A Reporter’s Guide toMedical Privacy Law                            S                                   ince stringent med...
CINCINNATI ENQUIRER PHOTO BY GLENN HARTONGThe Ohio Supreme Court ruled in March that The Cincinnati Enquirer was entitled ...
fying information, their first fallback was whether notices issued to property owners             still be public because ...
John Greiner, the Enquirer’s attorney,said he thinks the decision will help the pa-per access other documents, such as pol...
means a lot of time is spent retraining staff      tion that wouldn’t allow you to create any       D.C., Fire Department....
AP PHOTO BY PABLO MARTINEZ MONSIVAIS          The media were allowed into a          Washington, D.C., hospital last      ...
“If I were the attorney for the media, the                                                                                ...
AP PHOTO BY BILL HABER          During Hurricane Katrina, when     floodwaters in New Orleans caused        emergency offi...
Top secret                                                                                                                ...
Confusing laws keep informationconfidential on college campuses   A college football game illustrates thestrange interpret...
AP/THE DAILY TEXAN PHOTO BY MARK MULLIGAN                                                                                 ...
The Reporters Committee for Freedom of the Press is commit-           law help, there’s the Open Government Guide, a compl...
Upcoming SlideShare
Loading in …5

Reporter’s Guide to Medical Privacy Law


Published on

Published in: Self Improvement
1 Like
  • Be the first to comment

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Reporter’s Guide to Medical Privacy Law

  1. 1. A Reporter’s Guide toMedical Privacy Law S ince stringent medical privacy regulations went into effect in 2003, the media have been forced to learn the new rules, work around them in some cases, and in others battle them in court. Yet the Health Insurance Portability and Accountability Act’s privacy rule remains a prickly issue for reporters, hampering routine reporting assign- ments and big investigative pieces. Journalists have challenged the pri- vacy rule in court in a handful of cases and at least twice have won rulings re- quiring the release of information under state public records laws. continued inside AP PHOTOS
  2. 2. CINCINNATI ENQUIRER PHOTO BY GLENN HARTONGThe Ohio Supreme Court ruled in March that The Cincinnati Enquirer was entitled to lead notices that the local healthdepartment had withheld under HIPAA. Using that information, the Enquirer ran a series detailing the city’s lead problemand its effect on children such as Marquise Taylor (above), a five-year-old with elevated levels of lead in his body. When Congress passed HIPAA in 1996, so some are completely HIPAA-compliant, “The general news people — I feelthe law required the Department of Health while others can compartmentalize so that terrible for them,” said Chris Halsne, anand Human Services to enact federal health only parts of the organization are obligated investigative reporter for KIRO-TV in Se-privacy regulations, known as the Standards to comply with the act. attle. “It’s terribly frustrating for them whenfor Privacy of Individually Identifiable For instance, HIPAA may apply to coun- they know that the information is legallyHealth Information, or the privacy rule. ty ambulance services that bill electronically, available, it’s just not going to be — basedMedia organizations objected that the but may not apply in other counties without on . . . who knows what?”proposed rule overly restricted access to electronic billing. And where HIPAA may Halsne’s biggest HIPAA-related probleminformation. Still, the law went into effect prevent the release of health information in came when he was working on a Novemberin 2003. one state, another state’s public records laws 2005 story examining the frequency and Initially, HIPAA caused immense con- could make the same information public. rationale behind prescribing narcotics tofusion. Many entities that assumed they “There’s been tremendous confusion,” state prisoners.were covered by the law were not, and said Robert Gellman, a privacy consultant The numbers — what the prison boughtmost feared the harsh criminal penalties — who worked for the House Committee on and how much it cost — were a financialincluding jail time — associated with violat- Government Operations when HIPAA was matter and clearly public, he said.ing the law. drafted. “It’s been dying down, but it’s still Halsne got the numbers but also wanted Because of the language of the act, which going on. There was an initial panic and a log book of medications disbursed in thewas mainly concerned with controlling the there was a lot of initial misunderstanding prisons that includes the prisoner name,electronic transfer of health information, and it takes a long time to beat that out of identification number, reason for the medi-agencies that perform similar functions the system.” cation, the prescription, the date, and themay be subject to different standards under Journalists say agencies are withholding amount of drugs.HIPAA. records that were never intended to be cov- “They do that mostly not for medical Each agency can set itself up differently ered under HIPAA because they are unsure reasons, but for accounting purposes be- about the law — or use it as an excuse. cause they don’t want to be missing a bunch This guide was compiled by Reporters Commit- Initially, some refused to turn over of pills,” he said.tee legal intern Hannah Bergman and was made documents such as accident reports and He requested the log book with the namespossible by a grant from the Robert R. McCormick some would not give journalists even basic and identification numbers redacted.Tribune Foundation. information about accidents. “Even then, when there was no identi-Page 2 The Reporters Committee for Freedom of the Press Winter 2007
  3. 3. fying information, their first fallback was whether notices issued to property owners still be public because “the Ohio PublicHIPAA,” he said. of residences where children had tested Records Law . . . requires disclosure of these at high levels for lead in their blood were reports, and federal law, HIPAA, does notHIPAA and state laws public. supersede state disclosure requirements,” Halsne was able to report the story with- In covering a housing court, reporter Justice Terrence O’Donnell wrote for theout the records but said the data would have Sharon Coolidge had noticed only build- unanimous court.made it “more complete.” ing department cases on the docket and not The court wrestled with how to read the “If I cared enough and we would have cases brought by the health department. federal and state laws.fought this one on prison drugs, we would It quickly became clear that HIPAA was “We are confronted here with a prob-have won,” he said. “They just didn’t want the reason no health department cases were lem of circular reference because the Ohioto give it to us.” being docketed. When Coolidge learned the Public Records Act requires disclosure of But some journalists have successfully missing cases might involve a lead issue, she information unless prohibited by federalbattled agencies in court. knew there was a story, somewhere, about law, while federal law allows disclosure of The battles primarily involve disputes the city’s lead problem. protected health information if required byover the privacy rule’s “required by law” When she initially requested the lead state law,” O’Donnell wrote.provision. That provision allows HIPAA- notices, the health department refused, cit- The court concluded that neither Con-covered entities to disclose “protected ing the reference in the notices to children’s gress nor the Department of Health andhealth information” to the extent that such blood test results. Human Services intended to preempt stateuse or disclosure is required by law. “It’s pretty scary to go the lawsuit route disclosure laws. The court also noted that in Though the decisions are not binding because what if they said no?” Coolidge said. the guidance issued along with the privacyoutside of the courts’ jurisdictions, they may “Then I would be setting precedent.” rule, HHS said when a conflict arose be-be influential for other courts considering Initially the newspaper lost, as she feared. tween the federal Freedom of Informationthe issue and signal the courts’ skepticism When the state Supreme Court agreed Act and HIPAA, FOIA was an example of aof attempts to restrict access to information to hear the case, Coolidge said she was disclosure “required by law.”that was public before HIPAA. surprised. In June, the paper ran a three-story series In March, Ohio’s highest court ruled The court ruled that the notices did not based on the records, detailing the plight ofin favor of The Cincinnati Enquirer, which contain “protected health information” families whose children have been harmedfought the local health department over and that even if they did, the notices would by lead. What is HIPAA? that governs public release of information another part of the university, such as an and can prove so frustrating for reporters athletics department or nursing school, HIPAA history inquiring about a patient’s condition — was that did not comply with HIPAA. Congress passed the Health Insur- to give patients more control of the release “Affiliated covered entities” are legally ance Portability and Accountability Act of their medical information. Thus, the rule separate entities that have a common in August 1996. The law provided that frequently requires written consent forms. ownership. For example, a university if Congress failed to pass health privacy hospital and a university medical founda- legislation in three years, the Department Affected parties tion could have a common owner but be of Health and Human Services would HIPAA applies to health care organiza- legally separate entities. In that case, both issue rules under the authority given to tions, including providers, health plans, entities must comply with HIPAA. it in HIPAA. public health authorities, life insurers, billing Congress did not pass another privacy agencies, service organizations, ambulance Penalties bill and in October 1999, Health and services and medical universities. If the orga- For unintentionally violating the Human Services released a draft rule, nization electronically bills for health care or privacy rule, civil penalties of $100 per called the Standards for Privacy of Indi- transmits health information, HIPAA applies violation can be assessed up to a $25,000 vidually Identifiable Health Information regardless of the organization’s size. annual maximum fine. and known as the “privacy rule.” After The privacy rule allows a HIPAA-covered For intentional violations and misuse receiving tens of thousands of comments organization that has another function in ad- of individually identifiable health infor- on the draft, the department issued a final dition to providing health care to designate mation, criminal penalties can lead to a rule in December 2000 with modifications itself as a “hybrid entity.” The entity defines fine up to $250,000 and imprisonment following in August 2002. what its “health care component” is and for up to 10 years. Comments from the media — including makes sure that component complies with A safe harbor provision exists for The Reporters Committee for Freedom HIPAA. A “wall” is set up between the health inadvertent disclosures made by covered of the Press, the Newspaper Association care component of the organization and the entities that exercise reasonable diligence of America, the National Newspaper As- non-health care component. Information in attempting to comply with the law. sociation, and the American Society of is not shared internally by the two sides, An investigation in June by The Wash- Newspaper Editors — argued that the and the non-health care component is not ington Post found that no one has ever been proposed rule too harshly restricted access bound by HIPAA. If the organization does fined for violating HIPAA. However, the to information. not designate itself as a hybrid, the entire Post reported that the Justice Department Despite media concerns, health care operation must comply with HIPAA. has prosecuted two criminal cases, one organizations were required to comply For example, a university may designate against a Seattle man who stole credit with the privacy rule beginning in April itself a hybrid entity. Its hospital and medi- card information from a cancer patient 2003. According to its authors, the goal cal school may be designated as compliant, and another against a Texas woman who of the privacy rule — the part of HIPAA but they would not share information with sold an FBI agent’s medical records. uWinter 2007 A Reporter’s Guide to Medical Privacy Law Page 3
  4. 4. John Greiner, the Enquirer’s attorney,said he thinks the decision will help the pa-per access other documents, such as policeincident reports, that are frequently with-held citing HIPAA despite efforts to educatethe police that HIPAA does not apply tothose sorts of materials. “I think [it helps] in the sense that acourt said it’s OK to turn this stuff over,”Greiner said. The decision is also likely to solidify pre-HIPAA court rulings that 911 call recordsare public, he said, because of the way thecourt read the state freedom of informationlaw in conjunction with HIPAA. A Texas appeals court looked to the Ohiodecision, as well as the government guide-lines, in a recent case involving a Dallastelevision station that sought statistics aboutalleged sexual assaults at state psychiatrichospitals. In June, the court said the informationsought did not seem to qualify as protectedinformation under HIPAA. But even if the information is protected,the court wrote, the agency must determinewhether there is an exception to the privacyrule that allows the release. If the request ismade under the Texas Public InformationAct, it falls under the “required by law”exception. Other courts have sidestepped the issue.In Louisiana, Gannett River States Publish-ing, which owns several newspapers in thearea, sued the East Baton Rouge Parishemergency medical services department AP PHOTO BY PABLO MARTINEZ MONSIVAISafter officials refused to release 911 tapes,citing HIPAA. The Washington, D.C., Fire Department, shown here responding to a mercury spill in 2005, stopped allowing media ride-alongs after the Department of Health But the appeals court did not address and Human Services received complaints about a newspaper report containingthe applicability of HIPAA, opting instead patient information.to declare the calls confidential under statelaw in December 2005. Many media outlets fear hospitals and Working around HIPAA other health care providers will be able to Since health care agencies continue toPotential for punishment retaliate against them in civil actions if they stonewall reporters, media organizations Much of local agencies’ reluctance to re- publish protected health information. have tried to find solutions to get recordslease health and medical information comes But in 2004, a federal judge in Denver without resorting to lawsuits.from the potential penalties they face under held that a private party cannot sue under When it comes to breaking news stories,the federal regulations. HIPAA. Halsne, the Seattle TV reporter, says the “Everybody has had the same problem of The University of Colorado Hospital station now sends producers down hospitalno one knows what HIPAA says really well,” sued the publisher of the Rocky Mountain halls, trying to find information withoutsaid Gellman, the privacy advocate. “In the (Denver) News to prevent the newspaper asking the public relations staff.absence of a firm, clear lawyer standing next from printing an internal report, arguing Reporters also have cultivated additionalto you saying you won’t go to jail, people that publishing the information would be sources, such as security guards in the base-just say no.” a violation of HIPAA. The court neither ment, who they rely on to confirm basic But an investigation by The Washington granted the injunction nor allowed the information.Post published in June found that after hospital to continue its case against the In Atlanta, reporters have frequently metthree years and almost 20,000 complaints newspaper. with hospital staff in an attempt to resolve is-to Health and Human Services, no one has U.S. District Judge Walker Miller wrote sues before they arise in breaking news, saidever been fined for violating HIPAA and there was no evidence Congress intended Tom Clyde, an attorney who represents Theonly two criminal cases have been brought for a private party to be able to enforce Atlanta Journal-Constitution and WSP-TV.against alleged violators. Neither involved HIPAA, particularly through the privacy “There’s no question it’s been helpful,”releasing information to the media. rule. Though the federal judge’s ruling is Clyde said. “It has improved things, espe- The department told the Post it prefers to not binding elsewhere, the judge’s decision cially in the emergency situation.”work with institutions for voluntary compli- has been cited by other courts throughout But Clyde says the turnover at hospitalsance instead of enforcing the law strictly. the country. and government agencies can be high, whichPage 4 The Reporters Committee for Freedom of the Press Winter 2007
  5. 5. means a lot of time is spent retraining staff tion that wouldn’t allow you to create any D.C., Fire Department.and getting people comfortable with estab- statistics below the three-digit ZIP code The information came not from emer-lished practices. level,” Milliron said. Across Georgia, that gency personnel but from the patients For example, David Milliron, the com- means there would only be a handful of themselves, said Alan Etter, a spokesmanputer-assisted reporting editor at the Jour- geographic groups the newspaper could for the department.nal-Constitution, said he has had difficulty analyze. “A reporter walked up to the patient insecuring vital statistics from Georgia this “It’s very disconcerting to the newspaper a public area, and this person as an adult —year, including birth, death and marriage when the newspaper has spent great expense — obstinately aware of the ramifications —records — something the newspaper has legal and time wise — working out an agree- gave the reporter his name,” Etter said.done for at least nine years. ment,” he said. But Health and Human Services did not The newspaper uses the data to do stories Even some agencies have complained care, and the fire department has stoppedon topics such as marriage and divorce rates that overzealous enforcement of HIPAA media ride-alongs on ambulances becauseand teen pregnancy, and to publish interest- prevents them from publicizing positive of the federal government’s concerns, Et-ing feature pieces, such as statistics about the work and hurts the public’s right to know. ter said.babies who were born on Sept. 11, 2001. The Department of Health and Human “It makes it difficult for a PR guy like Recently, with new employees working Services received complaints after the Wash- me to show his fire department in action,”for the state, there are new problems, Mil- ington City Paper published stories with iden- he said. “This is a publicly funded service —liron said. tifying information about patients obtained people who pay taxes in the city ought to be “They want to apply some de-identifica- during a ride-along with the Washington, able to see.” u What records are available by some state hospital associations and the 911 dispatchers and paramedics provide under HIPAA? federal government, can detail the number health care, the attorney general said, of procedures performed, death rates and medical information in these records is Hospital directory information other information, but no names can be confidential under state law. However, the According to the Department of attached to the data. Generally, it is avail- attorney general said the state law does Health and Human Services, hospital able from the National Center for Health not protect the identity of the person who directory information containing basic Statistics (www.cdc.gov/nchs). called 911 or the identity of the person facts about current or recent patients transported. treated by a hospital should be released. Death, autopsy and coroner The same year, the Mississippi attor- This includes patients’ names, locations records ney general reached a similar conclusion. within the hospital, general conditions State laws vary widely on the availability Analyzing whether a county emergency (including whether a patient has been of death, autopsy and coroner records. Even medical service record could be released treated and released or has died), reli- before medical privacy rules, the availability under HIPAA, the attorney general gious affiliations and room telephone of these records was being curtailed. How- opinion concluded the act’s “required by numbers. The American Hospital As- ever, the Department of Health and Human law” exception would allow the release sociation (AHA) advises its members that Services says that if state law “provides for of information that was public under the information about the location a patient the reporting of disease or injury, child state’s public records law. was released to and the date and time of abuse, birth, or death, or for public health death should not be disclosed. surveillance, investigation, or intervention,” Ambulance ride-alongs The department’s guidelines require HIPAA does not prevent it. In at least one case, the Department of that patients be informed about the in- A 2004 Nebraska attorney general opin- Health and Human Services has cracked formation in the directory and be allowed ion found that cause of death was protected down on reporters riding along on medi- the chance to object to disclosure. In an health information under the act. However, cal emergency calls. emergency, if the patient has not had a the opinion also determined the information Washington, D.C.’s fire and EMS unit chance to consent, the hospital may still should be released because Nebraska’s open received a letter from the department release the information if it deems the records law mandated it. after a reader complained when the Wash- release is in the patient’s best interest. ington City Paper ran a story with patient The AHA also advises its members Ambulance and Emergency information the reporter obtained from that directory information can only be Medical Services records the patient. released if a reporter identifies the pa- Often medical information in these re- As a result of the letter, the city no lon- tient by name and that the room number cords will be protected under state laws, but ger allows media ride-alongs on medical of a patient should never be disclosed to other information in the records, such as the calls, though it will allow limited access the media without patient permission time it took an ambulance to reach a scene, to fire calls. as a matter of policy. The association’s can be released. Whether ambulance service In June 2004, Health and Human practices may be more restrictive than is covered by HIPAA generally depends on if Services sent a letter to the American the law requires, but journalists should the ambulance service bills the patient. Ambulance Association that addresses know what hospitals are being told. In a 2005 opinion, the Maryland attor- questions about ride-alongs. The letter ney general, in deciding whether dispatch concludes that without patient authori- Hospital billing data records known as “event reports” from the zation, disclosure of health information Statistical information related to Baltimore County Fire Department could to the media during a ride-along is not hospital billing data is not covered by be released, wrote that HIPAA does not allowed. It is unclear how authorization HIPAA, which means hospitals can apply because the fire department does not would be obtained in many emergency release it. This information, collected bill electronically for its services. Because situations. uWinter 2007 A Reporter’s Guide to Medical Privacy Law Page 5
  6. 6. AP PHOTO BY PABLO MARTINEZ MONSIVAIS The media were allowed into a Washington, D.C., hospital last year to shoot the recovery of two conjoined twins, but in many other cases, reporters have found it difficult or impossible to obtain access to hospitals for stories.Health care journalists’ accessto hospitals curtailed under HIPAA For health care journalists, the Health “In their attempt to sent did not relieve them of their HIPAAInsurance Portability and Accountability Act responsibilities.has changed the way they do their jobs and control, they really damage Shelton said that is not true. “Clearly, ifmade telling the stories of patients and those the relationship and they the patient signs a HIPAA form allowingwho provide their care more difficult. damage journalism.” me to be there, there’s no reason I can’t be Reporters say they devote more time there,” she said.than ever before negotiating for access for — St. Louis Post-Dispatch She was not able to persuade the hospitalhealth-related articles, often to no avail. reporter Deborah Shelton to give her more access and never wrote “From stories our members tell us, some the story. Shelton said she doubts HIPAAhospitals use HIPAA as a convenient way to was the problem. Instead, she believes thatobstruct reporters. Journalists are spending patient that wants to talk with a reporter, hospital officials were citing the law becausemore time arguing over inaccurate interpre- there may be one in the same hallway that they were concerned she would see some-tations of the law with hospital media rela- doesn’t,” Mitchell said. That, in most cases, thing they did not want her to, such as thetions specialists,” said Carla K. Johnson, a is what the hospital staff is worried about potentially awkward moments that occurboard member of the Association of Health when dealing with the media and access, when a medical student is just learning howCare Journalists. she said. to work with patients. On the other side of the issue is the Deborah Shelton, who covers health care Such problems have increased in the pastAmerican Hospital Association. Alicia issues for the St. Louis Post-Dispatch, said year, she said.Mitchell, a spokeswoman for the AHA, says rather than negotiate for insufficient access “It’s not because there’s a lack of clar-most of the time hospitals will work to make to health care institutions, she has simply ity,” Shelton said. “It’s because HIPAA issure important health care stories get told not reported some stories. an excuse.”despite HIPAA. For example, at St. Louis University Shelton also pointed to another experi- “If somebody is coming to profile the Hospital, medical students set up a clinic ence she had writing about a neonatal unitpediatrics unit, then the hospital would need to provide health care to uninsured people. at St. Louis Children’s Hospital. She hadto work kind of hard to do that. And HIPAA, When the public affairs office pitched a three meetings with hospital staff to workquite frankly makes it harder than it was in story to Shelton about a fundraising auction out logistics, a tactic many people recom-the past,” Mitchell said. for the clinic, she suggested a story profiling mend, to head off HIPAA problems before Hospitals are constantly concerned about the clinic. they arise. But it did not work.patient privacy, she said, pointing out that She wanted to spend a day there, walking One important procedure for Sheltonpeople in hospitals are ill, there to recuper- around and talking with the students and was that she, rather then the hospital staff,ate, and not always prepared to deal with patients. With a patient’s consent, she also approach each family and ask their per-reporters. wanted to be in the exam room to see how mission to be in the story. At a meeting, “Some patients would be happy to talk the students interacted with the patient. hospital staff agreed to this condition, shewith reporters but even when there’s a But the hospital told her the patient’s con- said, and everything went well on the firstPage 6 The Reporters Committee for Freedom of the Press Winter 2007
  7. 7. “If I were the attorney for the media, the last thing in the world I’d want is a contract for that,” she said. Rush said when it comes to entering hos- pitals, there is little a reporter can do. “Hospitals are a problem area because there’s not really a legal access right,” she said. The information and access reporters enjoyed before HIPAA was more a matter of AP PHOTO BY PHELAN M. EBENHACK tradition than a right, she pointed out. Reporters have to be more creative in Often, officials say HIPAA requires them to enact strict barriers to getting information now, Rush said. For ex- enter hospitals — even for the most ample, if a reporter is being escorted around innocuous stories. Media attorneys say the hospital by public affairs staff and not it is difficult for journalists to assert a allowed to talk to patients, the reporter can legal right to access hospitals. write down patient names, room numbers, and other information they observe and staff to express how upset she was with the follow up later. way things turned out. “There’s nothing to stop a reporter from Mitchell said the hospital association approaching a patient,” Rush said. “They advises its members that they should be the just can’t do it at the hospital.” AP PHOTO BY TOM GANNAM ones asking for patient permission, just as She also said reporters can have patients the association advises members to always willing to share their own medical recordsRestrictions at the St. Louis Children’s escort a reporter inside of a hospital. request them and then share the copiesHospital have hampered some local “The responsibility is on the hospital and with the reporters. That is more access thenjournalists’ reporting. One reporter saidshe will turn to more acommodating it’s because the hospital is the entity with reporters had before HIPAA, when patientshospitals for feature stories in the responsibility of protecting the patient’s had trouble getting their own records, Rushfuture. privacy rights,” Mitchell said. “When the said. reporters are on campus, they’re supposed Shelton has her own way of dealing withday — until 5 p.m. to be accompanied by members of the media uncooperative hospitals. Now, she says, if “All of a sudden, one nurse decides she team, really in order to protect the patient’s she wants to do a story similar to her profilewasn’t comfortable with it,” Shelton said. privacy, which is paramount.” of the neonatal unit, she will turn to another The ground rules she had worked out Tonda Rush, a media attorney and hospital, one that will want the attention andseemed to fly out the window, she said. The director of public policy for the National will be more flexible.next day, the hospital’s public relations staff Newspaper Association, said it is not neces- Shelton emphasizes she has a choice oftook over asking families to be in the story. sarily advisable to commit to any contract or where she reports these types of enterpriseNot another family agreed. agreement to writing. To make the agree- stories, which hospitals don’t seem to rec- “Everything I got, the story we ended ment legally binding, the reporter would ognize.up running, came from everything I got the have to also make promises to the hospital, “In their attempt to control, they reallyfirst day,” she said. which would provide little flexibility for damage the relationship and they damage Afterward, she had several meetings with the reporter. journalism,” she said. u General access to hospitals to a patient if the hospital thinks it would Directory information when a The American Hospital Association interfere with the patient’s care. patient has opted out has guidelines for its members on how Patients can elect to not have their to respond to media requests generally. Inside of the hospital information included in the hospital Journalists need to know what hospitals Hospital staff should always accompany directory, or have their information are being told but should note that the reporters when they are inside the hospi- listed but not available to the press. If the association’s guidelines may be more tal. The staff can deny access to any area patient does not want information given restrictive than the law requires. The they believe patients have an expectation to the press, the hospital should ask the guidelines include: of privacy, including the emergency room, relationship to the patient of anyone who intensive care units and nurseries. is calling for a condition report. Access to patients’ rooms If a patient has opted out of the di- Hospitals should not give out a pa- Photographs and interviews rectory, the hospital should not respond tient’s room number without the patient’s Both photographs and interviews require with that information because it would permission. written consent of the patient. Background disclose the patient’s presence. The AHA photos taken in public spaces are not ad- recommends saying, “Federal medical Direct contact with patients dressed directly by HIPAA, but in general privacy regulations allow the hospital to Hospitals should not allow reporters to the hospital cannot release identifiable pho- release to the media only information in contact patients directly. A representative tos without patient permission. Hospital the hospital’s directory” and “the hospital of the patient should handle media calls. staff, rather then reporters, should approach does not have any information about the The hospital should deny media access people for permission. person in its directory.” uWinter 2007 A Reporter’s Guide to Medical Privacy Law Page 7
  8. 8. AP PHOTO BY BILL HABER During Hurricane Katrina, when floodwaters in New Orleans caused emergency officials to take away patients of Charity Hospital by boat, journalists covering the disaster ran into fewer barriers relating to HIPAA than they usually encounter.Attitudes toward privacy rulesmay change in times of disaster Jane Hansen spent four months after 150 patients at Tulane Hospital, two hospi- problems she feared.Hurricane Katrina delving into how two tals located across the street from each other “I think because it was such an extraor-hospitals in New Orleans coped in the tense in downtown New Orleans. dinary tale, the issue of confidentiality justhours and days following the storm. “The only time I ran into confidentiality didn’t come up,” she said. “The notion of In the end, she wrote 22 stories for The was when I was mucking around trying to confidentiality seemed silly . . . given theAtlanta Journal-Constitution that ran in May verify who died,” she said. But with per- life and death situation they were all upand June under the title, “Through Hell and sistence, she was able to confirm what she against.”High Water.” needed, she said. In part, her experience may be due to The stories were accompanied by pic- Hansen wanted to meet one of the sur- two bulletins the Department of Health andtures taken by hospital staff during events vivors from Charity who had been taken Human Services issued in the days followingand given freely to the newspaper. on a truck through the water, had his col- Katrina, and which department officials say The only people who brought up the lapsed lung re-inflated in the middle of the are applicable in future disasters.Health Insurance Portability and Account- street, and was carried to the rooftop of According to the bulletin, health careability Act throughout the disaster were in Tulane’s hospital before being flown away providers can share information to locate aher newsroom. by helicopter. patient’s friends or family. When possible, “I kept waiting because my husband is When she tracked him down, she went verbal permission should be obtained froma doctor and he runs into HIPAA all of the to see him in his hospital bed, along with a the patient, but the bulletin says it is nottime,” Hansen said. “I don’t think anyone photographer. necessary.ever uttered the word HIPAA except at my “I had so much information on him from “Thus, when necessary, the hospital mayend — the editor’s end.” the doctors who were treating him, and they notify the police, the press, or the public at Hansen’s series told the stories of about didn’t hesitate to talk about him,” she said. large to the extent necessary to help locate,a dozen people who worked to save 347 Hansen was surprised — pleasantly — identify or otherwise notify family memberspatients at Charity Hospital and more than that she did not face the HIPAA-related and others,” the bulletin read.Page 8 The Reporters Committee for Freedom of the Press Winter 2007
  9. 9. Top secret What kind of information has been withheld under the Health Insurance Portability and Account- ability Act? • Chris Halsne, an investigative reporter for KIRO-TV in Seattle, reported that Seattle hospitals were failing to notify the police when patients in police custody were dis- charged. On at least one occasion, hospital officials warned a murder suspect that detectives were on the way, allowing the suspect to escape, Halsne reported. For the story, he obtained a copy of a hospital’s internal memo that said, “we cannot and should not be calling” law enforcement “to pick up arrested patients without their authorization.” “They stand on HIPAA falsely and are releasing some pretty dangerous people,” he said. • In Georgia, a local sheriff’s department cited HIPAA when reporters for The Atlanta Journal- AP/THE DAILY TOWN TALK PHOTO BY TIA OWENS-POWERS Constitution asked whether deputiesThe Department of Health and Human had received a medical clearance forServices issued bulletins during the firing range.Hurricane Katrina that said HIPAA The record “shows nothing what-did not prevent the release of certain soever about medical information,information to locate patients’ families.Hospital officials say that may be part it just said they were cleared,” saidof the reason that medical officials were David Milliron, the newspaper’s com-more forthcoming with information puter-assisted reporting editor.during the storm and its aftermath. • In a St. Paul (Minn.) Pioneer Press AP PHOTO BY DAVID J. PHILLIP story on the Minnesota Vikings foot- ball team in May, Coach Brad Chil- In addition, the bulletin said health care For example, the association says after an dress cited HIPAA as a reason for notproviders can share information with any- explosion, a hospital might want to disclose releasing the players’ weights. uone to prevent or lessen a threat to the pa- general information, including the numbertient or the public’s health and safety. Health of patients being treated there due to thecare providers can also provide directories event.of patients, the bulletin reminded. In cases where a hospital is trying to Alicia Mitchell, a spokeswoman for the identify a patient, the association says it isAmerican Hospital Association, said fol- not clear what information the hospital canlowing Katrina, the hospitals were more release under HIPAA. A hospital might wantflexible. to release general characteristics such as “Patient records didn’t follow patients. gender, height and weight, but would not beIt was a time of disaster, and hospitals did able to release a photo without the patient’swhat they thought was right to help the permission. But the association recommendspatient and shared information appropri- that a hospital use its professional judgmentately,” she said. in the best interest of the patient. The guidelines put out by the govern- Mitchell also pointed to another disasterment also helped, she said. “HIPAA is not resource — a patient locator Web site thesupposed to get in the way of the flow of Greater New York Hospital Associationinformation that is helpful for the public maintained in the days following Sept. 11.good in times of disasters,” she said. The public could enter names and receive AP PHOTO BY TOM OLMSCHEID The hospital association advises its basic information about the people if they Vikings coach Brad Childressmembers to work with the media during were patients. Such a Web site should bedisasters. HIPAA-compliant, she said. uWinter 2007 A Reporter’s Guide to Medical Privacy Law Page 9
  10. 10. Confusing laws keep informationconfidential on college campuses A college football game illustrates thestrange interpretations of HIPAA. Thestar quarterback is sacked during a playand 50,000 spectators and a national TVaudience see his leg snap. But the coach willnot talk about the player’s injury because hethinks HIPAA prevents him. In reporting on universities — whetherthe topic is football or campus crime — jour-nalists are finding the Health Insurance Por-tability and Accountability Act an obstacleto gaining records and information. One of the HIPAA challenges unique touniversity coverage is that certain studentrecords have long been considered confi-dential under a different federal law, theFamily Educational Rights and Privacy Act,known as FERPA or the Buckley Amend-ment. This can lead to confusion on everyone’spart about which law applies and why,particularly because one department mightwithhold information under FERPA, whileanother can cite HIPAA in holding the sameinformation confidential. For example, health records kept by thestudent health center are student recordscovered under FERPA. If those records are AP PHOTO BY ALEX BRANDONdisclosed to an athletic coach, FERPA con- Since HIPAA went into effect, some colleges have said the law prevents themtrols what the coach can discuss publicly. from releasing information about college athletes’ injuries. In 2005, a spokesman However, the same student health in- for Louisiana State University refused to tell a newspaper about the knee injury offormation at a university hospital might be running back Alley Broussard (above).controlled by HIPAA but not FERPA, saidJerry Woods, an attorney with Kilpatrick themselves up under HIPAA. to comply with the same regulations as theStockton in Georgia and former counsel for Universities can make their entire orga- health care component.the Medical College of Georgia. nizations subject to HIPAA, or they can be If an athletic department is not consid- “A lot of universities are very concerned “hybrid entities” with HIPAA-compliant ered part of the health care component, itsbecause they’re dealing with two different health care components and non-health employees are not subject to HIPAA — evenlaws and they’re trying to administer these components that are free from the regula- when they get information from a healthlaws,” Woods said. tion. care provider who is covered, Woods said. Even when FERPA does not apply, two For instance, the University of Kentucky HIPAA does not control the coach onceschools can be subject to very different rules has defined its athletic training facility and that information has been disclosed, in theabout the release of information because employees as part of the non-health care same way it does not control a journalistagencies have flexibility in the way they set unit of the university, so it does not have who has the information. But the coachesPage 10 The Reporters Committee for Freedom of the Press Winter 2007
  11. 11. AP/THE DAILY TEXAN PHOTO BY MARK MULLIGAN Rudy Vasquez of the Austin Police Department readies samples of a powdery substance found at a University of Texas dorm. During the February 2006 scare, school officials refused to release some information, citing HIPAA. tors. “If we did release information to the AP/THE DAILY TEXAN PHOTO BY MARK MULLIGAN media and the athlete complained about it,When a substance initially appearing to be the poison ricin was found at the we can always fall back on that document,”University of Texas in Austin last year, the university told the student newspaper Webster said.not to print the names of the students involved because of medical privacy laws. At the University of Texas in Austin,The Daily Texan managed to get the names from other sources. a university official told reporters for the student newspaper The Daily Texan not tomight think it does. is because the patient or player refused to print the names of students who were pos- “They believe in good faith they can’t authorize the release,” Webster said. sible victims in a ricin poison scare becausedisclose the information, and they may get When someone invokes HIPAA, he of HIPAA.legal advice to that effect,” Woods said. wants to know the precise reason. “What are The reporters already had the names But in the other scenario — if a university you really saying? Are you hiding behind it, from other sources, said Richard Finnell,made no distinction between the athletic or did the athlete refuse to release that infor- the newspaper’s adviser, and they were abledepartment and other health care services mation, or is it a policy?” Webster said. to go to another university official to resolvefor HIPAA purposes — a coach may be the HIPAA conflict — a practice that hasprohibited by HIPAA rules from disclosing Finding other ways become popular as many reporters seekcertain information about players. Mark Goodman, executive director of alternative sources after running into dead the Student Press Law Center, said the cen- ends with university officials.‘Our hands are tied’ ter would advise reporters to always argue “We tell our reporters to kind of deal With those complicated rules, it is not that HIPAA does not apply to information with it — smile at them and say, ‘yeah,’surprising that HIPAA can be as confusing about an athlete’s injury. and then do what you have to do,” Finnellfor college officials as it is for journalists. “But in all honesty, we would recognize said. u A 2003 Associated Press story reported that interpretation of the law is suspect,”that officials at some schools, such as Kansas he said.State University, thought HIPAA applied to Goodman is not particularly anxious to Sources and Citationsthem, but other universities did not. push the issue in court for fear it might lead For example, an August 2005 article in to bad precedent — especially since many 90 Md. Op. Att’y Gen. 45 (2005).The (Baton Rouge) Advocate reported that reporters “are finding other ways to get the Abbott v. Texas Dep’t of Mental HealthLouisiana State University sports informa- information,” Goodman said. and Retardation, No. 03-04-00743-CV,tion director Michael Bonnette would not Journalists, for instance, can inquire if 2006 WL 2504417 (Tex. App.-Austin,discuss a football player’s knee injury. universities have obtained permission from Aug. 30, 2006) “He’s got a knee injury, and that’s all students through release forms, which many Hill v. E. Baton Rouge Parish Dep’t ofwe’re saying,” he told the newspaper. “Due universities require of student athletes Emergency Med. Servs., 925 So. 2d 17to these new medical laws, our hands are as a condition of participating in college (La. App. 1 Cir. 2005).tied.” sports. Miss. Op. Att’y Gen. No. 2005-0595. To Keith Webster, the head athletic While a university will require the stu- Neb. Op. Att’y Gen. No. 04018trainer at the University of Kentucky and dent to allow the information to be released (2004).former chairman of the government com- to coaches, schools will sometimes refuse to State ex rel. Cincinnati Enquirer v.mittee for the National Athletic Trainers release that information to the media if the Daniels, 108 Ohio St. 3d 518 (2006).Association, these types of responses are student wishes, Webster said. Univ. of Colorado Hospital Authority v.frustrating. But if college officials do end up speaking Denver Publishing Co., 340 F Supp. “I hate the term ‘I can’t release it because to reporters, waivers such as those used at 2d 1142 (D. Co., 2004).of HIPAA.’ The reason you can’t release it Kentucky can protect school administra-Winter 2007 A Reporter’s Guide to Medical Privacy Law Page 11
  12. 12. The Reporters Committee for Freedom of the Press is commit- law help, there’s the Open Government Guide, a complete guideted to helping journalists understand the laws that affect newsgath- to each state’s open records and meetings acts. Also, Access toering. And we have a wide array of publications that can help. Electronic Records tracks developments in the states regarding We’ve got special reports like Homefront Confidential, an computerized release of data.examination of access and information policy issues in a post- And of course, there’s the First Amendment Handbook, aSeptember 11 world. guide to almost every aspect of media law with practical advice for Our Reporter’s Privilege Compendium offers a detailed look overcoming barriers encountered every day by journalists.at each state’s shield laws and court decisions that affect the ability For these and many more publications, visit our Web site.of reporters to keep their sources and information confidential. Read these guides online — for no charge — or purchase a copy For help with gaining access to government records and meet- to read in print.ings, we’ve got How to Use the Federal FOI Act. Or for state Visit our online First Amendment newsstand at: www.rcfp.org/publications