Chapter 146

146.81(2)(e) (e) The individual, agency or organization to which disclosure may be made.

146.81(2)(f) (f) The signature of the patient or the person authorized by the patient and, if signed by a person authorized by the patient, the relationship of that person to the patient or the authority of the person.

146.81(2)(g) (g) The date on which the consent is signed.

146.81(2)(h) (h) The time period during which the consent is effective.

146.81(3) (3) “Patient” means a person who receives health care services from a health care provider.

146.81(4) (4) “Patient health care records” means all records related to the health of a patient prepared by or under the supervision of a health care provider; and all records made by an ambulance service provider, as defined in s. 256.01 (3), an emergency medical services practitioner, as defined in s. 256.01 (5), or an emergency medical responder, as defined in s. 256.01 (4p), in administering emergency care procedures to and handling and transporting sick, disabled, or injured individuals. “Patient health care records” includes billing statements and invoices for treatment or services provided by a health care provider and includes health summary forms prepared under s. 302.388 (2). “Patient health care records” does not include those records subject to s. 51.30, reports collected under s. 69.186, records of tests administered under s. 252.15 (5g) or (5j), 343.305, 938.296 (4) or (5) or 968.38 (4) or (5), records related to sales of pseudoephedrine products, as defined in s. 961.01 (20c), that are maintained by pharmacies under s. 961.235, fetal monitor tracings, as defined under s. 146.817 (1), or a pupil’s physical health records maintained by a school under s. 118.125.

146.81(5) (5) “Person authorized by the patient” means the parent, guardian, or legal custodian of a minor patient, as defined in s. 48.02 (8) and (11), the person vested with supervision of the child under s. 938.183 or 938.34 (4d), (4h), (4m), or (4n), the guardian of a patient adjudicated incompetent in this state, the personal representative, spouse, or domestic partner under ch. 770 of a deceased patient, any person authorized in writing by the patient or a health care agent designated by the patient as a principal under ch. 155 if the patient has been found to be incapacitated under s. 155.05 (2), except as limited by the power of attorney for health care instrument. If no spouse or domestic partner survives a deceased patient, “person authorized by the patient” also means an adult member of the deceased patient’s immediate family, as defined in s. 632.895 (1) (d). A court may appoint a temporary guardian for a patient believed incompetent to consent to the release of records under this section as the person authorized by the patient to decide upon the release of records, if no guardian has been appointed for the patient.

146.81 History History: 1979 c. 221; 1981 c. 39 s. 22; 1983 a. 27; 1983 a. 189 s. 329 (1); 1983 a. 535; 1985 a. 315; 1987 a. 27, 70, 264; 1987 a. 399 ss. 403br, 491r; 1987 a. 403; 1989 a. 31, 168, 199, 200, 229, 316, 359; 1991 a. 39, 160, 269; 1993 a. 27, 32, 105, 112, 183, 385, 443, 496; 1995 a. 27 s. 9145 (1); 1995 a. 77, 98, 352; 1997 a. 27, 67, 75, 156, 175; 1999 a. 9, 32, 151, 180, 188; 2001 a. 38, 70, 74, 80, 89; 2005 a. 262, 387; 2007 a. 108; 2009 a. 28, 165, 209, 355; 2015 a. 195 s. 83; 2015 a. 265; 2017 a. 12; 2019 a. 100; 2021 a. 23 ss. 19, 20, 71; 2021 a. 100, 123, 130, 131, 251; 2023 a. 55, 56, 81, 87, 88; s. 13.92 (1) (bm) 2.; s. 13.92 (2) (i).

146.81 Annotation A letter written by a person not licensed as a health care provider under sub. (1) was not a record under sub. (4) prepared under the supervision of a health care provider under sub. (1) (j) when the person was employed by a corporation that employed health care professionals but the corporation’s shareholders were not health care providers. Hart v. Bennet, 2003 WI App 231, 267 Wis. 2d 919, 672 N.W.2d 306, 02-2933.

146.81 Annotation When a health care provider denied access to records on the ground that the patient was possibly incompetent to consent to the release of the records, it was obligated under sub. (5) to petition for a temporary guardian for the patient. Szymczak v. Terrace at St. Francis, 2006 WI App 3, 289 Wis. 2d 110, 709 N.W.2d 103, 04-2067.

146.81 Annotation The plaintiff in this case failed to state a claim that the defendant health care provider violated s. 146.83 (4) (b). The plaintiff did not allege that the defendant withheld any record when it alleged that the defendant concealed the results of an internal investigation into why and under what authority its employees had accessed the plaintiff’s health care records. Any records the defendant might have kept regarding its internal investigation would not have related to the plaintiff’s health or any treatment or services received. Accordingly, such information, even if reduced to a record, would not have constituted a patient health care record, as that term is defined in sub. (4). Wall v. Pahl, 2016 WI App 71, 371 Wis. 2d 716, 886 N.W.2d 373, 15-1230.

146.81 Annotation The context of the definition of “person authorized by the patient” in sub. (5) indicates that “any person authorized in writing by the patient” is a stand-alone category, separate and apart from the remaining categories, containing no limitations beyond those expressly written. This language requires only a person with a written authorization from the patient. The statute does not require that the authorization be an authorization to make health care decisions on behalf of the patient. Moya v. Aurora Healthcare, Inc., 2017 WI 45, 375 Wis. 2d 38, 894 N.W.2d 405, 14-2236.

146.81 Annotation Under sub. (4), “patient health care record” means “all records,” including electronic records. Nothing in s. 146.836 changes that definition as applied to s. 146.83 (3f), nor any other statute. Banuelos v. University of Wisconsin Hospitals & Clinics Authority, 2023 WI 25, 406 Wis. 2d 439, 988 N.W.2d 627, 20-1582.

146.815 146.815 Contents of certain patient health care records.

146.815(1) (1) Patient health care records maintained for hospital inpatients shall include, if obtainable, the inpatient’s occupation and the industry in which the inpatient is employed at the time of admission, plus the inpatient’s usual occupation.

146.815(2) (2) 

146.815(2)(a) (a) If a hospital inpatient’s health problems may be related to the inpatient’s occupation or past occupations, the inpatient’s physician shall ensure that the inpatient’s health care record contains available information from the patient or family about these occupations and any potential health hazards related to these occupations.

146.815(2)(b) (b) If a hospital inpatient’s health problems may be related to the occupation or past occupations of the inpatient’s parents, the inpatient’s physician shall ensure that the inpatient’s health care record contains available information from the patient or family about these occupations and any potential health hazards related to these occupations.

146.815(3) (3) The department shall provide forms that may be used to record information specified under sub. (2) and shall provide guidelines for determining whether to prepare the occupational history required under sub. (2). Nothing in this section shall be construed to require a hospital or physician to collect information required in this section from or about a patient who chooses not to divulge such information.

146.815 History History: 1981 c. 214.

146.816 146.816 Uses and disclosures of protected health information.

146.816(1) (1) In this section:

146.816(1)(a) (a) “Business associate” has the meaning given in 45 CFR 160.103.

146.816(1)(b) (b) “Covered entity” has the meaning given in 45 CFR 160.103.

146.816(1)(c) (c) “Disclosure” has the meaning given in 45 CFR 160.103 and includes redisclosures and rereleases of information.

146.816(1)(d) (d) “Health care operations” has the meaning given in 45 CFR 164.501.

146.816(1)(e) (e) “Payment” has the meaning given in 45 CFR 164.501.

146.816(1)(f) (f) “Protected health information” has the meaning given in 45 CFR 160.103.

146.816(1)(g) (g) “Treatment” has the meaning given in 45 CFR 164.501.

146.816(1)(h) (h) “Treatment facility” has the meaning given in s. 51.01 (19).

146.816(1)(i) (i) “Use” has the meaning given in 45 CFR 160.103.

146.816(2) (2) Sections 51.30 (4) (a) and (e) and 146.82 and rules promulgated under s. 51.30 (12) do not apply to a use, disclosure, or request for disclosure of protected health information by a covered entity or its business associate that meets all the following criteria:

146.816(2)(a) (a) The covered entity or its business associate makes the use, disclosure, or request for disclosure in compliance with 45 CFR 164.500 to 164.534.

146.816(2)(b) (b) The covered entity or its business associate makes the use, disclosure, or request for disclosure in any of the following circumstances:

146.816(2)(b)1. 1. For purposes of treatment.

146.816(2)(b)2. 2. For purposes of payment.

146.816(2)(b)3. 3. For purposes of health care operations.

146.816(2)(b)4. 4. For purposes of disclosing information about a patient in a good faith effort to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.

146.816(2)(b)5. 5. For purposes of disclosing under s. 175.32 any threat made by a patient regarding violence in or targeted at a school in a good faith effort to prevent or lessen a serious and imminent threat to the health or safety of a student or school employee or the public.

146.816(3) (3) A covered entity that is a treatment facility shall comply with the notice of privacy practices obligations under 45 CFR 164.520, including the obligation to include in plain language in the notice of privacy practices a statement of the individual’s rights with respect to protected health information and a brief description of how the individual may exercise those rights including the right to request restrictions on uses and disclosures of protected health information about the individual to carry out treatment, payment, or health care operations as provided in 45 CFR 164.522.

146.816(4) (4) The department shall make a comprehensive and accessible document written in commonly understood language that explains health information privacy rights available to all applicable health care facilities in the state and on the department’s Internet site.

146.816 History History: 2013 a. 238; 2017 a. 140, 143.

146.817 146.817 Preservation of fetal monitor tracings and microfilm copies.

146.817(1) (1) In this section, “fetal monitor tracing” means documentation of the heart tones of a fetus during labor and delivery of the mother of the fetus that are recorded from an electronic fetal monitor machine.

146.817(2) (2) 

146.817(2)(a) (a) Unless a health care provider has first made and preserved a microfilm copy of a patient’s fetal monitor tracing, the health care provider may delete or destroy part or all of the patient’s fetal monitor tracing only if 35 days prior to the deletion or destruction the health care provider provides written notice to the patient.

146.817(2)(b) (b) If a health care provider has made and preserved a microfilm copy of a patient’s fetal monitor tracing and if the health care provider has deleted or destroyed part or all of the patient’s fetal monitor tracing, the health care provider may delete or destroy part or all of the microfilm copy of the patient’s fetal monitor tracing only if 35 days prior to the deletion or destruction the health care provider provides written notice to the patient.

146.817(2)(c) (c) The notice specified in pars. (a) and (b) shall be sent to the patient’s last-known address and shall inform the patient of the imminent deletion or destruction of the fetal monitor tracing or of the microfilm copy of the fetal monitor tracing and of the patient’s right, within 30 days after receipt of notice, to obtain the fetal monitor tracing or the microfilm copy of the fetal monitor tracing from the health care provider.

146.817(2)(d) (d) The notice requirements under this subsection do not apply after 5 years after a fetal monitor tracing was first made.

146.817 History History: 1987 a. 27, 399, 403.

146.819 146.819 Preservation or destruction of patient health care records.

146.819(1) (1) Except as provided in sub. (4), any health care provider who ceases practice or business as a health care provider or the personal representative of a deceased health care provider who was an independent practitioner shall do one of the following for all patient health care records in the possession of the health care provider when the health care provider ceased business or practice or died:

146.819(1)(a) (a) Provide for the maintenance of the patient health care records by a person who states, in writing, that the records will be maintained in compliance with ss. 146.81 to 146.835.

146.819(1)(b) (b) Provide for the deletion or destruction of the patient health care records.

146.819(1)(c) (c) Provide for the maintenance of some of the patient health care records, as specified in par. (a), and for the deletion or destruction of some of the records, as specified in par. (b).

146.819(2) (2) If the health care provider or personal representative provides for the maintenance of any of the patient health care records under sub. (1), the health care provider or personal representative shall also do at least one of the following:

146.819(2)(a) (a) Provide written notice, by 1st class mail, to each patient or person authorized by the patient whose records will be maintained, at the last-known address of the patient or person, describing where and by whom the records shall be maintained.

146.819(2)(b) (b) Publish, under ch. 985, a class 3 notice in a newspaper that is published in the county in which the health care provider’s or decedent’s health care practice was located, specifying where and by whom the patient health care records shall be maintained.

146.819(3) (3) If the health care provider or personal representative provides for the deletion or destruction of any of the patient health care records under sub. (1), the health care provider or personal representative shall also do at least one of the following:

146.819(3)(a) (a) Provide notice to each patient or person authorized by the patient whose records will be deleted or destroyed, that the records pertaining to the patient will be deleted or destroyed. The notice shall be provided at least 35 days prior to deleting or destroying the records, shall be in writing and shall be sent, by 1st class mail, to the last-known address of the patient to whom the records pertain or the last-known address of the person authorized by the patient. The notice shall inform the patient or person authorized by the patient of the date on which the records will be deleted or destroyed, unless the patient or person retrieves them before that date, and the location where, and the dates and times when, the records may be retrieved by the patient or person.

146.819(3)(b) (b) Publish, under ch. 985, a class 3 notice in a newspaper that is published in the county in which the health care provider’s or decedent’s health care practice was located, specifying the date on which the records will be deleted or destroyed, unless the patient or person authorized by the patient retrieves them before that date, and the location where, and the dates and times when, the records may be retrieved by the patient or person.

146.819(4) (4) This section does not apply to a health care provider that is any of the following:

146.819(4)(a) (a) A community-based residential facility or nursing home licensed under s. 50.03.

146.819(4)(b) (b) A hospital approved under s. 50.35.

146.819(4)(c) (c) A hospice licensed under s. 50.92.

146.819(4)(d) (d) A home health agency licensed under s. 50.49 (4).

146.819(4)(f) (f) A local health department, as defined in s. 250.01 (4), that ceases practice or business and transfers the patient health care records in its possession to a successor local health department.

146.819 History History: 1991 a. 269; 1993 a. 27; 1999 a. 9.

146.819 Cross-reference Cross-reference: See also ch. Med 21, Wis. adm. code.

146.82 146.82 Confidentiality of patient health care records.

146.82(1) (1) Confidentiality. All patient health care records shall remain confidential. Patient health care records may be released only to the persons designated in this section or to other persons with the informed consent of the patient or of a person authorized by the patient. This subsection does not prohibit reports made in compliance with s. 253.12 (2), 255.40, or 979.01; records generated and disclosed to the controlled substances board pursuant to s. 961.385; testimony authorized under s. 905.04 (4) (h); or releases made for purposes of health care operations, as defined in 45 CFR 164.501, and as authorized under 45 CFR 164, subpart E.

146.82(2) (2) Access without informed consent.

146.82(2)(a) (a) Notwithstanding sub. (1), patient health care records shall be released upon request without informed consent in the following circumstances:

146.82(2)(a)1. 1. To health care facility staff committees, or accreditation or health care services review organizations for the purposes of conducting management audits, financial audits, program monitoring and evaluation, health care services reviews or accreditation.

146.82(2)(a)2. 2. To the extent that performance of their duties requires access to the records, to a health care provider or any person acting under the supervision of a health care provider or to a person licensed under s. 256.15, including medical staff members, employees or persons serving in training programs or participating in volunteer programs and affiliated with the health care provider, if any of the following is applicable:

146.82(2)(a)2.a. a. The person is rendering assistance to the patient.

146.82(2)(a)2.b. b. The person is being consulted regarding the health of the patient.

146.82(2)(a)2.c. c. The life or health of the patient appears to be in danger and the information contained in the patient health care records may aid the person in rendering assistance.

146.82(2)(a)2.d. d. The person prepares or stores records, for the purposes of the preparation or storage of those records.

146.82(2)(a)3. 3. To the extent that the records are needed for billing, collection or payment of claims.

146.82(2)(a)4. 4. Under a lawful order of a court of record.

146.82(2)(a)5. 5. In response to a written request by any federal or state governmental agency to perform a legally authorized function, including but not limited to management audits, financial audits, program monitoring and evaluation, facility licensure or certification or individual licensure or certification. The private pay patient, except if a resident of a nursing home, may deny access granted under this subdivision by annually submitting to a health care provider, other than a nursing home, a signed, written request on a form provided by the department. The provider, if a hospital, shall submit a copy of the signed form to the patient’s physician.

146.82(2)(a)6. 6. For purposes of research if the researcher is affiliated with the health care provider and provides written assurances to the custodian of the patient health care records that the information will be used only for the purposes for which it is provided to the researcher, the information will not be released to a person not connected with the study, and the final product of the research will not reveal information that may serve to identify the patient whose records are being released under this paragraph without the informed consent of the patient. The private pay patient may deny access granted under this subdivision by annually submitting to the health care provider a signed, written request on a form provided by the department.

146.82(2)(a)7. 7. To an elder-adult-at-risk agency designated under s. 46.90 (2) or other investigating agency under s. 46.90 for purposes of s. 46.90 (4) and (5) or to an adult-at-risk agency designated under s. 55.043 (1d) for purposes of s. 55.043. The health care provider may release information by initiating contact with the elder-adult-at-risk agency or adult-at-risk agency without receiving a request for release of the information from the elder-adult-at-risk agency or adult-at-risk agency.

146.82(2)(a)8. 8. To the department under s. 255.04 and to the persons specified under s. 255.04 (3). The release of a patient health care record under this subdivision shall be limited to the information prescribed by the department under s. 255.04 (2).

146.82(2)(a)9. 9.

146.82(2)(a)9.a. a. In this subdivision, “abuse” has the meaning given in s. 51.62 (1) (ag); “neglect” has the meaning given in s. 51.62 (1) (br); and “parent” has the meaning given in s. 48.02 (13), except that “parent” does not include the parent of a minor whose custody is transferred to a legal custodian, as defined in s. 48.02 (11), or for whom a guardian is appointed under s. 48.9795 or 54.10 or s. 880.33, 2003 stats.

146.82(2)(a)9.b. b. Except as provided in subd. 9. c. and d., to staff members of the protection and advocacy agency designated under s. 51.62 (2) or to staff members of the private, nonprofit corporation with which the agency has contracted under s. 51.62 (3) (a) 3., if any, for the purpose of protecting and advocating the rights of a person with developmental disabilities, as defined under s. 51.62 (1) (am), who resides in or who is receiving services from an inpatient health care facility, as defined under s. 51.62 (1) (b), or a person with mental illness, as defined under s. 51.62 (1) (bm).

146.82(2)(a)9.c. c. If the patient, regardless of age, has a guardian appointed under s. 48.9795 or 54.10 or s. 880.33, 2003 stats., or if the patient is a minor with developmental disability, as defined in s. 51.01 (5) (a), who has a parent or has a guardian appointed under s. 48.831 and does not have a guardian appointed under s. 48.9795 or 54.10 or s. 880.33, 2003 stats., information concerning the patient that is obtainable by staff members of the agency or nonprofit corporation with which the agency has contracted is limited, except as provided in subd. 9. e., to the nature of an alleged rights violation, if any; the name, birth date and county of residence of the patient; information regarding whether the patient was voluntarily admitted, involuntarily committed or protectively placed and the date and place of admission, placement or commitment; and the name, address and telephone number of the guardian of the patient and the date and place of the guardian’s appointment or, if the patient is a minor with developmental disability who has a parent or has a guardian appointed under s. 48.831 and does not have a guardian appointed under s. 48.9795 or 54.10 or s. 880.33, 2003 stats., the name, address and telephone number of the parent or guardian appointed under s. 48.831 of the patient.