What records are available under HIPAA?

Hospital directory information

According to the Department of Health and Human Services, hospital directory information containing basic facts about current or recent patients treated by a hospital should be released. This includes patients' names, locations within the hospital, general conditions (including whether a patient has been treated and released or has died), religious affiliations and room telephone numbers. The American Hospital Association (AHA) advises its members that information about the location a patient was released to and the date and time of death should not be disclosed.

The department's guidelines require that patients be informed about the information in the directory and be allowed the chance to object to disclosure. In an emergency, if the patient has not had a chance to consent, the hospital may still release the information if it deems the release is in the patient's best interest.

The AHA also advises its members that directory information can only be released if a reporter identifies the patient by name and that the room number of a patient should never be disclosed to the media without patient permission as a matter of policy. The association's practices may be more restrictive than the law requires, but journalists should know what hospitals are being told.

Hospital billing data

Statistical information related to hospital billing data is not covered by HIPAA, which means hospitals can release it. This information, collected by some state hospital associations and the federal government, can detail the number of procedures performed, death rates and other information, but no names can be attached to the data. Generally, it is available from the National Center for Health Statistics (www.cdc.gov/nchs).

Death, autopsy and coroner records

State laws vary widely on the availability of death, autopsy and coroner records. Even before medical privacy rules, the availability of these records was being curtailed. However, the Department of Health and Human Services says that if state law "provides for the reporting of disease or injury, child abuse, birth, or death, or for public health surveillance, investigation, or intervention," HIPAA does not prevent it.

A 2004 Nebraska attorney general opinion found that cause of death was protected health information under the act. However, the opinion also determined the information should be released because Nebraska's open records law mandated it.

Ambulance and Emergency Medical Services records

Often medical information in these records will be protected under state laws, but other information in the records, such as the time it took an ambulance to reach a scene, can be released. Whether ambulance service is covered by HIPAA generally depends on if the ambulance service bills the patient.

In a 2005 opinion, the Maryland attorney general, in deciding whether dispatch records known as "event reports" from the Baltimore County Fire Department could be released, wrote that HIPAA does not apply because the fire department does not bill electronically for its services. Because 911 dispatchers and paramedics provide health care, the attorney general said, medical information in these records is confidential under state law. However, the attorney general said the state law does not protect the identity of the person who called 911 or the identity of the person transported.

The same year, the Mississippi attorney general reached a similar conclusion. Analyzing whether a county emergency medical service record could be released under HIPAA, the attorney general opinion concluded the act's "required by law" exception would allow the release of information that was public under the state's public records law.

Ambulance ride-alongs

In at least one case, the Department of Health and Human Services has cracked down on reporters riding along on medical emergency calls.

Washington, D.C.'s fire and EMS unit received a letter from the department after a reader complained when the Washington City Paper ran a story with patient information the reporter obtained from the patient.

As a result of the letter, the city no longer allows media ride-alongs on medical calls, though it will allow limited access to fire calls.

In June 2004, Health and Human Services sent a letter to the American Ambulance Association that addresses questions about ride-alongs. The letter concludes that without patient authorization, disclosure of health information to the media during a ride-along is not allowed. It is unclear how authorization would be obtained in many emergency situations.