At a recent HIPAA seminar that I gave in Oklahoma, a psychologist asked whether the HIPAA right of access to protected health information (“PHI”)maintained in a system of records by a covered entity required the entity to provide access to copyright protected actual assessment instruments, test stimuli or questions, or laboratory devices. I have always instructed my HIPAA clients to avoid this issue by getting the patient/client to waive this portion of the access as a condition of taking the test, which avoids the issue of figuring out which rule controls the situation: the HIPAA right of access or the copyright protection.

If, however, you have not previously obtained such a waiver, a communication from the Office of Civil Rights (“OCR”) of the Department of Health and Human Services (“DHHS”) would seem to provide support for denying such access: “[A]ny requirement for disclosure of protected health information pursuant to the Privacy Rule is subject to Section 1172(e) of HIPAA, ‘Protection of Trade Secrets.’ As such, we confirm that it would not be a violation of the Privacy Rule for a covered entity to refrain from providing access to an individual’s protected health information, to the extent that doing so would result in a disclosure of trade secrets.” Harcourt Assessment’s HIPAA Position Statement at http://kspope.com/assess/harcourt-hipaa.php. Notwithstanding this guidance, obtaining a waiver in writing from the client at the intake or before administering the test may be prudent.