Hipaa made me do it

The New York Times has a great article this morning on how the federal law intended to protect patient's privacy is often over enforced by confused hospital staff.

Hipaa was designed to allow Americans to take their health insurance coverage with them when they changed jobs, with provisions to keep medical information confidential. But new studies have found that some health care providers apply Hipaa regulations overzealously, leaving family members, caretakers, public health and law enforcement authorities stymied in their efforts to get information.

Experts say many providers do not understand the law, have not trained their staff members to apply it judiciously, or are fearful of the threat of fines and jail terms — although no penalty has been levied in four years.

Some reports blame the language of the law itself, which says health care providers may share information with others unless the patient objects, but does not require them to do so. Thus, disclosures are voluntary and health care providers are left with broad discretion.

This spring, the department revised its Web site, www.hhs.gov/ocr/hipaa, in the interest of clarity. But Hipaa continues to baffle even the experts.

Ms. McAndrew explained some of the do’s and don’ts of sharing information in a telephone interview:

Medical professionals can talk freely to family and friends, unless the patient objects. No signed authorization is necessary and the person receiving the information need not have the legal standing of, say, a health care proxy or power of attorney. As for public health authorities or those investigating crimes like child abuse, Hipaa defers to state laws, which often, though not always, require such disclosure. Medical workers may not reveal confidential information about a patient or case to reporters, but they can discuss general health issues.

I know as a reporter, we educated ourselves on exactly what information can be released, but there is widespread confusion -- despite HIPAA training each year -- on how decisions are made. We have a sheet that the patient is supposed to fill out with names of the only people we can release information to. We press people to give specific named even when they say we can update "anyone who calls."