Little Health Law Blog
As a healthcare and business law firm, we assist many clinical laboratories in compliance and regulatory matters, and because of COVID-19, Georgia has seen a rise in the number of clinical 
laboratories. A compliance question faced by many of our clients, particularly those who conduct COVID-19 testing, is how to properly maintain and share patient records. Herein, we note some of the rules around retaining and sharing patient records under Georgia law for clinical laboratories.
Record Retention
Georgia Code, Title 31, Chapter 22 provides rules for Clinical Laboratories. For entities that meet the definition of “clinical laboratory,” section 31-22-4(f) provides that “[r]ecords involving clinical laboratory services and copies of reports of laboratory tests shall be kept for the period of time and in the manner prescribed by the department.” The department refers to the Georgia Department of Community Health (“DCH”). DCH’s rules require reports of “all clinical laboratory services, including records of laboratory test requests and reports” to be retained for at least two (2) years for general laboratory records and quality control records, at least five (5) years for records of immunohematology and cytology, and at least ten (10) years for surgical pathology records. Rule 111-8-10-.26.
Record Sharing
Georgia’s Department of Public Health (“DPH”) requires Georgia laboratories to report patient records of patients who have or are tested for certain diseases; the list of diseases is published by DPH and available here. O.C.G.A. § 31-12-2; see also Georgia Rule 511-2-1-.02. As relevant to our clinical laboratory clients that perform COVID-19 tests, those labs are required to immediately report “positive + negative lab results[;] all test types” for “novel respiratory viruses (COVID-19, SARS, MERS, etc.).” To immediately report notifiable diseases, labs are directed to call or fax the report to the appropriate contact or call 1-866-PUB-HLTH (1-866-782-4584).
One obvious question is whether such sharing violates confidentiality rules. The Georgia legislature has considered this and provides protections to reporting laboratories. Georgia Code section 31-12-2(a) states, “All [required] reports and data shall be deemed confidential and shall not be open to inspection by the public; provided, however, the department may release such reports and data in statistical form or for valid research purposes.” Section 31-12-2(d) further protects such reporting by stating: “Any person, including but not limited to practitioners of the healing arts, submitting in good faith reports or data to the department or county boards of health in compliance with the provisions of this Code section shall not be liable for any civil damages therefor.” The rules promulgated by DPH include similar protections. See Georgia Rules 511-2-1-.03; 511-2-1-.04.
The Health Insurance Portability and Accountability Act (“HIPAA”) regulations further confirm that public health reporting does not violate HIPAA. Specifically, 45 C.F.R. § 164.512(b) states, “A covered entity may use or disclose protected health information for the public health activities and purposes described in this paragraph to: (i) A public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease . . . including, but not limited to, the reporting of disease . . . .” Public health authorities include state and local health departments.
Our attorneys are experienced in advising healthcare business clients on compliance and regulatory matters. If you have questions about record keeping or sharing or would like to discuss this blog post, you may contact our healthcare and business law firm at (404) 685-1662 (Atlanta) or (706) 722-7886 (Augusta), or by email, info@littlehealthlaw.com. You may also learn more about our law firm by visiting www.littlehealthlaw.com.
*Disclaimer: Thoughts shared here do not constitute legal advice.