Release of medical and payment records to third parties, A.R.S. § 12-2294

“Release of medical records and payment records to third parties”
 
Arizona health care providers may release medical or payment records after obtaining the written authorization of a patient or the patient’s health care decision maker. Providers must disclose medical or payment records without a patient’s authorization when ordered by a court or required by law. Providers may disclose records without patient authorization in accordance with the HIPAA Privacy Rule or in one of the circumstances specified by this section (e.g., to ambulance providers that transfer a patient, to the industrial commission of Arizona, etc.).
 
Providers may release medical or payment records to a deceased patient’s health care decision maker, personal representative, or executor unless the patient notified the provider, in writing, that they did not want their records disclosed after their death. If the deceased patient does not have a personal representative or executor, then the provider may release the records to the deceased person’s spouse, acting trustee, adult child, parent, adult sibling, or guardian.
 
Persons that receive medical or payment records may not re-disclose the records unless the patient consents in writing or re-disclosure is permitted by law.