HIPAA

In reporting breaking news stories the frustration is often: why don’t we know more basic details about what happened? Initial reports are just that and investigation is ongoing but another factor is HIPAA law.

The 1996 Health Insurance Portability and Accountability Act, often referred to as HIPAA, stated that if Congress did not pass health-privacy legislation by August 1999, HHS officials would issue a set of rules. Congress missed the deadline, leaving the Clinton administration to draft a proposal.

Penalties for the unauthorized release of such information by health-care workers can reach as high as $250,000 and 10 years in jail for each violation. The regulations offer some waivers for law enforcement officials conducting investigations.

Regardless of the scale of the incident, the general public wants to know two things: How the accident occurred and what happened to the people involved. The most notable case in the Mother Lode was that of the woman who went missing from Sonora Regional Medical Center.  Which later ended in tragedy. There were comments from people claiming to be relatives and I am sure untold frustration on the part of the people working at Sonora Regional who are legally not allowed to comment.

So here are a few general rules to consider about news reports and Hipaa from a Stanford Hospital summary:

When A Patient Is Incapacitated

• The previously designated a representative (e.g. closest available relative) has the right to authorize (or object to) the release of the patient’s information to the media.
• If no designated representative, it is up to the hospital’s and the patient must be informed as it is practical to do so.
• Hospitals do not release patient information for patients who opt out of providing information or if the information could embarrass or endanger patients.

Information could include the room location of the patient (e.g. admission to an obstetrics unit following a miscarriage or admission to an isolation room for treatment of an infectious disease, etc.).

Additionally, a hospital should not report a patient’s location within the hospital-or even confirm the patient’s presence in the facility-if that information could potentially endanger the patient (e.g. the hospital has knowledge of a stalker or abusive partner, etc.).

Other Applicable Federal Or State Laws

• Federal and state laws specifically prohibit hospitals from releasing any information about patients who are being treated for alcohol or substance abuse or mental or developmental disabilities.
• This includes acknowledging, even in response to specific inquiries, that a patient is being treated in a facility if doing so would identify them as being the recipient of these services.
• Hospitals that provide treatment for alcohol or substance abuse or for mental or developmental disabilities should develop specific policies and procedures to address the additional restrictions imposed on the disclosure of information related to such treatment.

Information that is included on police logs is considered to be matters of public record (i.e., the transport of car accident victims to a hospital, etc.).

Even though public record cases may result in increased media inquiries, hospitals must take the same precautions to protect patient privacy as in other situations including the HIPAA requirement that information be released only if the inquiry specifically contains the patient’s name.

For example, in the case of a car accident victim who is transported by the fire department or paramedics to a hospital, a reporter must have the car accident victim’s name before the hospital can provide any patient information.

There are numerous state statutes that address reporting of incidents ranging from child abuse to gunshot wounds. The fact that a hospital has an obligation to report certain confidential information to a government agency does not make that information public and available to the news media.

Comments on local news stories are welcome but with reporting the balance is in favor of an individual’s right to privacy.