HIPAA Basics for Immigration Medical Exams

The Health Insurance Portability and Accountability Act (HIPAA) protects the privacy of individually identifiable health information, known as protected health information (PHI). Civil surgeons who perform immigration medical examinations are covered entities under HIPAA and must comply with its privacy and security requirements.

This means that the medical information collected during an immigration medical examination — including examination findings, laboratory results, and vaccination records — is protected by HIPAA.

What Civil Surgeons Can Share With USCIS

HIPAA includes an exception for disclosures required by law. Civil surgeons are required by USCIS regulations to complete Form I-693 and submit it to USCIS as part of the immigration process. This disclosure is permitted under HIPAA without patient authorization.

In other words, the civil surgeon does not need the patient's authorization to submit Form I-693 to USCIS — this is a legally required disclosure.

What Civil Surgeons Can Share With Attorneys

Sharing medical information with the patient's attorney is not a legally required disclosure under HIPAA. Therefore, the civil surgeon must have patient authorization before sharing PHI with the attorney.

Attorneys who want to communicate with the civil surgeon about a client's examination findings should obtain a signed HIPAA authorization from the client. The authorization should specify what information can be shared, with whom, and for what purpose.

Authorization Requirements

A valid HIPAA authorization must include:

• A description of the information to be disclosed
• The name of the person or entity authorized to make the disclosure (the civil surgeon)
• The name of the person or entity to whom the disclosure may be made (the attorney)
• The purpose of the disclosure
• An expiration date or event
• The patient's signature and date

Attorneys' Obligations Under HIPAA

Attorneys who receive PHI from a civil surgeon are not themselves covered entities under HIPAA (unless they also provide healthcare services). However, attorneys have ethical obligations to protect client confidentiality that are analogous to HIPAA requirements.

Attorneys should store medical records securely, limit access to authorized personnel, and not disclose medical records to third parties without client authorization.