Independent New Hampshire Journalism · Northfield, NH

When Concord Hospital Can Share Your Medical Records Without Asking You

Federal law opens twelve doors into your chart without your signature, hands police six separate routes to your information, and New Hampshire law orders the hospital to report you in a half dozen more situations. Here is the whole map.

The clipboard at Concord Hospital’s registration desk carries a form most patients sign without reading. It is not a consent form. It is an acknowledgment that you received the hospital’s Notice of Privacy Practices, a document describing everything the health system may already do with your information whether you agree or not. Your signature changes none of it.

That is the first thing to understand about medical privacy in New Hampshire’s largest independent health system. The Health Insurance Portability and Accountability Act, the federal law everyone calls HIPAA, is sold to the public as a privacy shield. Read the regulation and it functions as something closer to a permission map: a catalog of who can receive your diagnoses, your test results, your Social Security number, and your address, and under what conditions, with your authorization required only for what is left over. For Concord Hospital Health System, which now runs the hospitals in Concord, Laconia, and Franklin under one shared electronic record, that map covers a large share of the state’s population from the capital to the Lakes Region.

None of this means the hospital is breaking the law when it shares your chart. Almost all of it is legal. That is the point. The disclosures described below are the ones the law permits or commands, and the people they surprise are the patients who assumed a signature stood between their record and everyone else.

Three words do most of the work: treatment, payment, operations

The Privacy Rule’s baseline permission, 45 CFR 164.506, lets a hospital use and disclose your protected health information for treatment, payment, and health care operations without asking you. Treatment reaches every provider involved in your care, inside the system or out. Payment sends your identity, diagnosis, and procedures to your insurer with the bill. Operations covers the hospital’s own auditing, quality review, budgeting, and staff evaluation.

Concord Hospital’s own notice, revised February 1, 2026, is candid about how far that baseline reaches. The system’s shared electronic medical record extends to partners such as The Orthopedic Surgery Center and Concord Imaging Center. The system participates in accountable care organizations, clinical data registries, and a national health information exchange called CommonWell that transmits your record to outside providers involved in your care, with substance use and behavioral health information excluded. The notice also discloses that providers may use documentation tools built on what it calls secure advanced technology to draft treatment notes for the provider to review, which is the hospital telling you, in soft language, that software drafts your chart before your provider signs it.

You can opt out of the CommonWell exchange with a signed written request to the Health Information Management Services Department at 250 Pleasant Street in Concord. Most patients will never learn the option exists.

Twelve doors your signature never touches

Past the treatment-payment-operations baseline sits 45 CFR 164.512, the section titled, with bureaucratic honesty, uses and disclosures for which an authorization or opportunity to agree or object is not required. It lists twelve categories. Disclosures required by law. Public health activities, including disease reports, births, deaths, FDA safety work, and notifying people exposed to a communicable disease. Reports about victims of abuse, neglect, or domestic violence to protective agencies. Health oversight: audits, inspections, licensure, investigations. Judicial and administrative proceedings, where a court order gets exactly what it names and a bare subpoena gets records only if you were notified or a protective order was sought. Law enforcement, which earns its own section below. Coroners, medical examiners, and funeral directors. Organ, eye, and tissue procurement. Research under an institutional review board or privacy board waiver. Disclosures to prevent a serious and imminent threat to health or safety. Specialized government functions, a category that spans the military, national security agencies, presidential protection, correctional institutions, and reporting to the federal gun background check system. And workers’ compensation, where an employer’s insurer gets what the comp claim reasonably requires.

The twelve no-authorization categories in 45 CFR 164.512, the section of the HIPAA Privacy Rule that never requires your signature. (Graphic: Granite State Report)

Each category carries conditions, and the conditions matter. The serious-threat door, for example, opens only when the hospital in good faith believes disclosure is necessary to prevent or lessen a serious and imminent threat, and only to someone able to lessen it. But the structure is what patients should absorb: for these twelve purposes, the decision belongs to the hospital and the requester, not to you, and in most of them you are never told it happened unless you go ask for the list.

The police counter

Section 164.512(f) governs law enforcement, and it deserves its own reading because it is where public expectations and legal reality split widest. Police have six routes to information at Concord Hospital, and only the first requires paper.

Route one is legal process: a court order, a court-ordered warrant, a subpoena or summons from a judicial officer, a grand jury subpoena, or an administrative demand that is legally enforceable, relevant to a legitimate inquiry, specific, and impossible to satisfy with de-identified data. That route can pull the chart itself.

Route two requires nothing but a request. When an officer asks for help identifying or locating a suspect, fugitive, material witness, or missing person, the hospital may hand over your name and address, date and place of birth, Social Security number, blood type and Rh factor, the type of injury you came in with, the date and time of your treatment, the date and time of your death if you died, and a description of distinguishing features including scars and tattoos. No warrant. No subpoena. No notice to you. The regulation draws its line at DNA, dental records, and analysis of body fluids or tissue, which cannot move under this route.

Route three covers crime victims: with your agreement, or without it if you are incapacitated, the officer represents the information will not be used against you, waiting would impair an immediate enforcement need, and the hospital judges disclosure to be in your interest. Route four lets the hospital alert police when a death may have resulted from crime. Route five lets it report crime on its own premises. Route six lets emergency providers working off-site, an ambulance crew at a crash for instance, alert police to a crime, its location, and the perpetrator.

The line 164.512(f)(2) draws at the records desk: the left column moves on a verbal request, the right column takes legal process. (Graphic: Granite State Report)

There was a moment when New Hampshire considered hardening this counter. A 2020 bill, SB 466, would have amended the state patients’ bill of rights to bar hospitals from passing patient information to law enforcement without written patient approval or a court order. That language is not in the statute today. The current law’s confidentiality clause yields, as it always has, to anyone the law authorizes.

What New Hampshire orders the hospital to tell the government

Everything above is permission. New Hampshire law adds command. Four statutes turn Concord Hospital’s clinicians into mandatory informants, and each is worth knowing before you assume a conversation in an exam room stays there.

RSA 631:6 makes it a misdemeanor for anyone who treats a gunshot wound, or any injury believed caused by a criminal act, to fail to immediately notify law enforcement of “all the information he possesses concerning the injury.” The legislature carved out one exception: an adult victim of sexual assault or abuse as defined in the domestic violence chapter may object and stop the report, unless the victim is also being treated for a gunshot wound or other serious bodily injury, in which case the report goes in over the objection.

RSA 169-C:29 is broader than most states dare. It obligates not just physicians and nurses and hospital admission staff but any person having reason to suspect that a child has been abused or neglected to report it, to the Division for Children, Youth and Families or directly to police. New Hampshire is one of a handful of states whose reporting statute reaches even clergy. Suspicion triggers the duty; proof is not required.

RSA 161-F:46 does the same for incapacitated adults. Any person who in good faith suspects that an incapacitated adult has been abused, neglected, exploited, or left in hazardous conditions, or is neglecting themselves, must report it to the state, with after-hours reports routed to local police or the county sheriff.

RSA 141-C:7 rounds it out with disease. Every health care provider, laboratory director, and hospital administrator must report communicable diseases on the state’s list to the commissioner of Health and Human Services, and the report carries Social Security numbers when they were collected. The state’s Bureau of Infectious Disease Control runs the intake. Chapter 141-C keeps those reports confidential, but confidentiality inside a state database is not the same thing as the information never leaving the hospital.

Where New Hampshire is stronger than HIPAA

The state does give patients real ground the federal rule does not, and Concord Hospital patients should know where it is.

Start with ownership. RSA 332-I:1 declares all medical information in your records to be “the property of the patient,” even when a third-party vendor holds the file, and, as amended through 2025, caps the cost of electronic copies at a reasonable rate not to exceed $50. Concord Hospital’s notice puts it its own way: the records belong to the health system, the information belongs to you.

The hospital licensing chapter adds the confidentiality guarantee. RSA 151:21, X, part of the patients’ bill of rights every licensed facility must adopt, promises confidential treatment of everything in your record and requires written consent before release to “anyone not otherwise authorized by law to receive it.” The closing clause is the whole game. Every door in this article is an authorization by law, and the state guarantee steps aside for each one.

Then the piece HIPAA conspicuously lacks: a private right of action. You cannot sue anyone under HIPAA; your federal remedy is a complaint to the Office for Civil Rights, which fines institutions and pays you nothing. New Hampshire’s medical records chapter, by contrast, lets an aggrieved person bring a civil action for unlawful use or disclosure, with damages of not less than $1,000 per violation plus costs and reasonable legal fees. A Granite Stater whose record leaks has a state courthouse door a Texan does not.

The physician-patient privilege, RSA 329:26, puts doctor-patient communications on the same footing as attorney-client, then hands back much of what it gave: the privilege bends wherever another law provides otherwise, and it does not apply at all in medical licensing investigations, involuntary commitment proceedings, or guardianship cases. New Hampshire also codifies a duty to warn at RSA 329:31, so a credible threat voiced in an exam room can lawfully travel to its target and to police.

The armor that was stripped last year

For eleven months, reproductive health information carried extra federal armor. A 2024 rule barred hospitals from disclosing information about lawful reproductive care, defined to include contraception, IVF, and abortion, for use in investigating or penalizing that care, and required requesters to sign attestations. On June 18, 2025, a federal judge in Texas, Matthew Kacsmaryk, vacated the rule nationwide in Purl v. HHS, holding the department exceeded its authority. The federal government declined to appeal. A set of would-be intervenors filed and then withdrew, and the Fifth Circuit dismissed the appeal on September 10, 2025. The rule is dead.

The regulation books still print the stripped armor. The Code of Federal Regulations, current through this month, still displays the 2024 reproductive-privacy language inside 164.512. A court order hollowed it out; nobody has yet erased the text.

What survives is narrower and older. Substance use disorder treatment records from federally regulated programs keep their own confidentiality regime under 42 CFR Part 2, which generally demands written consent before those records move, and the 2024 rule’s notice provisions tied to Part 2 were the one piece Purl left standing. Concord Hospital’s notice reflects the practice: substance use treatment records sit behind role-based restrictions, stay out of the patient portal and the health information exchanges, and move only on written consent, in emergencies, or when law requires. Behavioral health notes get similar handling, and behavioral health inpatients are excluded from the hospital directory automatically. Everything else in your chart, including whatever a prosecutor might someday find interesting, now stands behind the ordinary rules described above and nothing more.

One record from Concord to Franklin, and the vendor who lost it

Geography is the part of this story that belongs to the Lakes Region. LRGHealthcare, the parent of Lakes Region General Hospital in Laconia and Franklin Regional Hospital, filed for Chapter 11 on October 19, 2020, carrying more than $100 million in debt. Concord Hospital bought the assets for $30 million; the bankruptcy court approved the sale in December 2020, the Attorney General’s Charitable Trusts Unit signed off in a negotiated resolution filed April 20, 2021, and the hospitals became Concord Hospital – Laconia and Concord Hospital – Franklin. One privacy notice, one shared record, one set of disclosure practices now runs from Concord to Laconia to Franklin.

The old records did not vanish with the old name, and neither did the risk. In a notice posted December 12, 2025, Concord Hospital – Laconia disclosed that Cerner, the legacy electronic health record vendor for LRGH, had been breached: an unauthorized party got into legacy Cerner systems as early as January 22, 2025, and took data. Cerner told the hospital on August 14, 2025, delivered the patient list on September 26, and letters went out December 12, offering identity monitoring. The compromised information may have included names, Social Security numbers, medical record numbers, doctors, diagnoses, medicines, test results, and images. The hospital’s systems were not breached and its operations were not disrupted, which is true and also beside the point for the Lakes Region patient whose 2019 diagnosis now sits on a stranger’s drive. Your data outlives your hospital’s corporate form, its software contracts, and its promises.

That breach notice, by the way, is itself a legal obligation. The federal Breach Notification Rule requires hospitals to tell you when your unsecured information is compromised, and New Hampshire’s medical records chapter adds a state-side duty to notify when information moves in ways federal law tolerates but state law does not. The right to be told is one of the few rights in this story that arrives without your asking.

Seven levers, most of them unused

What can a patient do with all this? More than most patients ever try.

You can opt out of the hospital directory at registration or on the floor, after which the hospital will not even confirm you are there to someone asking by name. You can opt out of the CommonWell exchange in writing. You can shut off fundraising contact through Concord Hospital Trust. You can request restrictions on disclosures in writing or through the MyPatient Connect portal, and while the hospital can refuse most restriction requests, one is mandatory: if you pay for a service in full out of pocket, the hospital must honor your demand that the service never be reported to your insurer. You can get your records, electronically, for no more than $50 under state law, and federal guidance bars any fee at all when you pull them yourself through the portal. You can demand an accounting of the non-routine disclosures made over the past six years, the closest thing to an audit trail the law gives you. And you can complain, to Patient Relations at (603) 230-1902 or ptrelations@crhc.org, or to the federal Office for Civil Rights, and the law forbids retaliation for doing it.

The seven levers, with the contact points Concord Hospital’s own notice provides. (Graphic: Granite State Report)

One more from the hospital’s own notice deserves a plain-language warning. When family or friends are involved in your care and you cannot speak for yourself, the notice says “we will use our best judgment about who to share your information with.” If there is a person in your life who should never hear your room number, the time to say so is at registration, on the record, not later.

The map is the message

Concord Hospital is not the villain of this piece. Its notice is clearer than most, its opt-outs are real, and nothing reported here accuses the system of breaking any rule. The problem is the rulebook, and the gap between what patients believe it says and what it says. A law marketed as privacy protection operates as a routing system, one that moves your information to insurers, registries, exchanges, state databases, and police counters on the strength of decisions you never see. The state constitution New Hampshire voters amended in 2018 declares a right to live free from governmental intrusion into private information. The statutes underneath it authorize the intrusions one paragraph at a time.

Read the notice. Pull the levers. And when a form says your signature is an acknowledgment, believe it. An acknowledgment is exactly what it is.

Fact check

Sources

• 45 CFR 164.512, Electronic Code of Federal Regulations · ecfr.gov
• 45 CFR 164.510, Electronic Code of Federal Regulations · ecfr.gov
• Concord Hospital Health System, Notice of Privacy Practices (rev. Feb. 1, 2026) · concordhospital.org
• Concord Hospital, Notice of Cerner Data Privacy Incident (Dec. 12, 2025) · concordhospital.org
• Holland & Knight, HIPAA’s Reproductive Health Rule Is Vacated Nationally (June 20, 2025) · hklaw.com
• American Bar Association, Fifth Circuit Dismisses Appeal … Signaling the End of the Purl Case · americanbar.org
• RSA 631:6 · Justia
• RSA 169-C:29 · Justia
• RSA 161-F:46 · Justia
• RSA 141-C:7 · Justia; NH DHHS, Infectious Disease Reporting · dhhs.nh.gov
• RSA 332-I:1 · Justia; RSA 332-I:6 (civil action) cited from the chapter text at gc.nh.gov
• RSA 151:21 · Justia; SB 466 (2020) · LegiScan
• RSA 329:26 · Justia
• NH Department of Justice, resolution on Concord Hospital’s acquisition of LRGHealthcare (April 20, 2021) · doj.nh.gov
• Laconia Daily Sun, sale of LRGH and Franklin assets approved · laconiadailysun.com
• HHS Office for Civil Rights, Individuals’ Right of Access guidance · hhs.gov; consumer rights page and video series · hhs.gov