The State of Indiana requires all health providers to maintain the privacy and confidentiality of patients’ medical information.  In order to release a patient’s health record, the provider must obtain written consent from the patient.1 However, providers may share patient information with one another without consent for the purposes of providing treatment to the patient.2  Additionally, a person who is authorized to consent for a patient is also authorized to receive health care information on behalf of the patient.3  Health information may also be disclosed to a law enforcement official for the purposes of identifying or locating a missing person.4 An accident and sickness insurance company may obtain a patient’s health information with written consent. However, a copy of health records obtained by the insurance company must be furnished to the patient upon request.5

The law requires that all Medicaid and CHIP applications, investigation reports, information and records be kept confidential.  Additionally, information obtained by a health provider regarding an individual's eligibility for Medicaid is confidential and may not be disclosed to any person.6  However, general information may be released in order to develop the Medicaid program and CHIP.7  In fact, the law requires that Medicaid participating providers fully disclose Medicaid records to the Office of Medicaid Policy and Planning if requested.8

There are also specific laws that govern the confidentiality of information before a peer review committee.  The law requires that all peer review information, communications and proceedings be kept confidential.9   Furthermore, any person attending a peer review hearing is also required to maintain the confidentiality of the peer review information.10  The law provides exceptions to the general rule of confidentiality, by permitting a peer review committee to disclose records and information to the patient safety agency.11  Additionally, peer review information that is otherwise discoverable or admissible from original sources is not immune from use in judicial proceedings.12  The law provides that a peer review committee of one institution is permitted to disclose records to the peer review committees of other health care entities, such as hospitals or health plans, to the disciplinary authority of the professional board, and to the state board of registration, to be used for a legitimate business purpose.13

The law maintains that all information and records obtained by the state for use in the registry must also be kept confidential.14  The law, however, does allow release of summary statistics as long as the summary does not reveal the identity of the individuals.15   All information relating to causes of death is confidential and may be used only for research and education, or for the improvement of the quality of medical care.16

The state protects many other aspects of health information as well.  Any health information that is exchanged as part of Indiana’s statewide health information exchange network is subject to the federal Health Information Portability and Accountability Act (HIPAA).17  There is much protection given to the confidentiality of a patient’s identity.  To that end, Indiana prohibits health care entities from disclosing patient identifying information, in the case of hospital medical staff reports or hospital fiscal or patient information reports.18