Medical Privacy

Since stringent medical privacy regulations went into effect in 2003, the media have been forced to learn the new rules, work around them in some cases, and in others battle them in court.

Yet the Health Insurance Portability and Accountability Act's privacy rule remains a prickly issue for reporters, hampering routine reporting assignments and big investigative pieces.

Journalists have challenged the privacy rule in court in a handful of cases and at least twice have won rulings requiring the release of information under state public records laws.

When Congress passed HIPAA in 1996, the law required the Department of Health and Human Services to enact federal health privacy regulations, known as the Standards for Privacy of Individually Identifiable Health Information, or the privacy rule. Media organizations objected that the proposed rule overly restricted access to information. Still, the law went into effect in 2003.

Initially, HIPAA caused immense confusion. Many entities that assumed they were covered by the law were not, and most feared the harsh criminal penalties -- including jail time -- associated with violating the law.

Because of the language of the act, which was mainly concerned with controlling the electronic transfer of health information, agencies that perform similar functions may be subject to different standards under HIPAA.

Each agency can set itself up differently so some are completely HIPAA-compliant, while others can compartmentalize so that only parts of the organization are obligated to comply with the act.

For instance, HIPAA may apply to county ambulance services that bill electronically, but may not apply in other counties without electronic billing. And where HIPAA may prevent the release of health information in one state, another state's public records laws could make the same information public.

"There's been tremendous confusion," said Robert Gellman, a privacy consultant who worked for the House Committee on Government Operations when HIPAA was drafted. "It's been dying down, but it's still going on. There was an initial panic and there was a lot of initial misunderstanding and it takes a long time to beat that out of the system."

Journalists say agencies are withholding records that were never intended to be covered under HIPAA because they are unsure about the law -- or use it as an excuse.

Initially, some refused to turn over documents such as accident reports and some would not give journalists even basic information about accidents.

"The general news people -- I feel terrible for them," said Chris Halsne, an investigative reporter for KIRO-TV in Seattle. "It's terribly frustrating for them when they know that the information is legally available, it's just not going to be -- based on . . . who knows what?"

Halsne's biggest HIPAA-related problem came when he was working on a November 2005 story examining the frequency and rationale behind prescribing narcotics to state prisoners.

The numbers -- what the prison bought and how much it cost -- were a financial matter and clearly public, he said.

Halsne got the numbers but also wanted a log book of medications disbursed in the prisons that includes the prisoner name, identification number, reason for the medication, the prescription, the date, and the amount of drugs.

"They do that mostly not for medical reasons, but for accounting purposes because they don't want to be missing a bunch of pills," he said.

He requested the log book with the names and identification numbers redacted.

"Even then, when there was no identifying information, their first fallback was HIPAA," he said.

HIPAA and state laws

Halsne was able to report the story without the records but said the data would have made it "more complete."

"If I cared enough and we would have fought this one on prison drugs, we would have won," he said. "They just didn't want to give it to us."

But some journalists have successfully battled agencies in court.

The battles primarily involve disputes over the privacy rule's "required by law" provision. That provision allows HIPAA-covered entities to disclose "protected health information" to the extent that such use or disclosure is required by law.

Though the decisions are not binding outside of the courts' jurisdictions, they may be influential for other courts considering the issue and signal the courts' skepticism of attempts to restrict access to information that was public before HIPAA.

In March, Ohio's highest court ruled in favor of The Cincinnati Enquirer, which fought the local health department over whether notices issued to property owners of residences where children had tested at high levels for lead in their blood were public.

In covering a housing court, reporter Sharon Coolidge had noticed only building department cases on the docket and not cases brought by the health department.

It quickly became clear that HIPAA was the reason no health department cases were being docketed. When Coolidge learned the missing cases might involve a lead issue, she knew there was a story, somewhere, about the city's lead problem.

When she initially requested the lead notices, the health department refused, citing the reference in the notices to children's blood test results.

"It's pretty scary to go the lawsuit route because what if they said no?" Coolidge said. "Then I would be setting precedent."

Initially the newspaper lost, as she feared. When the state Supreme Court agreed to hear the case, Coolidge said she was surprised.

The court ruled that the notices did not contain "protected health information" and that even if they did, the notices would still be public because "the Ohio Public Records Law . . . requires disclosure of these reports, and federal law, HIPAA, does not supersede state disclosure requirements," Justice Terrence O'Donnell wrote for the unanimous court.

The court wrestled with how to read the federal and state laws.

"We are confronted here with a problem of circular reference because the Ohio Public Records Act requires disclosure of information unless prohibited by federal law, while federal law allows disclosure of protected health information if required by state law," O'Donnell wrote.

The court concluded that neither Congress nor the Department of Health and Human Services intended to preempt state disclosure laws. The court also noted that in the guidance issued along with the privacy rule, HHS said when a conflict arose between the federal Freedom of Information Act and HIPAA, FOIA was an example of a disclosure "required by law."

In June, the paper ran a three-story series based on the records, detailing the plight of families whose children have been harmed by lead.

John Greiner, the Enquirer's attorney, said he thinks the decision will help the paper access other documents, such as police incident reports, that are frequently withheld citing HIPAA despite efforts to educate the police that HIPAA does not apply to those sorts of materials.

"I think [it helps] in the sense that a court said it's OK to turn this stuff over," Greiner said.

The decision is also likely to solidify pre-HIPAA court rulings that 911 call records are public, he said, because of the way the court read the state freedom of information law in conjunction with HIPAA.

A Texas appeals court looked to the Ohio decision, as well as the government guidelines, in a recent case involving a Dallas television station that sought statistics about alleged sexual assaults at state psychiatric hospitals.

In June, the court said the information sought did not seem to qualify as protected information under HIPAA.

But even if the information is protected, the court wrote, the agency must determine whether there is an exception to the privacy rule that allows the release. If the request is made under the Texas Public Information Act, it falls under the "required by law" exception.

Other courts have sidestepped the issue. In Louisiana, Gannett River States Publishing, which owns several newspapers in the area, sued the East Baton Rouge Parish emergency medical services department after officials refused to release 911 tapes, citing HIPAA.

But the appeals court did not address the applicability of HIPAA, opting instead to declare the calls confidential under state law in December 2005.

Potential for punishment

Much of local agencies' reluctance to release health and medical information comes from the potential penalties they face under the federal regulations.

"Everybody has had the same problem of no one knows what HIPAA says really well," said Gellman, the privacy advocate. "In the absence of a firm, clear lawyer standing next to you saying you won't go to jail, people just say no."

But an investigation by The Washington Post published in June found that after three years and almost 20,000 complaints to Health and Human Services, no one has ever been fined for violating HIPAA and only two criminal cases have been brought against alleged violators. Neither involved releasing information to the media.

The department told the Post it prefers to work with institutions for voluntary compliance instead of enforcing the law strictly.

Many media outlets fear hospitals and other health care providers will be able to retaliate against them in civil actions if they publish protected health information.

But in 2004, a federal judge in Denver held that a private party cannot sue under HIPAA.

The University of Colorado Hospital sued the publisher of the Rocky Mountain (Denver) News to prevent the newspaper from printing an internal report, arguing that publishing the information would be a violation of HIPAA. The court neither granted the injunction nor allowed the hospital to continue its case against the newspaper.

U.S. District Judge Walker Miller wrote there was no evidence Congress intended for a private party to be able to enforce HIPAA, particularly through the privacy rule. Though the federal judge's ruling is not binding elsewhere, the judge's decision has been cited by other courts throughout the country.

Working around HIPAA

Since health care agencies continue to stonewall reporters, media organizations have tried to find solutions to get records without resorting to lawsuits.

When it comes to breaking news stories, Halsne, the Seattle TV reporter, says the station now sends producers down hospital halls, trying to find information without asking the public relations staff.

Reporters also have cultivated additional sources, such as security guards in the basement, who they rely on to confirm basic information.

In Atlanta, reporters have frequently met with hospital staff in an attempt to resolve issues before they arise in breaking news, said Tom Clyde, an attorney who represents The Atlanta Journal-Constitution and WSP-TV.

"There's no question it's been helpful," Clyde said. "It has improved things, especially in the emergency situation."

But Clyde says the turnover at hospitals and government agencies can be high, which means a lot of time is spent retraining staff and getting people comfortable with established practices.

For example, David Milliron, the computer-assisted reporting editor at the Journal-Constitution, said he has had difficulty securing vital statistics from Georgia this year, including birth, death and marriage records -- something the newspaper has done for at least nine years.

The newspaper uses the data to do stories on topics such as marriage and divorce rates and teen pregnancy, and to publish interesting feature pieces, such as statistics about the babies who were born on Sept. 11, 2001.

Recently, with new employees working for the state, there are new problems, Milliron said.

"They want to apply some de-identification that wouldn't allow you to create any statistics below the three-digit ZIP code level," Milliron said. Across Georgia, that means there would only be a handful of geographic groups the newspaper could analyze.

"It's very disconcerting to the newspaper when the newspaper has spent great expense -- legal and time wise -- working out an agreement," he said.

Even some agencies have complained that overzealous enforcement of HIPAA prevents them from publicizing positive work and hurts the public's right to know.

The Department of Health and Human Services received complaints after the Washington City Paper published stories with identifying information about patients obtained during a ride-along with the Washington, D.C., Fire Department.

The information came not from emergency personnel but from the patients themselves, said Alan Etter, a spokesman for the department.

"A reporter walked up to the patient in a public area, and this person as an adult -- obstinately aware of the ramifications -- gave the reporter his name," Etter said.

But Health and Human Services did not care, and the fire department has stopped media ride-alongs on ambulances because of the federal government's concerns, Etter said.

"It makes it difficult for a PR guy like me to show his fire department in action," he said. "This is a publicly funded service -- people who pay taxes in the city ought to be able to see."