+ Penfield Volunteer Emergency Ambulance

Patient Records


Requests for disclosure of records containing Protected Health Information (PHI) must be in writing and authorized by the HIPAA Compliance Officer in advance of release.

Required: The privacy rule defines a covered entity as a health care provider, a health plan or a health care clearinghouse. PVEA is considered a covered entity based on this definition. Covered entities are required to disclose PHI under two (2) circumstances:

  1. PHI must be disclosed to individuals who request their PHI in writing or in person or a written request for accounting of PHI disclosures.
  2. PHI must be disclosed when required by the U.S. Department of Health and Human Services (HHS) or its subsidiaries to determine a covered entity's compliance with the privacy rule. Permitted: A covered entity is permitted to use and disclose patient PHI without consent or authorization or without allowing the patient to object or agree in the following circumstances.
    1. The PHI is used by or disclosed to the individual who is the subject of the PHI; or
    2. The use or disclosure is for the covered entity's treatment, payment or health care operations or specified treatment, payment or operations purposes of another covered entity;
      1. For example, it would be permitted for PVEA and a hospital to exchange PHI concerning a specific call because of their direct treatment relationship with the patient.
      2. Another example, PVEA would be permitted to submit or exchange PHI to a health insurance provider for billing or payment purpose


All requests for medical information for legal purposes pertaining to care rendered by PVEA must be referred to the HIPAA Compliance Officer. Stringent confidentiality requirements are observed in reference to all medical information. Subpoenas must be in writing and dated when received. Under no circumstances are documents containing PHI to be released upon oral request.


PVEA Retains Patient Care Reports under the following guidelines:
  • Patient Care Records Age 18 or older at time of response
  • 0 years to under age 18 at time of response: 10 years from patient's 18th birthday
  • Records subject to legal proceedings: Permanent
  • Call response not involving patient contact or care: 3 years