Attitudes toward privacy rules may change in times of disaster

Jane Hansen spent four months after Hurricane Katrina delving into how two hospitals in New Orleans coped in the tense hours and days following the storm.

In the end, she wrote 22 stories for The Atlanta Journal-Constitution that ran in May and June under the title, "Through Hell and High Water."

The stories were accompanied by pictures taken by hospital staff during events and given freely to the newspaper.

The only people who brought up the Health Insurance Portability and Accountability Act throughout the disaster were in her newsroom.

"I kept waiting because my husband is a doctor and he runs into HIPAA all of the time," Hansen said. "I don't think anyone ever uttered the word HIPAA except at my end -- the editor's end."

Hansen's series told the stories of about a dozen people who worked to save 347 patients at Charity Hospital and more than 150 patients at Tulane Hospital, two hospitals located across the street from each other in downtown New Orleans.

"The only time I ran into confidentiality was when I was mucking around trying to verify who died," she said. But with persistence, she was able to confirm what she needed, she said.

Hansen wanted to meet one of the survivors from Charity who had been taken on a truck through the water, had his collapsed lung re-inflated in the middle of the street, and was carried to the rooftop of Tulane's hospital before being flown away by helicopter.

When she tracked him down, she went to see him in his hospital bed, along with a photographer.

"I had so much information on him from the doctors who were treating him, and they didn't hesitate to talk about him," she said.

Hansen was surprised -- pleasantly -- that she did not face the HIPAA-related problems she feared.

"I think because it was such an extraordinary tale, the issue of confidentiality just didn't come up," she said. "The notion of confidentiality seemed silly . . . given the life and death situation they were all up against."

In part, her experience may be due to two bulletins the Department of Health and Human Services issued in the days following Katrina, and which department officials say are applicable in future disasters.

According to the bulletin, health care providers can share information to locate a patient's friends or family. When possible, verbal permission should be obtained from the patient, but the bulletin says it is not necessary.

"Thus, when necessary, the hospital may notify the police, the press, or the public at large to the extent necessary to help locate, identify or otherwise notify family members and others," the bulletin read.

In addition, the bulletin said health care providers can share information with anyone to prevent or lessen a threat to the patient or the public's health and safety. Health care providers can also provide directories of patients, the bulletin reminded.

Alicia Mitchell, a spokeswoman for the American Hospital Association, said following Katrina, the hospitals were more flexible.

"Patient records didn't follow patients. It was a time of disaster, and hospitals did what they thought was right to help the patient and shared information appropriately," she said.

The guidelines put out by the government also helped, she said. "HIPAA is not supposed to get in the way of the flow of information that is helpful for the public good in times of disasters," she said.

The hospital association advises its members to work with the media during disasters.

For example, the association says after an explosion, a hospital might want to disclose general information, including the number of patients being treated there due to the event.

In cases where a hospital is trying to identify a patient, the association says it is not clear what information the hospital can release under HIPAA. A hospital might want to release general characteristics such as gender, height and weight, but would not be able to release a photo without the patient's permission. But the association recommends that a hospital use its professional judgment in the best interest of the patient.

Mitchell also pointed to another disaster resource -- a patient locator Web site the Greater New York Hospital Association maintained in the days following Sept. 11. The public could enter names and receive basic information about the people if they were patients. Such a Web site should be HIPAA-compliant, she said.