be the individual’s personal representative rather than the individual him or herself. For HIPAA purposes, a personal representative is a person who has the authority to make health care decisions for the individual. A personal representative may obtain copies of an individual’s medical record or authorize the disclosure of the records to a third party. The health department must verify that the person is a personal representative of the individual before providing the copies.

In most cases, a person such as an advocate or attorney who is assisting with a deferred action application is not a personal representative for HIPAA purposes. He or she is a third party for purposes of records release. (There may be an occasional case in which a person who is advocating for an applicant also has legal authority to make health care decisions for the individual, but that is probably the rare exception, not the rule.)

Disclosure to a third party. In some cases, a person seeking medical records for a deferred action application may want the copies to be disclosed directly to a third party, such as an advocate or attorney who is assisting with the application. This disclosure requires a HIPAA-compliant authorization form, signed by the individual who is the subject of the records (or a personal representative, if applicable).

Who may request a minor child’s records – the parent, or the child?

The answer depends on whether the parent is the personal representative for HIPAA purposes. Parents of minor children are often the personal representatives of their children, but not always. For example, a parent may not be treated as the personal representative of a minor who has received treatment on his or her own consent under North Carolina’s minor consent law.

When a health department receives a request for a medical record of a minor child, the health department must determine whether the parent or the minor is the appropriate person to receive the record or to authorize its disclosure to a third person. This circumstance is not unique to the deferred action program and arises frequently enough that health departments should, and probably do, have policies and procedures specific to the release of minors’ records – those should be consulted and applied in this case. For further information on disclosure of minors’ records, see this outline.

Exactly which records should be copied and provided in response to a request for records for a deferred action application?

This is probably the most difficult question to answer and it will likely require case-by-case determinations. There actually is a simple legal answer—the department should provide whichever records the individual or personal representative requests—but in practice individuals may not know exactly which records they need. As a result, a person may submit a request that is unclear, or he or she may ask for a copy of the entire medical record.

If the individual clearly requests the entire medical record the agency may legally provide it, but this can pose significant practical problems: in some cases providing the whole record may be unnecessarily costly to the client and administratively burdensome to the health department.

If the department needs to clarify a request or wishes to assist an individual in narrowing the request, it will be helpful to keep in mind how medical records will be used in the deferred action application process. The instructions for Form I-821D state that medical records may be used to demonstrate any or all of the following:

• That the individual arrived in the United States before his or her 16^th birthday.
• That the individual was present in the United States on June 15, 2012.
• That the individual has continuously resided in the United States since June 15, 2007.

The instructions also state that the records must concern treatment or hospitalization, provide the name of the medical facility or physician that provided the treatment, and specify the date(s) of treatment. Obviously, they should also identify the individual.

Keeping this in mind, here are some general guidelines for helping an individual determine which records will serve his or her purposes:

• If all an individual is seeking is evidence of arrival in the United States before the 16^th birthday, then any record of any service provided before the 16^th birthday should suffice, so long as it includes the individual’s name and date of birth, the date of treatment, and the name of the health department or the physician who provided the treatment.
• If all the individual is seeking is evidence of presence in the United States on June 15, 2012, a record of any service provided on that date may be all he or she needs. Again, the record would need to include the individual’s name and date of birth, the date of the treatment, and the name of the health department or physician.
• If the individual is planning to use medical records as evidence of continuous residence in the United States since June 15, 2007, he or she will likely need all records of treatment since that date.

These guidelines are not rules that should be imposed on individuals requesting records; they are simply suggestions that may help health departments assist an individual in determining the scope of a request for records, if the individual requests or is receptive to such assistance. Ultimately, the health department should provide the records the individual requests.

May a local health department offer a memorandum or letter verifying the specific information requested in lieu of copies of the medical records themselves?

No, the health department should provide copies of the original medical records. The federal agency responsible for the program (USCIS) has advised me that it will not accept a letter or memorandum in lieu of original records. (Personal phone communication, Oct. 4, 2012).

May a local health department refuse a request for records if the department believes the request is unduly burdensome?

No. Under HIPAA, an individual has a right to obtain a copy of his or her medical record. This right may be denied only in very limited circumstances that are set out in the HIPAA Privacy Rule. Administrative burden to the agency is not a ground for denying a copy of a record. The full text of this portion of the Privacy Rule is available here.

The health department may require an individual to request the copy in writing. Once the written request is received, the department generally must provide the record within 30 days if the record is maintained and accessible on-site, or within 60 days if it must be retrieved from an off-site location. If the department is unable to provide the record within these timeframes, it may take a one-time extension of up to 30 additional days, but it must notify the individual in writing of the reason for the delay and the date by which the record will be provided.

May a local health department impose a fee for copies of the records? 

HIPAA allows covered entities to charge a “reasonable, cost-based” fee for copies of records that are requested by an individual. It doesn’t specify an amount, but it does specify that the fee may cover only the cost of copying the information that is requested.

In North Carolina, there is also a state law that addresses fees for copies of medical records but the law says it applies only when the records are requested for certain kinds of claims (personal injury lawsuits and social security disability). This law sets the maximum fee at 75 cents per page for the first 25 pages, 50 cents for pages 26 through 100, and 25 cents for each page in excess of 100. In the past, it was a common practice for North Carolina health care providers to look to this law for guidance on setting fees for copies of records, even when the law did not apply to the particular request because it did not relate to a personal injury or disability claim. However, the state law now must be read in conjunction with HIPAA’s provisions regarding reasonable, cost-based fees. If the fees established in the state law exceed the health department’s actual costs, they are too high—the department needs to set lower fees based on actual costs.

Local health departments should have a policy on fees for copies of medical records. Departments may apply that policy to impose fees for copies of records requested for the deferred action program.