HIPAA myths, ad nauseum

I fired off a long e-mail Thursday night to the listserv of the Association of Health Care Journalists, of which I am a member. I got tired of reading about people discussing why an editor for medical publishing company Elsevier had a hospital deny permission to print a clinical photo of a small portion of an unidentified patient’s body, even though a physician at the same hospital was willing to hand over the image.

Nothing in healthcare frosts my biscuits more than HIPAA-related paranoia.

This is how I responded:

Yes. there is a lot of paranoia about HIPAA, mostly because it’s badly misunderstood. For example, HHS has said it is perfectly fine for staff to call out patient names in waiting rooms. Click this link to go to the HHS privacy FAQ page and click on Subject #5.

From all the other comments on this listserv, it sounds like the hospital’s refusal to ask for consent had more to do with money (from sale of the rights to such photos) and potential malpractice liability. The potential criminal penalties notwithstanding, I am not aware of the feds prosecuting anybody under the privacy regs to date. The HHS Office for Civil Rights, which enforces the civil part of the privacy regs, has been clear in saying that enforcement will be driven by complaints only. There is no “HIPAA police” out there trying to catch anyone in the act.

One interesting provision in the privacy rules is that covered entities (e.g., hospitals, docs, labs, health plans) have permission share a “limited data set” of de-identified information with public health agencies to identify or respond to a public health outbreak, but news media are expressly excluded from this right. Read it yourself at http://www.hhs.gov/ocr/hipaa/privrulepd.pdf, page 57, final comment at the bottom of the right-hand column and the response that follows on page 58.

The HHS press office is at (202) 690-6343. Someone there should be able to explain the minutiae of the regs. E-mail me directly if you want the name of a HIPAA consultant or lawyer.

If you think the rules are too restrictive, get in touch with the National Committee on Vital and Health Statistics, which must report to the HHS secretary each year on the status of HIPAA regulations and recommend any necessary changes. The Radio-Television News Directors Association submitted testimony last year. See http://www.ncvhs.hhs.gov/040714p3.htm.

I took the trouble of carefully researching this information because I think it’s important to explode some of the myths. Whoever is planning next year’s AHCJ meeting, I think this subject might need to be on the agenda.