1. A Reporter’s Guide to
Medical Privacy Law
S
ince stringent medical privacy
regulations went into effect in
2003, the media have been forced
to learn the new rules, work around
them in some cases, and in others battle
them in court.
Yet the Health Insurance Portability
and Accountability Act’s privacy rule
remains a prickly issue for reporters,
hampering routine reporting assign-
ments and big investigative pieces.
Journalists have challenged the pri-
vacy rule in court in a handful of cases
and at least twice have won rulings re-
quiring the release of information under
state public records laws.
continued inside
AP PHOTOS

2. CINCINNATI ENQUIRER PHOTO BY GLENN HARTONG
The Ohio Supreme Court ruled in March that The Cincinnati Enquirer was entitled to lead notices that the local health
department had withheld under HIPAA. Using that information, the Enquirer ran a series detailing the city’s lead problem
and its effect on children such as Marquise Taylor (above), a five-year-old with elevated levels of lead in his body.
When Congress passed HIPAA in 1996, so some are completely HIPAA-compliant, “The general news people — I feel
the law required the Department of Health while others can compartmentalize so that terrible for them,” said Chris Halsne, an
and Human Services to enact federal health only parts of the organization are obligated investigative reporter for KIRO-TV in Se-
privacy regulations, known as the Standards to comply with the act. attle. “It’s terribly frustrating for them when
for Privacy of Individually Identifiable For instance, HIPAA may apply to coun- they know that the information is legally
Health Information, or the privacy rule. ty ambulance services that bill electronically, available, it’s just not going to be — based
Media organizations objected that the but may not apply in other counties without on . . . who knows what?”
proposed rule overly restricted access to electronic billing. And where HIPAA may Halsne’s biggest HIPAA-related problem
information. Still, the law went into effect prevent the release of health information in came when he was working on a November
in 2003. one state, another state’s public records laws 2005 story examining the frequency and
Initially, HIPAA caused immense con- could make the same information public. rationale behind prescribing narcotics to
fusion. Many entities that assumed they “There’s been tremendous confusion,” state prisoners.
were covered by the law were not, and said Robert Gellman, a privacy consultant The numbers — what the prison bought
most feared the harsh criminal penalties — who worked for the House Committee on and how much it cost — were a financial
including jail time — associated with violat- Government Operations when HIPAA was matter and clearly public, he said.
ing the law. drafted. “It’s been dying down, but it’s still Halsne got the numbers but also wanted
Because of the language of the act, which going on. There was an initial panic and a log book of medications disbursed in the
was mainly concerned with controlling the there was a lot of initial misunderstanding prisons that includes the prisoner name,
electronic transfer of health information, and it takes a long time to beat that out of identification number, reason for the medi-
agencies that perform similar functions the system.” cation, the prescription, the date, and the
may be subject to different standards under Journalists say agencies are withholding amount of drugs.
HIPAA. records that were never intended to be cov- “They do that mostly not for medical
Each agency can set itself up differently ered under HIPAA because they are unsure reasons, but for accounting purposes be-
about the law — or use it as an excuse. cause they don’t want to be missing a bunch
This guide was compiled by Reporters Commit- Initially, some refused to turn over of pills,” he said.
tee legal intern Hannah Bergman and was made documents such as accident reports and He requested the log book with the names
possible by a grant from the Robert R. McCormick some would not give journalists even basic and identification numbers redacted.
Tribune Foundation. information about accidents. “Even then, when there was no identi-
Page 2
The Reporters Committee for Freedom of the Press Winter 2007

3. fying information, their first fallback was whether notices issued to property owners still be public because “the Ohio Public
HIPAA,” he said. of residences where children had tested Records Law . . . requires disclosure of these
at high levels for lead in their blood were reports, and federal law, HIPAA, does not
HIPAA and state laws public. supersede state disclosure requirements,”
Halsne was able to report the story with- In covering a housing court, reporter Justice Terrence O’Donnell wrote for the
out the records but said the data would have Sharon Coolidge had noticed only build- unanimous court.
made it “more complete.” ing department cases on the docket and not The court wrestled with how to read the
“If I cared enough and we would have cases brought by the health department. federal and state laws.
fought this one on prison drugs, we would It quickly became clear that HIPAA was “We are confronted here with a prob-
have won,” he said. “They just didn’t want the reason no health department cases were lem of circular reference because the Ohio
to give it to us.” being docketed. When Coolidge learned the Public Records Act requires disclosure of
But some journalists have successfully missing cases might involve a lead issue, she information unless prohibited by federal
battled agencies in court. knew there was a story, somewhere, about law, while federal law allows disclosure of
The battles primarily involve disputes the city’s lead problem. protected health information if required by
over the privacy rule’s “required by law” When she initially requested the lead state law,” O’Donnell wrote.
provision. That provision allows HIPAA- notices, the health department refused, cit- The court concluded that neither Con-
covered entities to disclose “protected ing the reference in the notices to children’s gress nor the Department of Health and
health information” to the extent that such blood test results. Human Services intended to preempt state
use or disclosure is required by law. “It’s pretty scary to go the lawsuit route disclosure laws. The court also noted that in
Though the decisions are not binding because what if they said no?” Coolidge said. the guidance issued along with the privacy
outside of the courts’ jurisdictions, they may “Then I would be setting precedent.” rule, HHS said when a conflict arose be-
be influential for other courts considering Initially the newspaper lost, as she feared. tween the federal Freedom of Information
the issue and signal the courts’ skepticism When the state Supreme Court agreed Act and HIPAA, FOIA was an example of a
of attempts to restrict access to information to hear the case, Coolidge said she was disclosure “required by law.”
that was public before HIPAA. surprised. In June, the paper ran a three-story series
In March, Ohio’s highest court ruled The court ruled that the notices did not based on the records, detailing the plight of
in favor of The Cincinnati Enquirer, which contain “protected health information” families whose children have been harmed
fought the local health department over and that even if they did, the notices would by lead.
What is HIPAA? that governs public release of information another part of the university, such as an
and can prove so frustrating for reporters athletics department or nursing school,
HIPAA history inquiring about a patient’s condition — was that did not comply with HIPAA.
Congress passed the Health Insur- to give patients more control of the release “Affiliated covered entities” are legally
ance Portability and Accountability Act of their medical information. Thus, the rule separate entities that have a common
in August 1996. The law provided that frequently requires written consent forms. ownership. For example, a university
if Congress failed to pass health privacy hospital and a university medical founda-
legislation in three years, the Department Affected parties tion could have a common owner but be
of Health and Human Services would HIPAA applies to health care organiza- legally separate entities. In that case, both
issue rules under the authority given to tions, including providers, health plans, entities must comply with HIPAA.
it in HIPAA. public health authorities, life insurers, billing
Congress did not pass another privacy agencies, service organizations, ambulance Penalties
bill and in October 1999, Health and services and medical universities. If the orga- For unintentionally violating the
Human Services released a draft rule, nization electronically bills for health care or privacy rule, civil penalties of $100 per
called the Standards for Privacy of Indi- transmits health information, HIPAA applies violation can be assessed up to a $25,000
vidually Identifiable Health Information regardless of the organization’s size. annual maximum fine.
and known as the “privacy rule.” After The privacy rule allows a HIPAA-covered For intentional violations and misuse
receiving tens of thousands of comments organization that has another function in ad- of individually identifiable health infor-
on the draft, the department issued a final dition to providing health care to designate mation, criminal penalties can lead to a
rule in December 2000 with modifications itself as a “hybrid entity.” The entity defines fine up to $250,000 and imprisonment
following in August 2002. what its “health care component” is and for up to 10 years.
Comments from the media — including makes sure that component complies with A safe harbor provision exists for
The Reporters Committee for Freedom HIPAA. A “wall” is set up between the health inadvertent disclosures made by covered
of the Press, the Newspaper Association care component of the organization and the entities that exercise reasonable diligence
of America, the National Newspaper As- non-health care component. Information in attempting to comply with the law.
sociation, and the American Society of is not shared internally by the two sides, An investigation in June by The Wash-
Newspaper Editors — argued that the and the non-health care component is not ington Post found that no one has ever been
proposed rule too harshly restricted access bound by HIPAA. If the organization does fined for violating HIPAA. However, the
to information. not designate itself as a hybrid, the entire Post reported that the Justice Department
Despite media concerns, health care operation must comply with HIPAA. has prosecuted two criminal cases, one
organizations were required to comply For example, a university may designate against a Seattle man who stole credit
with the privacy rule beginning in April itself a hybrid entity. Its hospital and medi- card information from a cancer patient
2003. According to its authors, the goal cal school may be designated as compliant, and another against a Texas woman who
of the privacy rule — the part of HIPAA but they would not share information with sold an FBI agent’s medical records. u
Winter 2007 A Reporter’s Guide to Medical Privacy Law Page 3

4. John Greiner, the Enquirer’s attorney,
said he thinks the decision will help the pa-
per access other documents, such as police
incident reports, that are frequently with-
held citing HIPAA despite efforts to educate
the police that HIPAA does not apply to
those sorts of materials.
“I think [it helps] in the sense that a
court said it’s OK to turn this stuff over,”
Greiner said.
The decision is also likely to solidify pre-
HIPAA court rulings that 911 call records
are public, he said, because of the way the
court read the state freedom of information
law in conjunction with HIPAA.
A Texas appeals court looked to the Ohio
decision, as well as the government guide-
lines, in a recent case involving a Dallas
television station that sought statistics about
alleged sexual assaults at state psychiatric
hospitals.
In June, the court said the information
sought did not seem to qualify as protected
information under HIPAA.
But even if the information is protected,
the court wrote, the agency must determine
whether there is an exception to the privacy
rule that allows the release. If the request is
made under the Texas Public Information
Act, it falls under the “required by law”
exception.
Other courts have sidestepped the issue.
In Louisiana, Gannett River States Publish-
ing, which owns several newspapers in the
area, sued the East Baton Rouge Parish
emergency medical services department AP PHOTO BY PABLO MARTINEZ MONSIVAIS
after officials refused to release 911 tapes,
citing HIPAA. The Washington, D.C., Fire Department, shown here responding to a mercury
spill in 2005, stopped allowing media ride-alongs after the Department of Health
But the appeals court did not address and Human Services received complaints about a newspaper report containing
the applicability of HIPAA, opting instead patient information.
to declare the calls confidential under state
law in December 2005. Many media outlets fear hospitals and Working around HIPAA
other health care providers will be able to Since health care agencies continue to
Potential for punishment retaliate against them in civil actions if they stonewall reporters, media organizations
Much of local agencies’ reluctance to re- publish protected health information. have tried to find solutions to get records
lease health and medical information comes But in 2004, a federal judge in Denver without resorting to lawsuits.
from the potential penalties they face under held that a private party cannot sue under When it comes to breaking news stories,
the federal regulations. HIPAA. Halsne, the Seattle TV reporter, says the
“Everybody has had the same problem of The University of Colorado Hospital station now sends producers down hospital
no one knows what HIPAA says really well,” sued the publisher of the Rocky Mountain halls, trying to find information without
said Gellman, the privacy advocate. “In the (Denver) News to prevent the newspaper asking the public relations staff.
absence of a firm, clear lawyer standing next from printing an internal report, arguing Reporters also have cultivated additional
to you saying you won’t go to jail, people that publishing the information would be sources, such as security guards in the base-
just say no.” a violation of HIPAA. The court neither ment, who they rely on to confirm basic
But an investigation by The Washington granted the injunction nor allowed the information.
Post published in June found that after hospital to continue its case against the In Atlanta, reporters have frequently met
three years and almost 20,000 complaints newspaper. with hospital staff in an attempt to resolve is-
to Health and Human Services, no one has U.S. District Judge Walker Miller wrote sues before they arise in breaking news, said
ever been fined for violating HIPAA and there was no evidence Congress intended Tom Clyde, an attorney who represents The
only two criminal cases have been brought for a private party to be able to enforce Atlanta Journal-Constitution and WSP-TV.
against alleged violators. Neither involved HIPAA, particularly through the privacy “There’s no question it’s been helpful,”
releasing information to the media. rule. Though the federal judge’s ruling is Clyde said. “It has improved things, espe-
The department told the Post it prefers to not binding elsewhere, the judge’s decision cially in the emergency situation.”
work with institutions for voluntary compli- has been cited by other courts throughout But Clyde says the turnover at hospitals
ance instead of enforcing the law strictly. the country. and government agencies can be high, which
Page 4
The Reporters Committee for Freedom of the Press Winter 2007

5. means a lot of time is spent retraining staff tion that wouldn’t allow you to create any D.C., Fire Department.
and getting people comfortable with estab- statistics below the three-digit ZIP code The information came not from emer-
lished practices. level,” Milliron said. Across Georgia, that gency personnel but from the patients
For example, David Milliron, the com- means there would only be a handful of themselves, said Alan Etter, a spokesman
puter-assisted reporting editor at the Jour- geographic groups the newspaper could for the department.
nal-Constitution, said he has had difficulty analyze. “A reporter walked up to the patient in
securing vital statistics from Georgia this “It’s very disconcerting to the newspaper a public area, and this person as an adult —
year, including birth, death and marriage when the newspaper has spent great expense — obstinately aware of the ramifications —
records — something the newspaper has legal and time wise — working out an agree- gave the reporter his name,” Etter said.
done for at least nine years. ment,” he said. But Health and Human Services did not
The newspaper uses the data to do stories Even some agencies have complained care, and the fire department has stopped
on topics such as marriage and divorce rates that overzealous enforcement of HIPAA media ride-alongs on ambulances because
and teen pregnancy, and to publish interest- prevents them from publicizing positive of the federal government’s concerns, Et-
ing feature pieces, such as statistics about the work and hurts the public’s right to know. ter said.
babies who were born on Sept. 11, 2001. The Department of Health and Human “It makes it difficult for a PR guy like
Recently, with new employees working Services received complaints after the Wash- me to show his fire department in action,”
for the state, there are new problems, Mil- ington City Paper published stories with iden- he said. “This is a publicly funded service —
liron said. tifying information about patients obtained people who pay taxes in the city ought to be
“They want to apply some de-identifica- during a ride-along with the Washington, able to see.” u
What records are available by some state hospital associations and the 911 dispatchers and paramedics provide
under HIPAA? federal government, can detail the number health care, the attorney general said,
of procedures performed, death rates and medical information in these records is
Hospital directory information other information, but no names can be confidential under state law. However, the
According to the Department of attached to the data. Generally, it is avail- attorney general said the state law does
Health and Human Services, hospital able from the National Center for Health not protect the identity of the person who
directory information containing basic Statistics (www.cdc.gov/nchs). called 911 or the identity of the person
facts about current or recent patients transported.
treated by a hospital should be released. Death, autopsy and coroner The same year, the Mississippi attor-
This includes patients’ names, locations records ney general reached a similar conclusion.
within the hospital, general conditions State laws vary widely on the availability Analyzing whether a county emergency
(including whether a patient has been of death, autopsy and coroner records. Even medical service record could be released
treated and released or has died), reli- before medical privacy rules, the availability under HIPAA, the attorney general
gious affiliations and room telephone of these records was being curtailed. How- opinion concluded the act’s “required by
numbers. The American Hospital As- ever, the Department of Health and Human law” exception would allow the release
sociation (AHA) advises its members that Services says that if state law “provides for of information that was public under the
information about the location a patient the reporting of disease or injury, child state’s public records law.
was released to and the date and time of abuse, birth, or death, or for public health
death should not be disclosed. surveillance, investigation, or intervention,” Ambulance ride-alongs
The department’s guidelines require HIPAA does not prevent it. In at least one case, the Department of
that patients be informed about the in- A 2004 Nebraska attorney general opin- Health and Human Services has cracked
formation in the directory and be allowed ion found that cause of death was protected down on reporters riding along on medi-
the chance to object to disclosure. In an health information under the act. However, cal emergency calls.
emergency, if the patient has not had a the opinion also determined the information Washington, D.C.’s fire and EMS unit
chance to consent, the hospital may still should be released because Nebraska’s open received a letter from the department
release the information if it deems the records law mandated it. after a reader complained when the Wash-
release is in the patient’s best interest. ington City Paper ran a story with patient
The AHA also advises its members Ambulance and Emergency information the reporter obtained from
that directory information can only be Medical Services records the patient.
released if a reporter identifies the pa- Often medical information in these re- As a result of the letter, the city no lon-
tient by name and that the room number cords will be protected under state laws, but ger allows media ride-alongs on medical
of a patient should never be disclosed to other information in the records, such as the calls, though it will allow limited access
the media without patient permission time it took an ambulance to reach a scene, to fire calls.
as a matter of policy. The association’s can be released. Whether ambulance service In June 2004, Health and Human
practices may be more restrictive than is covered by HIPAA generally depends on if Services sent a letter to the American
the law requires, but journalists should the ambulance service bills the patient. Ambulance Association that addresses
know what hospitals are being told. In a 2005 opinion, the Maryland attor- questions about ride-alongs. The letter
ney general, in deciding whether dispatch concludes that without patient authori-
Hospital billing data records known as “event reports” from the zation, disclosure of health information
Statistical information related to Baltimore County Fire Department could to the media during a ride-along is not
hospital billing data is not covered by be released, wrote that HIPAA does not allowed. It is unclear how authorization
HIPAA, which means hospitals can apply because the fire department does not would be obtained in many emergency
release it. This information, collected bill electronically for its services. Because situations. u
Winter 2007 A Reporter’s Guide to Medical Privacy Law Page 5

6. AP PHOTO BY PABLO MARTINEZ MONSIVAIS
The media were allowed into a
Washington, D.C., hospital last
year to shoot the recovery of two
conjoined twins, but in many other
cases, reporters have found it
difficult or impossible to obtain
access to hospitals for stories.
Health care journalists’ access
to hospitals curtailed under HIPAA
For health care journalists, the Health “In their attempt to sent did not relieve them of their HIPAA
Insurance Portability and Accountability Act responsibilities.
has changed the way they do their jobs and
control, they really damage Shelton said that is not true. “Clearly, if
made telling the stories of patients and those the relationship and they the patient signs a HIPAA form allowing
who provide their care more difficult. damage journalism.” me to be there, there’s no reason I can’t be
Reporters say they devote more time there,” she said.
than ever before negotiating for access for — St. Louis Post-Dispatch She was not able to persuade the hospital
health-related articles, often to no avail. reporter Deborah Shelton to give her more access and never wrote
“From stories our members tell us, some the story. Shelton said she doubts HIPAA
hospitals use HIPAA as a convenient way to was the problem. Instead, she believes that
obstruct reporters. Journalists are spending patient that wants to talk with a reporter, hospital officials were citing the law because
more time arguing over inaccurate interpre- there may be one in the same hallway that they were concerned she would see some-
tations of the law with hospital media rela- doesn’t,” Mitchell said. That, in most cases, thing they did not want her to, such as the
tions specialists,” said Carla K. Johnson, a is what the hospital staff is worried about potentially awkward moments that occur
board member of the Association of Health when dealing with the media and access, when a medical student is just learning how
Care Journalists. she said. to work with patients.
On the other side of the issue is the Deborah Shelton, who covers health care Such problems have increased in the past
American Hospital Association. Alicia issues for the St. Louis Post-Dispatch, said year, she said.
Mitchell, a spokeswoman for the AHA, says rather than negotiate for insufficient access “It’s not because there’s a lack of clar-
most of the time hospitals will work to make to health care institutions, she has simply ity,” Shelton said. “It’s because HIPAA is
sure important health care stories get told not reported some stories. an excuse.”
despite HIPAA. For example, at St. Louis University Shelton also pointed to another experi-
“If somebody is coming to profile the Hospital, medical students set up a clinic ence she had writing about a neonatal unit
pediatrics unit, then the hospital would need to provide health care to uninsured people. at St. Louis Children’s Hospital. She had
to work kind of hard to do that. And HIPAA, When the public affairs office pitched a three meetings with hospital staff to work
quite frankly makes it harder than it was in story to Shelton about a fundraising auction out logistics, a tactic many people recom-
the past,” Mitchell said. for the clinic, she suggested a story profiling mend, to head off HIPAA problems before
Hospitals are constantly concerned about the clinic. they arise. But it did not work.
patient privacy, she said, pointing out that She wanted to spend a day there, walking One important procedure for Shelton
people in hospitals are ill, there to recuper- around and talking with the students and was that she, rather then the hospital staff,
ate, and not always prepared to deal with patients. With a patient’s consent, she also approach each family and ask their per-
reporters. wanted to be in the exam room to see how mission to be in the story. At a meeting,
“Some patients would be happy to talk the students interacted with the patient. hospital staff agreed to this condition, she
with reporters but even when there’s a But the hospital told her the patient’s con- said, and everything went well on the first
Page 6
The Reporters Committee for Freedom of the Press Winter 2007

7. “If I were the attorney for the media, the
last thing in the world I’d want is a contract
for that,” she said.
Rush said when it comes to entering hos-
pitals, there is little a reporter can do.
“Hospitals are a problem area because
there’s not really a legal access right,” she
said.
The information and access reporters
enjoyed before HIPAA was more a matter of
AP PHOTO BY PHELAN M. EBENHACK tradition than a right, she pointed out.
Reporters have to be more creative in
Often, officials say HIPAA requires
them to enact strict barriers to getting information now, Rush said. For ex-
enter hospitals — even for the most ample, if a reporter is being escorted around
innocuous stories. Media attorneys say the hospital by public affairs staff and not
it is difficult for journalists to assert a allowed to talk to patients, the reporter can
legal right to access hospitals. write down patient names, room numbers,
and other information they observe and
staff to express how upset she was with the follow up later.
way things turned out. “There’s nothing to stop a reporter from
Mitchell said the hospital association approaching a patient,” Rush said. “They
advises its members that they should be the just can’t do it at the hospital.”
AP PHOTO BY TOM GANNAM
ones asking for patient permission, just as She also said reporters can have patients
the association advises members to always willing to share their own medical records
Restrictions at the St. Louis Children’s escort a reporter inside of a hospital. request them and then share the copies
Hospital have hampered some local “The responsibility is on the hospital and with the reporters. That is more access then
journalists’ reporting. One reporter said
she will turn to more acommodating it’s because the hospital is the entity with reporters had before HIPAA, when patients
hospitals for feature stories in the responsibility of protecting the patient’s had trouble getting their own records, Rush
future. privacy rights,” Mitchell said. “When the said.
reporters are on campus, they’re supposed Shelton has her own way of dealing with
day — until 5 p.m. to be accompanied by members of the media uncooperative hospitals. Now, she says, if
“All of a sudden, one nurse decides she team, really in order to protect the patient’s she wants to do a story similar to her profile
wasn’t comfortable with it,” Shelton said. privacy, which is paramount.” of the neonatal unit, she will turn to another
The ground rules she had worked out Tonda Rush, a media attorney and hospital, one that will want the attention and
seemed to fly out the window, she said. The director of public policy for the National will be more flexible.
next day, the hospital’s public relations staff Newspaper Association, said it is not neces- Shelton emphasizes she has a choice of
took over asking families to be in the story. sarily advisable to commit to any contract or where she reports these types of enterprise
Not another family agreed. agreement to writing. To make the agree- stories, which hospitals don’t seem to rec-
“Everything I got, the story we ended ment legally binding, the reporter would ognize.
up running, came from everything I got the have to also make promises to the hospital, “In their attempt to control, they really
first day,” she said. which would provide little flexibility for damage the relationship and they damage
Afterward, she had several meetings with the reporter. journalism,” she said. u
General access to hospitals to a patient if the hospital thinks it would Directory information when a
The American Hospital Association interfere with the patient’s care. patient has opted out
has guidelines for its members on how Patients can elect to not have their
to respond to media requests generally. Inside of the hospital information included in the hospital
Journalists need to know what hospitals Hospital staff should always accompany directory, or have their information
are being told but should note that the reporters when they are inside the hospi- listed but not available to the press. If the
association’s guidelines may be more tal. The staff can deny access to any area patient does not want information given
restrictive than the law requires. The they believe patients have an expectation to the press, the hospital should ask the
guidelines include: of privacy, including the emergency room, relationship to the patient of anyone who
intensive care units and nurseries. is calling for a condition report.
Access to patients’ rooms If a patient has opted out of the di-
Hospitals should not give out a pa- Photographs and interviews rectory, the hospital should not respond
tient’s room number without the patient’s Both photographs and interviews require with that information because it would
permission. written consent of the patient. Background disclose the patient’s presence. The AHA
photos taken in public spaces are not ad- recommends saying, “Federal medical
Direct contact with patients dressed directly by HIPAA, but in general privacy regulations allow the hospital to
Hospitals should not allow reporters to the hospital cannot release identifiable pho- release to the media only information in
contact patients directly. A representative tos without patient permission. Hospital the hospital’s directory” and “the hospital
of the patient should handle media calls. staff, rather then reporters, should approach does not have any information about the
The hospital should deny media access people for permission. person in its directory.” u
Winter 2007 A Reporter’s Guide to Medical Privacy Law Page 7

8. AP PHOTO BY BILL HABER
During Hurricane Katrina, when
floodwaters in New Orleans caused
emergency officials to take away
patients of Charity Hospital by boat,
journalists covering the disaster ran
into fewer barriers relating to HIPAA
than they usually encounter.
Attitudes toward privacy rules
may change in times of disaster
Jane Hansen spent four months after 150 patients at Tulane Hospital, two hospi- problems she feared.
Hurricane Katrina delving into how two tals located across the street from each other “I think because it was such an extraor-
hospitals in New Orleans coped in the tense in downtown New Orleans. dinary tale, the issue of confidentiality just
hours and days following the storm. “The only time I ran into confidentiality didn’t come up,” she said. “The notion of
In the end, she wrote 22 stories for The was when I was mucking around trying to confidentiality seemed silly . . . given the
Atlanta Journal-Constitution that ran in May verify who died,” she said. But with per- life and death situation they were all up
and June under the title, “Through Hell and sistence, she was able to confirm what she against.”
High Water.” needed, she said. In part, her experience may be due to
The stories were accompanied by pic- Hansen wanted to meet one of the sur- two bulletins the Department of Health and
tures taken by hospital staff during events vivors from Charity who had been taken Human Services issued in the days following
and given freely to the newspaper. on a truck through the water, had his col- Katrina, and which department officials say
The only people who brought up the lapsed lung re-inflated in the middle of the are applicable in future disasters.
Health Insurance Portability and Account- street, and was carried to the rooftop of According to the bulletin, health care
ability Act throughout the disaster were in Tulane’s hospital before being flown away providers can share information to locate a
her newsroom. by helicopter. patient’s friends or family. When possible,
“I kept waiting because my husband is When she tracked him down, she went verbal permission should be obtained from
a doctor and he runs into HIPAA all of the to see him in his hospital bed, along with a the patient, but the bulletin says it is not
time,” Hansen said. “I don’t think anyone photographer. necessary.
ever uttered the word HIPAA except at my “I had so much information on him from “Thus, when necessary, the hospital may
end — the editor’s end.” the doctors who were treating him, and they notify the police, the press, or the public at
Hansen’s series told the stories of about didn’t hesitate to talk about him,” she said. large to the extent necessary to help locate,
a dozen people who worked to save 347 Hansen was surprised — pleasantly — identify or otherwise notify family members
patients at Charity Hospital and more than that she did not face the HIPAA-related and others,” the bulletin read.
Page 8
The Reporters Committee for Freedom of the Press Winter 2007

9. Top secret
What kind of information has
been withheld under the Health
Insurance Portability and Account-
ability Act?
• Chris Halsne, an investigative
reporter for KIRO-TV in Seattle,
reported that Seattle hospitals were
failing to notify the police when
patients in police custody were dis-
charged. On at least one occasion,
hospital officials warned a murder
suspect that detectives were on the
way, allowing the suspect to escape,
Halsne reported.
For the story, he obtained a copy
of a hospital’s internal memo that
said, “we cannot and should not be
calling” law enforcement “to pick
up arrested patients without their
authorization.”
“They stand on HIPAA falsely and
are releasing some pretty dangerous
people,” he said.
• In Georgia, a local sheriff’s
department cited HIPAA when
reporters for The Atlanta Journal-
AP/THE DAILY TOWN TALK PHOTO BY TIA OWENS-POWERS
Constitution asked whether deputies
The Department of Health and Human had received a medical clearance for
Services issued bulletins during the firing range.
Hurricane Katrina that said HIPAA The record “shows nothing what-
did not prevent the release of certain
soever about medical information,
information to locate patients’ families.
Hospital officials say that may be part it just said they were cleared,” said
of the reason that medical officials were David Milliron, the newspaper’s com-
more forthcoming with information puter-assisted reporting editor.
during the storm and its aftermath.
• In a St. Paul (Minn.) Pioneer Press
AP PHOTO BY DAVID J. PHILLIP
story on the Minnesota Vikings foot-
ball team in May, Coach Brad Chil-
In addition, the bulletin said health care For example, the association says after an dress cited HIPAA as a reason for not
providers can share information with any- explosion, a hospital might want to disclose releasing the players’ weights. u
one to prevent or lessen a threat to the pa- general information, including the number
tient or the public’s health and safety. Health of patients being treated there due to the
care providers can also provide directories event.
of patients, the bulletin reminded. In cases where a hospital is trying to
Alicia Mitchell, a spokeswoman for the identify a patient, the association says it is
American Hospital Association, said fol- not clear what information the hospital can
lowing Katrina, the hospitals were more release under HIPAA. A hospital might want
flexible. to release general characteristics such as
“Patient records didn’t follow patients. gender, height and weight, but would not be
It was a time of disaster, and hospitals did able to release a photo without the patient’s
what they thought was right to help the permission. But the association recommends
patient and shared information appropri- that a hospital use its professional judgment
ately,” she said. in the best interest of the patient.
The guidelines put out by the govern- Mitchell also pointed to another disaster
ment also helped, she said. “HIPAA is not resource — a patient locator Web site the
supposed to get in the way of the flow of Greater New York Hospital Association
information that is helpful for the public maintained in the days following Sept. 11.
good in times of disasters,” she said. The public could enter names and receive AP PHOTO BY TOM OLMSCHEID
The hospital association advises its basic information about the people if they Vikings coach Brad Childress
members to work with the media during were patients. Such a Web site should be
disasters. HIPAA-compliant, she said. u
Winter 2007 A Reporter’s Guide to Medical Privacy Law Page 9

10. Confusing laws keep information
confidential on college campuses
A college football game illustrates the
strange interpretations of HIPAA. The
star quarterback is sacked during a play
and 50,000 spectators and a national TV
audience see his leg snap. But the coach will
not talk about the player’s injury because he
thinks HIPAA prevents him.
In reporting on universities — whether
the topic is football or campus crime — jour-
nalists are finding the Health Insurance Por-
tability and Accountability Act an obstacle
to gaining records and information.
One of the HIPAA challenges unique to
university coverage is that certain student
records have long been considered confi-
dential under a different federal law, the
Family Educational Rights and Privacy Act,
known as FERPA or the Buckley Amend-
ment.
This can lead to confusion on everyone’s
part about which law applies and why,
particularly because one department might
withhold information under FERPA, while
another can cite HIPAA in holding the same
information confidential.
For example, health records kept by the
student health center are student records
covered under FERPA. If those records are AP PHOTO BY ALEX BRANDON
disclosed to an athletic coach, FERPA con- Since HIPAA went into effect, some colleges have said the law prevents them
trols what the coach can discuss publicly. from releasing information about college athletes’ injuries. In 2005, a spokesman
However, the same student health in- for Louisiana State University refused to tell a newspaper about the knee injury of
formation at a university hospital might be running back Alley Broussard (above).
controlled by HIPAA but not FERPA, said
Jerry Woods, an attorney with Kilpatrick themselves up under HIPAA. to comply with the same regulations as the
Stockton in Georgia and former counsel for Universities can make their entire orga- health care component.
the Medical College of Georgia. nizations subject to HIPAA, or they can be If an athletic department is not consid-
“A lot of universities are very concerned “hybrid entities” with HIPAA-compliant ered part of the health care component, its
because they’re dealing with two different health care components and non-health employees are not subject to HIPAA — even
laws and they’re trying to administer these components that are free from the regula- when they get information from a health
laws,” Woods said. tion. care provider who is covered, Woods said.
Even when FERPA does not apply, two For instance, the University of Kentucky HIPAA does not control the coach once
schools can be subject to very different rules has defined its athletic training facility and that information has been disclosed, in the
about the release of information because employees as part of the non-health care same way it does not control a journalist
agencies have flexibility in the way they set unit of the university, so it does not have who has the information. But the coaches
Page 10
The Reporters Committee for Freedom of the Press Winter 2007

11. AP/THE DAILY TEXAN PHOTO BY MARK MULLIGAN
Rudy Vasquez of the Austin Police
Department readies samples of
a powdery substance found at a
University of Texas dorm. During the
February 2006 scare, school officials
refused to release some information,
citing HIPAA.
tors.
“If we did release information to the
AP/THE DAILY TEXAN PHOTO BY MARK MULLIGAN
media and the athlete complained about it,
When a substance initially appearing to be the poison ricin was found at the we can always fall back on that document,”
University of Texas in Austin last year, the university told the student newspaper Webster said.
not to print the names of the students involved because of medical privacy laws. At the University of Texas in Austin,
The Daily Texan managed to get the names from other sources.
a university official told reporters for the
student newspaper The Daily Texan not to
might think it does. is because the patient or player refused to print the names of students who were pos-
“They believe in good faith they can’t authorize the release,” Webster said. sible victims in a ricin poison scare because
disclose the information, and they may get When someone invokes HIPAA, he of HIPAA.
legal advice to that effect,” Woods said. wants to know the precise reason. “What are The reporters already had the names
But in the other scenario — if a university you really saying? Are you hiding behind it, from other sources, said Richard Finnell,
made no distinction between the athletic or did the athlete refuse to release that infor- the newspaper’s adviser, and they were able
department and other health care services mation, or is it a policy?” Webster said. to go to another university official to resolve
for HIPAA purposes — a coach may be the HIPAA conflict — a practice that has
prohibited by HIPAA rules from disclosing Finding other ways become popular as many reporters seek
certain information about players. Mark Goodman, executive director of alternative sources after running into dead
the Student Press Law Center, said the cen- ends with university officials.
‘Our hands are tied’ ter would advise reporters to always argue “We tell our reporters to kind of deal
With those complicated rules, it is not that HIPAA does not apply to information with it — smile at them and say, ‘yeah,’
surprising that HIPAA can be as confusing about an athlete’s injury. and then do what you have to do,” Finnell
for college officials as it is for journalists. “But in all honesty, we would recognize said. u
A 2003 Associated Press story reported that interpretation of the law is suspect,”
that officials at some schools, such as Kansas he said.
State University, thought HIPAA applied to Goodman is not particularly anxious to Sources and Citations
them, but other universities did not. push the issue in court for fear it might lead
For example, an August 2005 article in to bad precedent — especially since many 90 Md. Op. Att’y Gen. 45 (2005).
The (Baton Rouge) Advocate reported that reporters “are finding other ways to get the Abbott v. Texas Dep’t of Mental Health
Louisiana State University sports informa- information,” Goodman said. and Retardation, No. 03-04-00743-CV,
tion director Michael Bonnette would not Journalists, for instance, can inquire if 2006 WL 2504417 (Tex. App.-Austin,
discuss a football player’s knee injury. universities have obtained permission from Aug. 30, 2006)
“He’s got a knee injury, and that’s all students through release forms, which many Hill v. E. Baton Rouge Parish Dep’t of
we’re saying,” he told the newspaper. “Due universities require of student athletes Emergency Med. Servs., 925 So. 2d 17
to these new medical laws, our hands are as a condition of participating in college (La. App. 1 Cir. 2005).
tied.” sports. Miss. Op. Att’y Gen. No. 2005-0595.
To Keith Webster, the head athletic While a university will require the stu- Neb. Op. Att’y Gen. No. 04018
trainer at the University of Kentucky and dent to allow the information to be released (2004).
former chairman of the government com- to coaches, schools will sometimes refuse to State ex rel. Cincinnati Enquirer v.
mittee for the National Athletic Trainers release that information to the media if the Daniels, 108 Ohio St. 3d 518 (2006).
Association, these types of responses are student wishes, Webster said. Univ. of Colorado Hospital Authority v.
frustrating. But if college officials do end up speaking Denver Publishing Co., 340 F Supp.
“I hate the term ‘I can’t release it because to reporters, waivers such as those used at 2d 1142 (D. Co., 2004).
of HIPAA.’ The reason you can’t release it Kentucky can protect school administra-
Winter 2007 A Reporter’s Guide to Medical Privacy Law Page 11

12. The Reporters Committee for Freedom of the Press is commit- law help, there’s the Open Government Guide, a complete guide
ted to helping journalists understand the laws that affect newsgath- to each state’s open records and meetings acts. Also, Access to
ering. And we have a wide array of publications that can help. Electronic Records tracks developments in the states regarding
We’ve got special reports like Homefront Confidential, an computerized release of data.
examination of access and information policy issues in a post- And of course, there’s the First Amendment Handbook, a
September 11 world. guide to almost every aspect of media law with practical advice for
Our Reporter’s Privilege Compendium offers a detailed look overcoming barriers encountered every day by journalists.
at each state’s shield laws and court decisions that affect the ability For these and many more publications, visit our Web site.
of reporters to keep their sources and information confidential. Read these guides online — for no charge — or purchase a copy
For help with gaining access to government records and meet- to read in print.
ings, we’ve got How to Use the Federal FOI Act. Or for state
Visit our online First Amendment newsstand at:
www.rcfp.org/publications