Skip to Content

Security of Health Information in Ohio

< Return to Security of Health Information

In conjunction with its laws governing privacy and confidentiality of health information, the state of Ohio has enacted laws governing the maintenance of health information in an effort to protect confidential information against unauthorized disclosures.  Each state agency must have rules regarding the confidential personal information the agency keeps that include a mechanism for recording specific access of the information system by employees and an authentication measure used to access electronically kept confidential personal information.  Knowingly accessing confidential personal information in violation of a rule of a state agency, or knowingly using or disclosing confidential personal information in a manner prohibited by law is considered a violation of a state statute. 1  Every agency that maintains a personal information system must take reasonable precautions to protect personal information in the system from unauthorized use or disclosure; each agency must eliminate information from the system when it is no longer necessary and relevant to an authorized function of the agency.2

In addition to these broad requirements, the law governs the confidentiality of certain systems and program records.  The birth defects information system is considered confidential, and the director must maintain a record of users given access to the system; any user who violates the system’s confidentiality may be denied further access to the system.3  Each hospice program must store central clinical records to protect them against unauthorized use.4   Nursing homes must safeguard medical records against unauthorized use and must ensure their confidentiality.5  All healthcare facilities must take appropriate measures to protect against unauthorized use of medical records.6  Adult care facility resident records must be safeguarded against unauthorized use; individuals working in the facility must return resident records to the storage area and may not allow the records to remain open in the view of others in the facility.7

 

Footnotes

  • 1. Ohio Rev. Code § 1347.15
  • 2. Ohio Rev. Code § 1347.05
  • 3. Ohio Rev. Code § 3705.32
  • 4. Ohio Admin. Code 3701-19-23
  • 5. Ohio Admin. Code 3701-17-19
  • 6. Ohio Admin. Code 3701-83-11
  • 7. Ohio Admin. Code 5122-33-15

 

Security of Health Information in Ohio

Subtopic Statute/Regulation Description
Unauthorized access or disclosure of health information (Cross reference Privacy & Confidentiality) Access rules for confidential personal information – Ohio Rev. Code Ann. § 1347.15 Each state agency must adopt rules regulating access to the confidential personal information the agency keeps, electronically or on paper.  The...
Records are confidential – exceptions – Ohio Rev. Code Ann. § 3705.32 Records received and information assembled by the birth defects information system are confidential medical records, accessible only by the director...
Storage of health information in a secure location (Cross reference Medical Record Collection) Central clinical record – Ohio Admin. Code 3701-19-23 Each hospice care program must establish and maintain a central clinical record for each patient receiving care and services from the program. All...
Duties of state and local agencies maintaining personal information systems – Ohio Rev. Code Ann. § 1347.05 Every state or local agency that maintains a personal information system must take reasonable precautions to protect personal information in the...
General medical records requirements – Ohio Admin. Code 3701-83-11 Each health care facility (HCF) must maintain a medical record for each patient for six years from the date of discharge that documents the patient...
Recordkeeping – Ohio Admin. Code 5122-33-15 Adult care facilities must maintain a record for each resident that contains the following: The resident’s name, previous address, date of...
Records and reports – Ohio Admin. Code 3701-17-19 Every nursing home must maintain an individual medical record for each resident, started immediately upon admission and containing the following...
Security of Health Information Duty of covered entities – Ohio Rev. Code Ann. § 3798.03 This section applies to covered entities as they are defined in the HIPAA administrative regulation provisions (at 45 C.F.R. § 160.103)....
Click on the individual state law in the table above to see our summary of the individual law.


Welcome to Health Information & the Law

Please provide the following information and continue to the site.

by Dr. Radut.