A Reporter’s Guide to Medical Law

ince stringent medical privacy regulations went into effect in S2003, the media have been forced to learn the new rules, work around them in some cases, and in others battle them in court. Yet the Health Portability and Accountability Act’s privacy rule remains a prickly issue for reporters, hampering routine reporting assign- ments and big investigative pieces. Journalists have challenged the pri- vacy rule in court in a handful of cases and at least twice have won rulings re- quiring the release of information under state public records laws. continued inside

AP PHOTOS CINCINNATI ENQUIRER PHOTO BY GLENN HARTONG The Ohio Supreme Court ruled in March that The Cincinnati Enquirer was entitled to lead notices that the local health department had withheld under HIPAA. Using that information, the Enquirer ran a series detailing the city’s lead problem and its effect on children such as Marquise Taylor (above), a five-year-old with elevated levels of lead in his body.

When Congress passed HIPAA in 1996, so some are completely HIPAA-compliant, “The general news people — I feel the law required the Department of Health while others can compartmentalize so that terrible for them,” said Chris Halsne, an and Human Services to enact federal health only parts of the organization are obligated investigative reporter for KIRO-TV in Se- privacy regulations, known as the Standards to comply with the act. attle. “It’s terribly frustrating for them when for Privacy of Individually Identifiable For instance, HIPAA may apply to coun- they know that the information is legally Health Information, or the privacy rule. ty ambulance services that bill electronically, available, it’s just not going to be — based Media organizations objected that the but may not apply in other counties without on . . . who knows what?” proposed rule overly restricted access to electronic billing. And where HIPAA may Halsne’s biggest HIPAA-related problem information. Still, the law went into effect prevent the release of health information in came when he was working on a November in 2003. one state, another state’s public records laws 2005 story examining the frequency and Initially, HIPAA caused immense con- could make the same information public. rationale behind prescribing narcotics to fusion. Many entities that assumed they “There’s been tremendous confusion,” state prisoners. were covered by the law were not, and said Robert Gellman, a privacy consultant The numbers — what the prison bought most feared the harsh criminal penalties — who worked for the House Committee on and how much it cost — were a financial including jail time — associated with violat- Government Operations when HIPAA was matter and clearly public, he said. ing the law. drafted. “It’s been dying down, but it’s still Halsne got the numbers but also wanted Because of the language of the act, which going on. There was an initial panic and a log book of medications disbursed in the was mainly concerned with controlling the there was a lot of initial misunderstanding prisons that includes the prisoner name, electronic transfer of health information, and it takes a long time to beat that out of identification number, reason for the medi- agencies that perform similar functions the system.” cation, the prescription, the date, and the may be subject to different standards under Journalists say agencies are withholding amount of drugs. HIPAA. records that were never intended to be cov- “They do that mostly not for medical Each agency can set itself up differently ered under HIPAA because they are unsure reasons, but for accounting purposes be- about the law — or use it as an excuse. cause they don’t want to be missing a bunch This guide was compiled by Reporters Commit- Initially, some refused to turn over of pills,” he said. tee legal intern Hannah Bergman and was made documents such as accident reports and He requested the log book with the names possible by a grant from the Robert R. McCormick some would not give journalists even basic and identification numbers redacted. Tribune Foundation. information about accidents. “Even then, when there was no identi-

Page 2 The Reporters Committee for Freedom of the Press Winter 2007 fying information, their first fallback was whether notices issued to property owners still be public because “the Ohio Public HIPAA,” he said. of residences where children had tested Records Law . . . requires disclosure of these at high levels for lead in their blood were reports, and federal law, HIPAA, does not HIPAA and state laws public. supersede state disclosure requirements,” Halsne was able to report the story with- In covering a housing court, reporter Justice Terrence O’Donnell wrote for the out the records but said the data would have Sharon Coolidge had noticed only build- unanimous court. made it “more complete.” ing department cases on the docket and not The court wrestled with how to read the “If I cared enough and we would have cases brought by the health department. federal and state laws. fought this one on prison drugs, we would It quickly became clear that HIPAA was “We are confronted here with a prob- have won,” he said. “They just didn’t want the reason no health department cases were lem of circular reference because the Ohio to give it to us.” being docketed. When Coolidge learned the Public Records Act requires disclosure of But some journalists have successfully missing cases might involve a lead issue, she information unless prohibited by federal battled agencies in court. knew there was a story, somewhere, about law, while federal law allows disclosure of The battles primarily involve disputes the city’s lead problem. protected health information if required by over the privacy rule’s “required by law” When she initially requested the lead state law,” O’Donnell wrote. provision. That provision allows HIPAA- notices, the health department refused, cit- The court concluded that neither Con- covered entities to disclose “protected ing the reference in the notices to children’s gress nor the Department of Health and health information” to the extent that such blood test results. Human Services intended to preempt state use or disclosure is required by law. “It’s pretty scary to go the lawsuit route disclosure laws. The court also noted that in Though the decisions are not binding because what if they said no?” Coolidge said. the guidance issued along with the privacy outside of the courts’ jurisdictions, they may “Then I would be setting precedent.” rule, HHS said when a conflict arose be- be influential for other courts considering Initially the newspaper lost, as she feared. tween the federal Freedom of Information the issue and signal the courts’ skepticism When the state Supreme Court agreed Act and HIPAA, FOIA was an example of a of attempts to restrict access to information to hear the case, Coolidge said she was disclosure “required by law.” that was public before HIPAA. surprised. In June, the paper ran a three-story series In March, Ohio’s highest court ruled The court ruled that the notices did not based on the records, detailing the plight of in favor of The Cincinnati Enquirer, which contain “protected health information” families whose children have been harmed fought the local health department over and that even if they did, the notices would by lead.

What is HIPAA? that governs public release of information another part of the university, such as an and can prove so frustrating for reporters athletics department or nursing school, HIPAA history inquiring about a patient’s condition — was that did not comply with HIPAA. Congress passed the Health Insur- to give patients more control of the release “Affiliated covered entities” are legally ance Portability and Accountability Act of their medical information. Thus, the rule separate entities that have a common in August 1996. The law provided that frequently requires written consent forms. ownership. For example, a university if Congress failed to pass health privacy hospital and a university medical founda- legislation in three years, the Department Affected parties tion could have a common owner but be of Health and Human Services would HIPAA applies to health care organiza- legally separate entities. In that case, both issue rules under the authority given to tions, including providers, health plans, entities must comply with HIPAA. it in HIPAA. public health authorities, life insurers, billing Congress did not pass another privacy agencies, service organizations, ambulance Penalties bill and in October 1999, Health and services and medical universities. If the orga- For unintentionally violating the Human Services released a draft rule, nization electronically bills for health care or privacy rule, civil penalties of $100 per called the Standards for Privacy of Indi- transmits health information, HIPAA applies violation can be assessed up to a $25,000 vidually Identifiable Health Information regardless of the organization’s size. annual maximum fine. and known as the “privacy rule.” After The privacy rule allows a HIPAA-covered For intentional violations and misuse receiving tens of thousands of comments organization that has another function in ad- of individually identifiable health infor- on the draft, the department issued a final dition to providing health care to designate mation, criminal penalties can lead to a rule in December 2000 with modifications itself as a “hybrid entity.” The entity defines fine up to $250,000 and imprisonment following in August 2002. what its “health care component” is and for up to 10 years. Comments from the media — including makes sure that component complies with A safe harbor provision exists for The Reporters Committee for Freedom HIPAA. A “wall” is set up between the health inadvertent disclosures made by covered of the Press, the Newspaper Association care component of the organization and the entities that exercise reasonable diligence of America, the National Newspaper As- non-health care component. Information in attempting to comply with the law. sociation, and the American Society of is not shared internally by the two sides, An investigation in June by The Wash- Newspaper Editors — argued that the and the non-health care component is not ington Post found that no one has ever been proposed rule too harshly restricted access bound by HIPAA. If the organization does fined for violating HIPAA. However, the to information. not designate itself as a hybrid, the entire Post reported that the Justice Department Despite media concerns, health care operation must comply with HIPAA. has prosecuted two criminal cases, one organizations were required to comply For example, a university may designate against a Seattle man who stole credit with the privacy rule beginning in April itself a hybrid entity. Its hospital and medi- card information from a cancer patient 2003. According to its authors, the goal cal school may be designated as compliant, and another against a Texas woman who of the privacy rule — the part of HIPAA but they would not share information with sold an FBI agent’s medical records. u

Winter 2007 A Reporter’s Guide to Medical Page 3 John Greiner, the Enquirer’s attorney, said he thinks the decision will help the pa- per access other documents, such as police incident reports, that are frequently with- held citing HIPAA despite efforts to educate the police that HIPAA does not apply to those sorts of materials. “I think [it helps] in the sense that a court said it’s OK to turn this stuff over,” Greiner said. The decision is also likely to solidify pre- HIPAA court rulings that 911 call records are public, he said, because of the way the court read the state freedom of information law in conjunction with HIPAA. A Texas appeals court looked to the Ohio decision, as well as the government guide- lines, in a recent case involving a Dallas television station that sought statistics about alleged sexual assaults at state psychiatric hospitals. In June, the court said the information sought did not seem to qualify as protected information under HIPAA. But even if the information is protected, the court wrote, the agency must determine whether there is an exception to the privacy rule that allows the release. If the request is made under the Texas Public Information Act, it falls under the “required by law” exception. Other courts have sidestepped the issue. In Louisiana, Gannett River States Publish- ing, which owns several newspapers in the area, sued the East Baton Rouge Parish emergency medical services department AP PHOTO BY PABLO MARTINEZ MONSIVAIS after officials refused to release 911 tapes, citing HIPAA. The Washington, D.C., Fire Department, shown here responding to a mercury spill in 2005, stopped allowing media ride-alongs after the Department of Health But the appeals court did not address and Human Services received complaints about a newspaper report containing the applicability of HIPAA, opting instead patient information. to declare the calls confidential under state law in December 2005. Many media outlets fear hospitals and Working around HIPAA other health care providers will be able to Since health care agencies continue to Potential for punishment retaliate against them in civil actions if they stonewall reporters, media organizations Much of local agencies’ reluctance to re- publish protected health information. have tried to find solutions to get records lease health and medical information comes But in 2004, a federal judge in Denver without resorting to lawsuits. from the potential penalties they face under held that a private party cannot sue under When it comes to breaking news stories, the federal regulations. HIPAA. Halsne, the Seattle TV reporter, says the “Everybody has had the same problem of The University of Colorado Hospital station now sends producers down hospital no one knows what HIPAA says really well,” sued the publisher of the Rocky Mountain halls, trying to find information without said Gellman, the privacy advocate. “In the (Denver) News to prevent the newspaper asking the public relations staff. absence of a firm, clear lawyer standing next from printing an internal report, arguing Reporters also have cultivated additional to you saying you won’t go to jail, people that publishing the information would be sources, such as security guards in the base- just say no.” a violation of HIPAA. The court neither ment, who they rely on to confirm basic But an investigation by The Washington granted the injunction nor allowed the information. Post published in June found that after hospital to continue its case against the In Atlanta, reporters have frequently met three years and almost 20,000 complaints newspaper. with hospital staff in an attempt to resolve is- to Health and Human Services, no one has U.S. District Judge Walker Miller wrote sues before they arise in breaking news, said ever been fined for violating HIPAA and there was no evidence Congress intended Tom Clyde, an attorney who represents The only two criminal cases have been brought for a private party to be able to enforce Atlanta Journal-Constitution and WSP-TV. against alleged violators. Neither involved HIPAA, particularly through the privacy “There’s no question it’s been helpful,” releasing information to the media. rule. Though the federal judge’s ruling is Clyde said. “It has improved things, espe- The department told the Post it prefers to not binding elsewhere, the judge’s decision cially in the emergency situation.” work with institutions for voluntary compli- has been cited by other courts throughout But Clyde says the turnover at hospitals ance instead of enforcing the law strictly. the country. and government agencies can be high, which

Page 4 The Reporters Committee for Freedom of the Press Winter 2007 means a lot of time is spent retraining staff tion that wouldn’t allow you to create any D.C., Fire Department. and getting people comfortable with estab- statistics below the three-digit ZIP code The information came not from emer- lished practices. level,” Milliron said. Across Georgia, that gency personnel but from the patients For example, David Milliron, the com- means there would only be a handful of themselves, said Alan Etter, a spokesman puter-assisted reporting editor at the Jour- geographic groups the newspaper could for the department. nal-Constitution, said he has had difficulty analyze. “A reporter walked up to the patient in securing vital statistics from Georgia this “It’s very disconcerting to the newspaper a public area, and this person as an adult — year, including birth, death and marriage when the newspaper has spent great expense — obstinately aware of the ramifications — records — something the newspaper has legal and time wise — working out an agree- gave the reporter his name,” Etter said. done for at least nine years. ment,” he said. But Health and Human Services did not The newspaper uses the data to do stories Even some agencies have complained care, and the fire department has stopped on topics such as marriage and divorce rates that overzealous enforcement of HIPAA media ride-alongs on ambulances because and teen pregnancy, and to publish interest- prevents them from publicizing positive of the federal government’s concerns, Et- ing feature pieces, such as statistics about the work and hurts the public’s right to know. ter said. babies who were born on Sept. 11, 2001. The Department of Health and Human “It makes it difficult for a PR guy like Recently, with new employees working Services received complaints after the Wash- me to show his fire department in action,” for the state, there are new problems, Mil- ington City Paper published stories with iden- he said. “This is a publicly funded service — liron said. tifying information about patients obtained people who pay taxes in the city ought to be “They want to apply some de-identifica- during a ride-along with the Washington, able to see.” u

What records are available by some state hospital associations and the 911 dispatchers and paramedics provide under HIPAA? federal government, can detail the number health care, the attorney general said, of procedures performed, death rates and medical information in these records is Hospital directory information other information, but no names can be confidential under state law. However, the According to the Department of attached to the data. Generally, it is avail- attorney general said the state law does Health and Human Services, hospital able from the National Center for Health not protect the identity of the person who directory information containing basic Statistics (www.cdc.gov/nchs). called 911 or the identity of the person facts about current or recent patients transported. treated by a hospital should be released. Death, autopsy and coroner The same year, the Mississippi attor- This includes patients’ names, locations records ney general reached a similar conclusion. within the hospital, general conditions State laws vary widely on the availability Analyzing whether a county emergency (including whether a patient has been of death, autopsy and coroner records. Even medical service record could be released treated and released or has died), reli- before medical privacy rules, the availability under HIPAA, the attorney general gious affiliations and room telephone of these records was being curtailed. How- opinion concluded the act’s “required by numbers. The American Hospital As- ever, the Department of Health and Human law” exception would allow the release sociation (AHA) advises its members that Services says that if state law “provides for of information that was public under the information about the location a patient the reporting of disease or injury, child state’s public records law. was released to and the date and time of abuse, birth, or death, or for public health death should not be disclosed. , investigation, or intervention,” Ambulance ride-alongs The department’s guidelines require HIPAA does not prevent it. In at least one case, the Department of that patients be informed about the in- A 2004 Nebraska attorney general opin- Health and Human Services has cracked formation in the directory and be allowed ion found that cause of death was protected down on reporters riding along on medi- the chance to object to disclosure. In an health information under the act. However, cal emergency calls. emergency, if the patient has not had a the opinion also determined the information Washington, D.C.’s fire and EMS unit chance to consent, the hospital may still should be released because Nebraska’s open received a letter from the department release the information if it deems the records law mandated it. after a reader complained when the Wash- release is in the patient’s best interest. ington City Paper ran a story with patient The AHA also advises its members Ambulance and Emergency information the reporter obtained from that directory information can only be Medical Services records the patient. released if a reporter identifies the pa- Often medical information in these re- As a result of the letter, the city no lon- tient by name and that the room number cords will be protected under state laws, but ger allows media ride-alongs on medical of a patient should never be disclosed to other information in the records, such as the calls, though it will allow limited access the media without patient permission time it took an ambulance to reach a scene, to fire calls. as a matter of policy. The association’s can be released. Whether ambulance service In June 2004, Health and Human practices may be more restrictive than is covered by HIPAA generally depends on if Services sent a letter to the American the law requires, but journalists should the ambulance service bills the patient. Ambulance Association that addresses know what hospitals are being told. In a 2005 opinion, the Maryland attor- questions about ride-alongs. The letter ney general, in deciding whether dispatch concludes that without patient authori- Hospital billing data records known as “event reports” from the zation, disclosure of health information Statistical information related to Baltimore County Fire Department could to the media during a ride-along is not hospital billing data is not covered by be released, wrote that HIPAA does not allowed. It is unclear how authorization HIPAA, which means hospitals can apply because the fire department does not would be obtained in many emergency release it. This information, collected bill electronically for its services. Because situations. u

Winter 2007 A Reporter’s Guide to Medical Privacy Law Page 5 AP PHOTO BY PABLO MARTINEZ MONSIVAIS The media were allowed into a Washington, D.C., hospital last year to shoot the recovery of two conjoined twins, but in many other cases, reporters have found it difficult or impossible to obtain access to hospitals for stories. Health care journalists’ access to hospitals curtailed under HIPAA For health care journalists, the Health “In their attempt to sent did not relieve them of their HIPAA Insurance Portability and Accountability Act control, they really damage responsibilities. has changed the way they do their jobs and Shelton said that is not true. “Clearly, if made telling the stories of patients and those the relationship and they the patient signs a HIPAA form allowing who provide their care more difficult. damage journalism.” me to be there, there’s no reason I can’t be Reporters say they devote more time there,” she said. than ever before negotiating for access for — St. Louis Post-Dispatch She was not able to persuade the hospital health-related articles, often to no avail. reporter Deborah Shelton to give her more access and never wrote “From stories our members tell us, some the story. Shelton said she doubts HIPAA hospitals use HIPAA as a convenient way to was the problem. Instead, she believes that obstruct reporters. Journalists are spending patient that wants to talk with a reporter, hospital officials were citing the law because more time arguing over inaccurate interpre- there may be one in the same hallway that they were concerned she would see some- tations of the law with hospital media rela- doesn’t,” Mitchell said. That, in most cases, thing they did not want her to, such as the tions specialists,” said Carla K. Johnson, a is what the hospital staff is worried about potentially awkward moments that occur board member of the Association of Health when dealing with the media and access, when a medical student is just learning how Care Journalists. she said. to work with patients. On the other side of the issue is the Deborah Shelton, who covers health care Such problems have increased in the past American Hospital Association. Alicia issues for the St. Louis Post-Dispatch, said year, she said. Mitchell, a spokeswoman for the AHA, says rather than negotiate for insufficient access “It’s not because there’s a lack of clar- most of the time hospitals will work to make to health care institutions, she has simply ity,” Shelton said. “It’s because HIPAA is sure important health care stories get told not reported some stories. an excuse.” despite HIPAA. For example, at St. Louis University Shelton also pointed to another experi- “If somebody is coming to profile the Hospital, medical students set up a clinic ence she had writing about a neonatal unit pediatrics unit, then the hospital would need to provide health care to uninsured people. at St. Louis Children’s Hospital. She had to work kind of hard to do that. And HIPAA, When the public affairs office pitched a three meetings with hospital staff to work quite frankly makes it harder than it was in story to Shelton about a fundraising auction out logistics, a tactic many people recom- the past,” Mitchell said. for the clinic, she suggested a story profiling mend, to head off HIPAA problems before Hospitals are constantly concerned about the clinic. they arise. But it did not work. patient privacy, she said, pointing out that She wanted to spend a day there, walking One important procedure for Shelton people in hospitals are ill, there to recuper- around and talking with the students and was that she, rather then the hospital staff, ate, and not always prepared to deal with patients. With a patient’s consent, she also approach each family and ask their per- reporters. wanted to be in the exam room to see how mission to be in the story. At a meeting, “Some patients would be happy to talk the students interacted with the patient. hospital staff agreed to this condition, she with reporters but even when there’s a But the hospital told her the patient’s con- said, and everything went well on the first

Page 6 The Reporters Committee for Freedom of the Press Winter 2007 “If I were the attorney for the media, the last thing in the world I’d want is a contract for that,” she said. Rush said when it comes to entering hos- pitals, there is little a reporter can do. “Hospitals are a problem area because there’s not really a legal access right,” she said. The information and access reporters enjoyed before HIPAA was more a matter of

AP PHOTO BY PHELAN M. EBENHACK tradition than a right, she pointed out. Reporters have to be more creative in Often, officials say HIPAA requires them to enact strict barriers to getting information now, Rush said. For ex- enter hospitals — even for the most ample, if a reporter is being escorted around innocuous stories. Media attorneys say the hospital by public affairs staff and not it is difficult for journalists to assert a allowed to talk to patients, the reporter can legal right to access hospitals. write down patient names, room numbers, and other information they observe and staff to express how upset she was with the follow up later. way things turned out. “There’s nothing to stop a reporter from Mitchell said the hospital association approaching a patient,” Rush said. “They advises its members that they should be the just can’t do it at the hospital.” ones asking for patient permission, just as She also said reporters can have patients AP PHOTO BY TOM GANNAM the association advises members to always willing to share their own medical records Restrictions at the St. Louis Children’s escort a reporter inside of a hospital. request them and then share the copies Hospital have hampered some local “The responsibility is on the hospital and with the reporters. That is more access then journalists’ reporting. One reporter said she will turn to more acommodating it’s because the hospital is the entity with reporters had before HIPAA, when patients hospitals for feature stories in the responsibility of protecting the patient’s had trouble getting their own records, Rush future. privacy rights,” Mitchell said. “When the said. reporters are on campus, they’re supposed Shelton has her own way of dealing with day — until 5 p.m. to be accompanied by members of the media uncooperative hospitals. Now, she says, if “All of a sudden, one nurse decides she team, really in order to protect the patient’s she wants to do a story similar to her profile wasn’t comfortable with it,” Shelton said. privacy, which is paramount.” of the neonatal unit, she will turn to another The ground rules she had worked out Tonda Rush, a media attorney and hospital, one that will want the attention and seemed to fly out the window, she said. The director of public policy for the National will be more flexible. next day, the hospital’s public relations staff Newspaper Association, said it is not neces- Shelton emphasizes she has a choice of took over asking families to be in the story. sarily advisable to commit to any contract or where she reports these types of enterprise Not another family agreed. agreement to writing. To make the agree- stories, which hospitals don’t seem to rec- “Everything I got, the story we ended ment legally binding, the reporter would ognize. up running, came from everything I got the have to also make promises to the hospital, “In their attempt to control, they really first day,” she said. which would provide little flexibility for damage the relationship and they damage Afterward, she had several meetings with the reporter. journalism,” she said. u

General access to hospitals to a patient if the hospital thinks it would Directory information when a The American Hospital Association interfere with the patient’s care. patient has opted out has guidelines for its members on how Patients can elect to not have their to respond to media requests generally. Inside of the hospital information included in the hospital Journalists need to know what hospitals Hospital staff should always accompany directory, or have their information are being told but should note that the reporters when they are inside the hospi- listed but not available to the press. If the association’s guidelines may be more tal. The staff can deny access to any area patient does not want information given restrictive than the law requires. The they believe patients have an expectation to the press, the hospital should ask the guidelines include: of privacy, including the emergency room, relationship to the patient of anyone who intensive care units and nurseries. is calling for a condition report. Access to patients’ rooms If a patient has opted out of the di- Hospitals should not give out a pa- Photographs and interviews rectory, the hospital should not respond tient’s room number without the patient’s Both photographs and interviews require with that information because it would permission. written consent of the patient. Background disclose the patient’s presence. The AHA photos taken in public spaces are not ad- recommends saying, “Federal medical Direct contact with patients dressed directly by HIPAA, but in general privacy regulations allow the hospital to Hospitals should not allow reporters to the hospital cannot release identifiable pho- release to the media only information in contact patients directly. A representative tos without patient permission. Hospital the hospital’s directory” and “the hospital of the patient should handle media calls. staff, rather then reporters, should approach does not have any information about the The hospital should deny media access people for permission. person in its directory.” u

Winter 2007 A Reporter’s Guide to Medical Privacy Law Page 7 AP PHOTO BY BILL HABER During , when floodwaters in New Orleans caused emergency officials to take away patients of Charity Hospital by boat, journalists covering the disaster ran into fewer barriers relating to HIPAA than they usually encounter. Attitudes toward privacy rules may change in times of disaster

Jane Hansen spent four months after 150 patients at Tulane Hospital, two hospi- problems she feared. Hurricane Katrina delving into how two tals located across the street from each other “I think because it was such an extraor- hospitals in New Orleans coped in the tense in downtown New Orleans. dinary tale, the issue of just hours and days following the storm. “The only time I ran into confidentiality didn’t come up,” she said. “The notion of In the end, she wrote 22 stories for The was when I was mucking around trying to confidentiality seemed silly . . . given the Atlanta Journal-Constitution that ran in May verify who died,” she said. But with per- life and death situation they were all up and June under the title, “Through Hell and sistence, she was able to confirm what she against.” High Water.” needed, she said. In part, her experience may be due to The stories were accompanied by pic- Hansen wanted to meet one of the sur- two bulletins the Department of Health and tures taken by hospital staff during events vivors from Charity who had been taken Human Services issued in the days following and given freely to the newspaper. on a truck through the water, had his col- Katrina, and which department officials say The only people who brought up the lapsed lung re-inflated in the middle of the are applicable in future disasters. Portability and Account- street, and was carried to the rooftop of According to the bulletin, health care ability Act throughout the disaster were in Tulane’s hospital before being flown away providers can share information to locate a her newsroom. by helicopter. patient’s friends or family. When possible, “I kept waiting because my husband is When she tracked him down, she went verbal permission should be obtained from a doctor and he runs into HIPAA all of the to see him in his hospital bed, along with a the patient, but the bulletin says it is not time,” Hansen said. “I don’t think anyone photographer. necessary. ever uttered the word HIPAA except at my “I had so much information on him from “Thus, when necessary, the hospital may end — the editor’s end.” the doctors who were treating him, and they notify the police, the press, or the public at Hansen’s series told the stories of about didn’t hesitate to talk about him,” she said. large to the extent necessary to help locate, a dozen people who worked to save 347 Hansen was surprised — pleasantly — identify or otherwise notify family members patients at Charity Hospital and more than that she did not face the HIPAA-related and others,” the bulletin read.

Page 8 The Reporters Committee for Freedom of the Press Winter 2007 Top secret What kind of information has been withheld under the Health Insurance Portability and Account- ability Act?

• Chris Halsne, an investigative reporter for KIRO-TV in Seattle, reported that Seattle hospitals were failing to notify the police when patients in police custody were dis- charged. On at least one occasion, hospital officials warned a murder suspect that detectives were on the way, allowing the suspect to escape, Halsne reported. For the story, he obtained a copy of a hospital’s internal memo that said, “we cannot and should not be calling” law enforcement “to pick up arrested patients without their authorization.” “They stand on HIPAA falsely and are releasing some pretty dangerous people,” he said.

• In Georgia, a local sheriff’s department cited HIPAA when reporters for The Atlanta Journal- AP/THE DAILY TOWN TALK PHOTO BY TIA OWENS-POWERS Constitution asked whether deputies The Department of Health and Human had received a medical clearance for Services issued bulletins during the firing range. Hurricane Katrina that said HIPAA The record “shows nothing what- did not prevent the release of certain information to locate patients’ families. soever about medical information, Hospital officials say that may be part it just said they were cleared,” said of the reason that medical officials were David Milliron, the newspaper’s com- more forthcoming with information puter-assisted reporting editor. during the storm and its aftermath. • In a St. Paul (Minn.) Pioneer Press AP PHOTO BY DAVID J. PHILLIP story on the Minnesota Vikings foot- ball team in May, Coach Brad Chil- In addition, the bulletin said health care For example, the association says after an dress cited HIPAA as a reason for not providers can share information with any- explosion, a hospital might want to disclose releasing the players’ weights. u one to prevent or lessen a threat to the pa- general information, including the number tient or the public’s health and safety. Health of patients being treated there due to the care providers can also provide directories event. of patients, the bulletin reminded. In cases where a hospital is trying to Alicia Mitchell, a spokeswoman for the identify a patient, the association says it is American Hospital Association, said fol- not clear what information the hospital can lowing Katrina, the hospitals were more release under HIPAA. A hospital might want flexible. to release general characteristics such as “Patient records didn’t follow patients. gender, height and weight, but would not be It was a time of disaster, and hospitals did able to release a photo without the patient’s what they thought was right to help the permission. But the association recommends patient and shared information appropri- that a hospital use its professional judgment ately,” she said. in the best interest of the patient. The guidelines put out by the govern- Mitchell also pointed to another disaster ment also helped, she said. “HIPAA is not resource — a patient locator Web site the supposed to get in the way of the flow of Greater New York Hospital Association information that is helpful for the public maintained in the days following Sept. 11. good in times of disasters,” she said. The public could enter names and receive AP PHOTO BY TOM OLMSCHEID The hospital association advises its basic information about the people if they Vikings coach Brad Childress members to work with the media during were patients. Such a Web site should be disasters. HIPAA-compliant, she said. u

Winter 2007 A Reporter’s Guide to Medical Privacy Law Page 9 Confusing laws keep information confidential on college campuses A college football game illustrates the strange interpretations of HIPAA. The star quarterback is sacked during a play and 50,000 spectators and a national TV audience see his leg snap. But the coach will not talk about the player’s injury because he thinks HIPAA prevents him. In reporting on universities — whether the topic is football or campus crime — jour- nalists are finding the Health Insurance Por- tability and Accountability Act an obstacle to gaining records and information. One of the HIPAA challenges unique to university coverage is that certain student records have long been considered confi- dential under a different federal law, the Family Educational Rights and , known as FERPA or the Buckley Amend- ment. This can lead to confusion on everyone’s part about which law applies and why, particularly because one department might withhold information under FERPA, while another can cite HIPAA in holding the same information confidential. For example, health records kept by the student health center are student records covered under FERPA. If those records are AP PHOTO BY ALEX BRANDON disclosed to an athletic coach, FERPA con- Since HIPAA went into effect, some colleges have said the law prevents them trols what the coach can discuss publicly. from releasing information about college athletes’ injuries. In 2005, a spokesman However, the same student health in- for Louisiana State University refused to tell a newspaper about the knee injury of formation at a university hospital might be running back Alley Broussard (above). controlled by HIPAA but not FERPA, said Jerry Woods, an attorney with Kilpatrick themselves up under HIPAA. to comply with the same regulations as the Stockton in Georgia and former counsel for Universities can make their entire orga- health care component. the Medical College of Georgia. nizations subject to HIPAA, or they can be If an athletic department is not consid- “A lot of universities are very concerned “hybrid entities” with HIPAA-compliant ered part of the health care component, its because they’re dealing with two different health care components and non-health employees are not subject to HIPAA — even laws and they’re trying to administer these components that are free from the regula- when they get information from a health laws,” Woods said. tion. care provider who is covered, Woods said. Even when FERPA does not apply, two For instance, the University of Kentucky HIPAA does not control the coach once schools can be subject to very different rules has defined its athletic training facility and that information has been disclosed, in the about the release of information because employees as part of the non-health care same way it does not control a journalist agencies have flexibility in the way they set unit of the university, so it does not have who has the information. But the coaches

Page 10 The Reporters Committee for Freedom of the Press Winter 2007 AP/THE DAILY TEXAN PHOTO BY MARK MULLIGAN Rudy Vasquez of the Austin Police Department readies samples of a powdery substance found at a University of Texas dorm. During the February 2006 scare, school officials refused to release some information, citing HIPAA.

tors. “If we did release information to the AP/THE DAILY TEXAN PHOTO BY MARK MULLIGAN media and the athlete complained about it, When a substance initially appearing to be the poison ricin was found at the we can always fall back on that document,” University of Texas in Austin last year, the university told the student newspaper Webster said. not to print the names of the students involved because of medical privacy laws. At the University of Texas in Austin, The Daily Texan managed to get the names from other sources. a university official told reporters for the student newspaper The Daily Texan not to might think it does. is because the patient or player refused to print the names of students who were pos- “They believe in good faith they can’t authorize the release,” Webster said. sible victims in a ricin poison scare because disclose the information, and they may get When someone invokes HIPAA, he of HIPAA. legal advice to that effect,” Woods said. wants to know the precise reason. “What are The reporters already had the names But in the other scenario — if a university you really saying? Are you hiding behind it, from other sources, said Richard Finnell, made no distinction between the athletic or did the athlete refuse to release that infor- the newspaper’s adviser, and they were able department and other health care services mation, or is it a policy?” Webster said. to go to another university official to resolve for HIPAA purposes — a coach may be the HIPAA conflict — a practice that has prohibited by HIPAA rules from disclosing Finding other ways become popular as many reporters seek certain information about players. Mark Goodman, executive director of alternative sources after running into dead the Student Press Law Center, said the cen- ends with university officials. ‘Our hands are tied’ ter would advise reporters to always argue “We tell our reporters to kind of deal With those complicated rules, it is not that HIPAA does not apply to information with it — smile at them and say, ‘yeah,’ surprising that HIPAA can be as confusing about an athlete’s injury. and then do what you have to do,” Finnell for college officials as it is for journalists. “But in all honesty, we would recognize said. u A 2003 Associated Press story reported that interpretation of the law is suspect,” that officials at some schools, such as Kansas he said. State University, thought HIPAA applied to Goodman is not particularly anxious to Sources and Citations them, but other universities did not. push the issue in court for fear it might lead For example, an August 2005 article in to bad precedent — especially since many 90 Md. Op. Att’y Gen. 45 (2005). The (Baton Rouge) Advocate reported that reporters “are finding other ways to get the Abbott v. Texas Dep’t of Mental Health Louisiana State University sports informa- information,” Goodman said. and Retardation, No. 03-04-00743-CV, tion director Michael Bonnette would not Journalists, for instance, can inquire if 2006 WL 2504417 (Tex. App.-Austin, discuss a football player’s knee injury. universities have obtained permission from Aug. 30, 2006) “He’s got a knee injury, and that’s all students through release forms, which many Hill v. E. Baton Rouge Parish Dep’t of we’re saying,” he told the newspaper. “Due universities require of student athletes Emergency Med. Servs., 925 So. 2d 17 to these new medical laws, our hands are as a condition of participating in college (La. App. 1 Cir. 2005). tied.” sports. Miss. Op. Att’y Gen. No. 2005-0595. To Keith Webster, the head athletic While a university will require the stu- Neb. Op. Att’y Gen. No. 04018 trainer at the University of Kentucky and dent to allow the information to be released (2004). former chairman of the government com- to coaches, schools will sometimes refuse to State ex rel. Cincinnati Enquirer v. mittee for the National Athletic Trainers release that information to the media if the Daniels, 108 Ohio St. 3d 518 (2006). Association, these types of responses are student wishes, Webster said. Univ. of Colorado Hospital Authority v. frustrating. But if college officials do end up speaking Denver Publishing Co., 340 F Supp. “I hate the term ‘I can’t release it because to reporters, waivers such as those used at 2d 1142 (D. Co., 2004). of HIPAA.’ The reason you can’t release it Kentucky can protect school administra-

Winter 2007 A Reporter’s Guide to Medical Privacy Law Page 11 The Reporters Committee for Freedom of the Press is commit- law help, there’s the Open Government Guide, a complete guide ted to helping journalists understand the laws that affect newsgath- to each state’s open records and meetings acts. Also, Access to ering. And we have a wide array of publications that can help. Electronic Records tracks developments in the states regarding We’ve got special reports like Homefront Confidential, an computerized release of data. examination of access and information policy issues in a post- And of course, there’s the First Amendment Handbook, a September 11 world. guide to almost every aspect of media law with practical advice for Our Reporter’s Privilege Compendium offers a detailed look overcoming barriers encountered every day by journalists. at each state’s shield laws and court decisions that affect the ability For these and many more publications, visit our Web site. of reporters to keep their sources and information confidential. Read these guides online — for no charge — or purchase a copy For help with gaining access to government records and meet- to read in print. ings, we’ve got How to Use the Federal FOI Act. Or for state Visit our online First Amendment newsstand at: www.rcfp.org/publications