New HHS rules mute hospital staff, health workers

From the Winter 2001 issue of The News Media & The Law, page 42.

By Rebecca Daugherty

The U.S. Department of Health and Human Services received more than 52,000 comments on its proposed medical privacy rules — at least two of which were from journalists’ organizations.

Not surprisingly, final rules published in late December restrict the information any health care providers can make public and promise to penalize employees who give out patient information without, at least in most cases, written consent from the patients themselves.

In the 330 pages in the Federal Register devoted to addressing comments, the agency did not address journalists’ concerns that the new rules will hinder reporting.

The complicated rules take effect in late February, but health care providers will have two years to implement them. The rules set minimum standards for what the health care industry must keep secret. They displace existing state laws that are less strict, but they allow states to impose their own more stringent rules against disclosure.

President George W. Bush has put on hold those regulations adopted late in the Clinton administration.

Except for some directory information, journalists will not likely obtain any identifiable patient information unless the information is leaked to them, and leakers will face new penalties. These rules do not actually set the penalties for unauthorized disclosure of patient information, but promise that separate regulations will address monetary penalties and the referral of criminal cases when the rules are violated. The law allows both civil and criminal penalties including civil fines of $100 per incident up to $25,000 a year, and criminal penalties as high as $250,000 or ten years imprisonment.

The proposed rules only addressed complaints from patients about disclosure of patient information, but the final rules allow anyone to make a complaint about patient privacy to the government and any complaint can result in penalties for disclosure.

In another change, the agency extended the privacy rules to cover not only electronic records, as described in the law and in the proposed rules, but records in paper form as well.

The rules require secrecy about patients not only from hospitals but from a wide range of health plan and health care providers as well — even ambulance services and pharmacies are covered.

Even the standard directory information that hospitals traditionally have made available will be limited under these rules. Without consent, hospitals can only release patients’ names, where they are located within the facility, and their condition, described only in general medical terms. This is not markedly different from the rules most hospitals already observe, but under the new rules, even this information cannot be released unless a patient has an opportunity to object to the disclosure, or unless the patient is incapacitated or an emergency exists.

And even when it is impossible to obtain a patient’s consent, disclosure is only allowed if it would be “consistent with a prior expressed preference” of the individual known to the hospital, or disclosure would be “in the patient’s best interest according to the professional judgment of the health care provider.” If disclosures are made, the patient must be given the opportunity to object to further disclosures as soon as is practicable.

The rules regarding exceptions to written consent do not mention journalists — either by excluding or including them. They do mention health care institutions, family members, close friends, other persons assisting in care, government agencies and disaster relief agencies. One section addresses uses for marketing purposes.

Only twice in the lengthy commentary on the rules, does HHS mention journalists’ access at all. Two deprecatory references each say that an exception allowing minor disclosure “is not intended to allow disclosures to a broad range of individuals, such as journalists who may be curious about a celebrity’s health status.”

The rules contain a “research” exception allowing researchers to obtain individually identifiable information under certain rigid circumstances. Journalists in some instances have benefitted from “researcher” exceptions to other nondisclosure rules. However, these medical privacy rules apparently only contemplate research exceptions for medical research. Anyone gaining a “researcher” exception must be approved by hospital or privacy review boards before any research can commence.

The rules also provide some exception for “oversight,” but they list oversight agencies that can qualify for the exceptions to secrecy, and do not include journalists. The rules address whistle-blowers but refer them to health oversight agencies and do not acknowledge any relationship between whistle-blowers and journalists.

In opening commentary on the values of privacy, HHS cited as one of the “harms” that can occur, the “almost” derailed candidacy of a representative to Congress after news revelations, based on leaked hospital records, that she had attempted suicide and had subsequently sought psychiatric help. HHS did not concede that the public had an interest in the fitness for office of Rep. Nydia Velazquez (D-N.Y.), nor that the public minimized any stigma associated with her by electing her.

In its commentary, HHS said that the privacy exemption to the federal Freedom of Information Act should be invoked to protect any patient records held by federal agencies. It also recommended that agencies invoke the privacy exemption even when a patient is dead “to consider the privacy interests of the decedent’s survivors.”

The Reporters Committee for Freedom of the Press told HHS in its comments that the proposed rules would hinder reporting on several levels. It wrote:

“Initially we are concerned that hospitals will be limited in providing the standard directory information that they have customarily provided the public, information that is important not only on a regular day-to-day basis, but that is critical to public understanding of tragedies and disasters.”

After the Columbine and Jonesboro school shooting tragedies, the bombing of a federal building in Oklahoma City, the recent multiple shootings at workplaces, school bus accidents and in countless other situations, the public has needed accurate identification and status of patients. Reporters have worked diligently to gather that information. It is unthinkable that a hospital communicator would be subject to a $25,000 fine for helping a reporter give that news to the public,” the Reporters Committee wrote.

“Secondly we are very concerned about the extremely harsh punishments for disclosures of patient information. Journalists have often reported information provided to them by whistle-blowers within the hospital community, and they have often sought answers to questions from health care providers that have helped provide the public with stories on important medical matters. Although these rules would not prohibit many of the communications between staff and journalists, health care workers will be very wary of providing any information at all given the hefty penalty they face for providing prohibited information. The conclusive nature of these rules that punishes good works as well as bad is unfortunate and runs counter to the public’s interest.”

The Reporters Committee pointed to the role that journalists play in overseeing institutions, even when government agencies charged with oversight and professional organizations fail to recognize problems. It noted, for example, that after Associated Press reporter Jean Heller in 1972 reported upon a decades-long study of untreated syphilis in 400 poor black men in Macon County, Ala., public outcry led to the discontinuance of that study. Both the Centers for Disease Control in Atlanta and the American Medical Association had written about that study without challenging it. It also cited stories of secrecy in medical research that inadequately protects patients, and stories of medical mistakes.

“Thirdly, the rules would prohibit and austerely punish any undercover investigative work by journalists even though journalists have, in the past, uncovered stories about extremely sinister medical practices that could not have been revealed in any other way. These rules fail to acknowledge the First Amendment’s protections for newsgathering and provide no exception or defense for undercover reporting — even when that reporting clearly benefits society rather than harming it.”

The comments cited Pam Zekman’s reporting in the 1970s for The Chicago Sun Times about an abortion clinic that performed abortions on women who were not pregnant. Her story depended on the work of an undercover operative who supplied her with medical records.

“Finally, these rules do not allow any balance of public and privacy interests that may surround the category or circumstance of particular patients. The public has an undeniable interest in the health of its leaders and the fitness of persons — such as airline pilots — who are entrusted with the well-being of others. There is a different and special interest in the health of patients whose legal status is dependent on the state of their health. And the public may have a special interest in medical and identifying information about persons who have contracted deadly and communicable diseases.”

The Society for Professional Journalists also commented on the proposed regulations, asking that public record information include general information on certain categories of patients including people in police custody or who are transported to the hospital by public safety entities; people injured in violent crimes or accidents that are reportable to federal or other public agencies; and, public officials who are hospitalized. HHS did not address any of these concerns.

Congress in 1996 enacted the Health Insurance Portability and Accountability Act (HIPAA), vowing that if it did not itself enact a law governing privacy of patient information by Aug. 21, 1999, then HHS would have to write and adopt rules governing patient privacy. Congress has considered but not passed numerous medical privacy bills since passage of HIPAA.