HIPAA Tips & FAQ (thanks to Therese Bottomly)

A new federal law called Health Insurance Portability and Accountability Act (HIPAA) is making life hard for anyone, except close family members who must call hospitals, doctors, nurses, paramedics or other health workers to get information about patients. The law limits the information that any health worker who electronically transmits information (basically all health workers) can give about patients.

The law is very long and complicated. Here is a summary:

  • You must know the patient’s name to get any information. Hospitals, etc., will generally give you a patient’s one-word condition (good, fair, serious, critical, dead) if you tell them the person’s name. If they tell you the condition they also should tell you where they are in the hospital (the OR, ICU, recovery, etc.) but usually won’t unless you ask them.
  • If you have the name wrong, or no name, you’ll get nothing. Health folks are very scared because HIPAA violations carry big penalties (fines up to $50,000 and criminal charges). So they don’t say, “Oh, it’s Melanie Johns, not Melanie Johnson.” They also no longer give information based on descriptions, such as “the 60-year-old man who had his leg ripped off by pit bulls in Downtown Portland.” You need the name.
  • So try to get and double-check the patient’s name before calling the hospital. Cops, state and county officials, witnesses, etc. may know the name. If it’s a wreck, and you get the license plate, you can check the owner’s name against DMV records. This sounds obvious, but also get a spelling and as much other identifying information as possible (age, home town, etc.). That lets you check the name against public records and see if it’s correct and gives you other information to track down a wrong name. My last cops shift, for instance, a Portland Police PIO told me a driver’s name was Lindsey K. Delashmotl, 18, of Southwest Portland. No such name in DMV. So I searched for all Lindsey D-s in Portland, and found an 18-year-old named Lindsey DeLashmutt, the correct spelling.
  • Even with a name, you may get nothing. The law lets patients “opt out,” in which case the health provider is supposed to say nothing, including whether the person is even there or not.
  • The flip side is that patients can release as much information as they want. They also can sign forms giving doctors, nurses, PIOs, etc., permission to discuss them and their care. At your request, hospital PR people usually will ask patients to talk to the media and sign a release, though that takes time. If the PR people won’t ask, point out that it is their job to ask and that they can’t refuse for the patient — only the patient can agree to give or withhold information.
  • Obviously patients can’t always opt in or out. They may be unconscious, in shock or otherwise not up for discussing federal privacy law. If a patient has said nothing, hospitals generally interpret it to mean they have not “opted out,” and will give condition info. if you have their name. But they may still claim they can give nothing.  This situation offers two hopes. A doctor can release information if she or he decides it is in their patient’s best interest. You can try getting to the doctor and arguing that, since we’re going to be writing about the person anyway, it is certainly in their best interest to have their friends, family, coworkers and neighbors know they are not dead but just in serious but stable condition (or whatever).
  • Also, a patient can choose a representative to speak for them for HIPAA purposes. Representatives sometimes make care decisions for patients, too – such as parents for children, spouses of people in comas, etc. If a patient isn’t in a condition to talk, those people can make HIPAA decisions for them.
  • Hospitals generally won’t tell you if a patient has been treated and released. All they’ll say now is that a person is “no longer in this facility,” or something similar, leaving you to connect the dots. Also, they don’t keep information on where they’ve been released to (home, a nursing home, morgue, etc.).
  • If you get the run-around from hospital PR people, or think they are misinterpreting the law, you can ask to speak to the privacy officer. Every hospital has one. They are the higher HIPAA authority.

Leave a Reply

Your email address will not be published. Required fields are marked *