New medical privacy rules resulting from HIPAA may hamper the media’s ability to report vital information and could result in potential fines and jail time, driving health officials to restrict previously routine patient disclosures.
“The new regulations really don’t serve the public’s best interest,” said Joe Atkins, an associate professor of journalism at the University of Mississippi who teaches a media ethics course. “With public institutions, like public hospitals, the public has a right to know how patients are treated, such as the kind and quality of treatment,” he said. “Some areas can be seen as an invasion of privacy and there’s sometimes a tendency to get overzealous, but by and large, journalists are trying to get information to the public that helps assure an informed citizenry.”
After the Health Insurance Portability and Accountability Act (HIPAA) of 1996 went into effect Aug. 21, 1996, Congress had three years to develop privacy standards. When that didn’t happen, the task went to the Secretary of Health and Human Services (HHS). Its proposed rules were published Dec. 20, 2000. The new regulations go into full effect April 14, 2003.
“The rules don’t regulate what the press can and cannot report, but they do regulate what medical providers can say,” said a spokesperson for HHS, who asked not to be identified. “During the next two years, we will try to help the medical community understand the regulations and get policies in place.”
Stacy Baldwin, assistant director for compliance at the University of Mississippi Medical Center, said some scenarios, such as natural disasters, would allow medical facilities to provide general information without violating the new privacy standard, but identifying details could not be revealed to the media.
Sam W. Cameron, president and CEO of the Mississippi Hospital Association, said that according to the final rule, a hospital can only permit disclosure to clergy of a patient’s name, room number, general condition and religious affiliation.
“The policy can also allow disclosure of the same information, except religious affiliation, to anyone who asks for the patient by name,” he said. “If a person asks for a patient’s location in the hospital, but not about the patient’s condition, the patient’s condition should not be disclosed because the location information would be the ‘minimum necessary.’”
Another sticking point: if a patient requests exclusion of information in the hospital directory, the hospital must comply.
“This, of course, will affect what hospitals can and cannot release to the media,” Cameron said. “A patient can choose if he or she wishes to have his admittance to the hospital, location in the hospital, or general condition released. The hospital must then make sure the patient’s wishes are followed.”
Richard D. Marks, partner of Davis Wright Tremaine LLP in Washington, D.C., HIPAA task force member and author of the white paper on HIPAA Certification for the Strategic National Implementation Process of the Workgroup for Electronic Data Interchange, said that “as a matter of prudence and complying with HIPAA regulations, HIPAA hospitals will greatly restrict the amount given out, and public information will have to come from public health authorities.”
A coalition of 46 news organizations recently took a stand against HIPAA because of its stringent rules restricting the release of medical records to the public. The press groups, calling HIPAA an “official secrets act for health care,” object to HIPAA-mandated penalties that call for up to 10 years in prison and a $250,000 fine for obtaining or disclosing health information under certain extreme circumstances.
“The public’s best interests were just not considered,” said Diana Kramer, executive director of the Washington Newspaper Publishers Association, a member of the coalition that asked HHS Secretary Tommy Thompson to revise the regulations.
Robert Lystad of Baker & Hostetler, the law firm contracted by the Society of Professional Journalists, wrote in a letter to Thompson, “Imagine, if you will, a leak of hazardous substances from a chemical plant into a water supply. Suppose a few individuals fall sick due to this leak. Under the department’s regulations, no one – not the media, not area citizens, not even some government officials – would be privy to an afflicted person’s illness and the cause of that illness unless a patient consented to release of his or her medical information. The result could well be a spread of a highly dangerous disease to dozens, perhaps hundred or thousands, of other citizens, all in the name of patient privacy.”
Wyatt Emmerich, president of Emmerich Newspapers, said, “With all the government regulations, it’s so complex that newspapers are going to end up violating them, no matter what they do. It’s too vague, and it’s going to end up hampering newspaper’s ability to report the news. How do you define what’s part of someone’s medical file? It’s going to be the source of a lot of confusion and a lot of litigation. It’s needless governmental interference.”
Trial lawyers are already looking at the new privacy rules for HIPAA as the next litigation bonanza.
“Any reporter who is thinking about a story that draws support from surreptitiously obtained medical records, any editor and publisher faced with the opportunities and obligations that a story like this carries and any lawyer called upon to give pre-publication advice, faces risks far graver than before. The uncertainties are enormous,” said Marks.
Cases such as Bartnicki v. Vopper leave open the question of whether the state could punish a newspaper that illegally acquired information from both the unlawful acquisition and the ensuing publication. In Bartnicki v. Vopper, the U.S. Supreme Court ruled May 21 that the First Amendment protected a radio commentator’s broadcast of an illegally intercepted cellular telephone call.
When legislators were crafting HIPAA in 1995, they concentrated on parts of the act dealing with insurance portability and health care fraud and abuse. There was no discussion about whether HIPAA’s prohibitions on disclosure of health records might trespass on First Amendment rights that Congress should attempt to balance against the reasons for privacy protection, Marks said.
“Put another way, there are no legislative findings on the questions surrounding the value of press scrutiny of potential wrongdoing or ineptitude in the health care industry, or the need to reconcile the potential adverse effect of press reports on the privacy rights of some patients,” Marks said.
Under the new privacy standards, good faith whistleblowers are protected if they have credible evidence and turn it over to authorized public health authorities, appropriate health care accreditation organizations or an attorney for the purpose of determining legal options. No such protection exists for any other entities, including the media.
Enforcement of HIPAA regulations rests with Department of Health and Human Services Office of Civil Rights in Washington, D.C.
“The one-year, $50,000 penalty is the garden-variety routine – what we might think of as a negligent mistake by a doctor or nurse or administrator,” Marks said. “It’s a penalty which in the wrong circumstances could result in somebody’s being on the wrong end of a criminal indictment when they didn’t think they did anything wrong. The 10 years, $250,000 malice penalties (are) for selling a movie star’s medical records to the tabloids (or) false pretenses involving somebody coming into a facility and doing some social engineering (such as) impersonating a doctor o
r a nurs
e – those should be serious penalties.”
The mere threat of such harsh punishment would make investigative reporting on health care nearly impossible, Kramer said.
“Newspapers are just not going to get the informatio