Phyllis Gilmore, Executive Director Behavioral Sciences Regulatory Board 712 S. Kansas Avenue Topeka, Kansas 66603
Dear Mrs. Gilmore:
As Executive Director for the Behavioral Sciences Regulatory Board (Board), you pose the following question:
"Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Behavioral Sciences Regulatory Board statutes and regulations, does the sale of a practice of psychology include past clients' records, or must the selling psychologist retain those records?"
The sale or other transfer of the professional practice of a psychologist may involve the transfer of realty, as well as the practice itself. The practice may consist of the records of the selling psychologist, including names and addresses of past and present patients and their psychological histories, books, fixtures, equipment, other items of personalty located on the premises, and the good will of the practice. While not required by law, the selling psychologist may find it advisable to notify clients of an intended sale of the practice and determine whether any client objects to the transfer of their records to the purchasing psychologist.1 The answers to your questions, however, are not dependant on whether a selling psychologist attends to this consideration.
Health Insurance Portability and Accountability Act of 1996 (HIPAA)
The regulatory definition of "health care operations" that was adopted pursuant to HIPAA includes in pertinent part:
"(6) Business management and general administrative activities of the [covered] entity,2 including, but not limited to:
. . . .
"(iv) The sale, transfer, merger, or consolidation of all or part of the covered entity with another covered entity, or an entity that following such activity will become a covered entity and due diligence related to such activity; . . ."3
Moving to the use of the term "health care operations" in the HIPAA regulations' context, we find that a covered entity may use or disclose protected health information for health care operations,4 which includes the sale of a practice, without client authorization. Such use or disclosure of protected health information was made crystal clear by the Department of Health and Human Services' commentary to the final HIPAA regulations:
"The Department indicated in the December 2000 preamble of the Privacy Rule its intent to include in the definition of health care operations the actual transfer of protected health information to a successor in interest upon a sale or transfer of its assets. (67 FR 82609.) However, the regulation itself did not expressly provide for the transfer of protected health information upon the sale or transfer of assets to a successor in interest. . . .
"A number of entities expressed concern about the discrepancy between the intent as expressed in the preamble to the December 2000 Privacy Rule and the actual regulatory language. To address these concerns, the Department proposed to add language to paragraph (6) of the definition of 'health care operations' to clarify its intent to permit the transfer of records to a covered entity upon a sale, transfer, merger, or consolidation. This proposed change would prevent the Privacy Rule from interfering with necessary treatment or payment activities upon the sale of a covered entity or its assets. . . .
"Final Modifications. . . . Thus, 'health care operations' includes the sale, transfer, merger, or consolidation of all or part of the covered entity to or with another covered entity, or an entity that will become a covered entity as a result of the transaction, as well as the due diligence activities in connection with such transaction. . . .
"Under the final definition of 'health care operations,' a covered entity may use or disclose protected health information in connection with a sale or transfer of assets to, or a consolidation or merger with, an entity that is or will be a covered entity upon completion of the transaction; and to conduct due diligence in connection with such transaction. The modification makes clear it is also a health care operation to transfer records containing protected health information as part of the transaction. For example, if a pharmacy which is a covered entity buys another pharmacy which is also a covered entity, protected health information can be exchanged between the two entities for the purpose of conducting due diligence, and the selling entity may transfer any records containing protected health information to the new owner upon completion of the transaction. The new owner may then immediately use and disclose those records to provide health care services to the individuals, as well as for payment and health care operations purposes. Since the information would continue to be protected by the Privacy Rule, any other use or disclosure of the information would require an authorization unless otherwise permitted without authorization by the Rule, and the new owner would be obligated to observe the individual's rights of access, amendment, and accounting. The Privacy Rule would not interfere with other legal or ethical obligations of an entity that may arise out of the nature of its business or relationship with its customers or patients to provide such persons with notice of the transaction or an opportunity to agree to the transfer of records containing personal information to the new owner."5
Behavioral Sciences Regulatory Board Statutes and Regulations
K.S.A. 74-5324(d) authorizes the Board to take disciplinary action against a psychologist who "has been guilty of unprofessional conduct as defined by rules and regulations established by the board." The Board adopted an unprofessional conduct regulation regarding record-keeping that addresses a psychologist's responsibility concerning retention of records:
"If a licensee is the owner or custodian of client or patient records, the licensee shall retain a complete record for the following periods of time:
"(1) At least five years after the date of termination of one or more contacts with an adult; and
"(2) for a client or patient who is a minor on the date of termination of the contact or contacts, at least until the later of the following two dates:
"(A) Two years past the age of majority; or
"(B) five years after the date of termination of the contact or contacts with the minor."6
The sale of a psychologist's practice may legitimately include client records.7 The parties to a contract of sale of a psychologist's practice should specify in detail the exact nature of the property, which may include client records, being transferred. Assuming the sale of a psychologist's practice does include client records, once that sale has occurred, the selling psychologist is no longer the owner or custodian of client or patient records and is no longer bound by the Board's regulation requiring retention of client records.
In conclusion, the sale of a psychologist's practice may legitimately include client records. Once such a sale has occurred, the selling psychologist is no longer the owner or custodian of client records and thus is no longer bound by the Board's regulation that requires the owner or custodian to retain client records. Under regulations adopted pursuant to the Health Insurance Portability and Accountability Act, a psychologist may use or disclose protected health information for health care operations, which includes the sale of a practice to another covered entity, without client authorization.
Sincerely,
PHILL KLINE Attorney General of Kansas
Camille Nohe Assistant Attorney General
PK:JLM:CN:jm
1 15 Am.Jur.2d Legal Forms, Physicians and Surgeons §§ 202.7 and 202.9.
2 A psychologist is a "covered entity" under HIPAA by virtue of being a health care provider, assuming the psychologist transmits any health information in electronic form in connection with a covered transaction. 42 C.F.R. § 160.103.
3 42 C.F.R. § 164.501(6)(iv).
4 42 C.F.R. § 164.506(c)(1).
5 67 F.R. 53190-91.
6 K.A.R. 102-1-20(c) (emphasis added).
7 See note 1.