|
|
The federal law, which went into effect April 14, 2003, was intended by Congress to protect health insurance coverage for workers and their families when they change or lose their jobs.
But it brought with it regulations formed by the U.S. Department of Health and Human Services at the direction of Congress intended to protect the privacy of individuals’ medical information. Hospital personnel are among the health care providers charged with implementing the regulations under threat of fine and imprisonment.
When patients are admitted they must be asked if they would like to opt out of the patient directory, which, in effect, prevents anyone from knowing they are in the hospital. If they opt to stay in the directory, only general information may be released, such as condition and where they are in the facility.
While HIPAA makes exceptions for law enforcement authorities investigating cases, it has created problems for them.
Delaware County Deputy District Attorney Sheldon Kovach, chief of the law and appeals division, noted that there is a potential for injured perpetrators to try to elude authorities via HIPAA while in the hospital.
"I recall one case where a detective wanted to speak to a perpetrator and because of HIPAA, couldn’t see the patient. They knew he was there," said Kovach.
Assistant District Attorney Michael Galantino, who heads Delaware County’s special victims unit, said the difficulty presented by HIPAA for him isn’t so much right after a crime occurs, but later in the course of an investigation.
"It slows down cases that we’re already investigating and, in some cases, delays the trial," said Galantino, who has closed about 1,000 cases involving sexual assault, domestic abuse and child physical and sexual abuse since 1998.
He prosecuted one domestic abuse case where the victim was injured in Pennsylvania, went to an emergency room in Delaware because that’s where she lived, then underwent surgery in Tennessee to be near her family.
Hospital officials in Tennessee and the victim’s doctor, whose office was in Georgia, were very reluctant to turn the records over to him and he finally had to ask the victim to get the records for him.
"It was easier to ask her to go to the hospital where she had the surgery, sign the release in person and turn the records over to us. It delayed the process, the trial and the disposition of the case by several months," said Galantino.
He said he has also experienced delays in getting subpoenaed medical records from hospital clerks in Delaware County.
"One case is set to go to trial in a few weeks. We sent for medical records several months ago. We have received a form letter suggesting they couldn’t comply with the subpoena because of HIPAA. I don’t believe the person realized it was a criminal case or that the victim has been sexually assaulted," said Galantino.
He called the hospital’s risk manager and she helped resolve the matter, but it prolonged the process by three or four weeks. Because of a suspect’s right to a speedy trial, if one is not held within six months of arrest, the suspect is entitled to a reduction in bail, explained Galantino.
"We could conceivably be faced with the decision some day of trying a case without full preparation or letting a dangerous defendant out on bail because we don’t have all the records," said Galantino.
Kovach said Chester regional court officers have had some difficulty with hospital clerksin obtaining blood-test results connected with drunk-driving cases despite subpoenas and an exception under HIPAA for criminal investigations.
"If a patient can’t give consent, then we can get a court order," said Kovach. "They’ll say you need patient consent. Well, no you don’t. A subpoena is in essence a court order."
Problems down the road
Pennsylvania State Police Sgt. Tony Sivo said, because of HIPAA, state police have also used court orders to obtain the results of blood tests in drunken driving cases. He foresees potential problems with HIPAA in trying to get the condition of accident victims.
"If someone was killed we’d like to know that before we approach a member of the family and ask how the person is doing," said Sivo.
Kovach noted that there is also the potential problem of consent for medical records in child abuse cases where a parent may be the suspect. Doctors are required by HIPAA to report suspected child abuse cases to Delaware County Children and Youth Services.
"If the parent is the perpetrator, then Children and Youth Services has the right to get the records," said Kovach, who noted that child services officials cooperate with the District Attorney in investigating child abuse cases.
He noted that some hospital personnel choose to be cooperative with criminal investigators seeking information about patients, while others will routinely defer to their superiors.
"They want to protect the institution against civil liability, that’s why they go overboard. They follow the protocols and directions of their solicitors," said Kovach.
Kathy Scullin, vice president of marketing and public relations for Crozer-Keystone Health System, said as they go along, hospital officials are recognizing how they need to amend the HIPAA implementation process both internally and externally.
She said because Crozer-Chester Medical Center is the largest Delaware County hospital, chances are greater that misunderstandings about HIPAA may occur there. Scullin noted that hospital officials have been working with police and prosecutors to resolve HIPAA issues.
"The last thing we want to do is make their job more difficult," said Scullin.
Crozer-Keystone Health System also includes Taylor Hospital in Ridley Park, Springfield Hospital, Delaware County Memorial Hospital in the Drexel Hill section of Upper Darby and Community Hospital in Chester, which does not have an emergency room.
Nancy Bucher, Crozer-Keystone’s vice president and chief compliance and privacy officer, said that when staff members have questions regarding HIPAA, they are instructed to contact Linda Ramsey, assistant vice president for claims and risk management.
One common point of confusion centers on the release of information about a crime victim who has been brought to the emergency room.
"If it is a victim of a violent crime, the law is very specific in that area. The first thing we try to do is get an agreement from the victim. If they are incapacitated and it is an emergency situation, the caregiver has to decide," said Bucher.
Sometimes it is impossible to get consent from the patient or a legal representative.
"We can use professional judgment on whether to disclose information. We’d share information with law enforcement officials," noted Bucher.
Sister Donna Watto, vice president of mission services at Mercy Fitzgerald Hospital in Darby, said hospital officials follow guidelines specified by HIPAA in the release of information to law enforcement authorities.
"In a case of violence or a case of abuse we may release information without authorization from the patient," said Watto.
Dennis Burt, privacy officer at Riddle Memorial Hospital in Middletown, noted that there are circumstances in which the needs of federal, state or local law enforcement or other regulatory agencies supersede the patient’s right to privacy.
"For example, a patient’s record that is suspected of having a disease obtained by a bioterrorism event, or a patient condition that could present a public health risk would be reported to authorities as required by law," said Burt.
He noted that if a patient is unable to give consent to be in or out of the directory, no information is released to the media until next of kin or the patient’s legal representative is notified.
"In the event of a mass casualty such as a traffic incident, the hospital may provide information on the number of victims brought to the emergency department, but would not release patient names until the next of kin/representative was informed," said Burt.
Even before HIPAA went into effect, said Watto, Mercy Fitzgerald Hospital policy was to attempt to gain permission from the patient or the patient’s family before releasing any information about the patient to the public.
"It depended on the case whether we would release anything," said Watto.
She said now if hospital officials are unable to consult with the patient or a family member, they lean toward leaving the patient in the directory until they are able to consult with the patient or family member.
Similar policies
The policy is the same at Riddle and Crozer-Keystone hospitals.
"Unless directed by the patient or the patient’s legal representative to remove them from the directory, the patient would be in the directory," said Burt.
At Riddle, Mercy Fitzgerald and Crozer-Keystone hospitals, most patients opt to stay in the directory.
"We try really hard to have patients understand up-front that if they opt out of the directory, under HIPAA, we can’t even acknowledge they are in the institution, we can’t accept flowers, we can’t do anything to demonstrate to the outside world that they are here," said Bucher.
When HIPAA was first instituted, more patients opted out of the directory at Mercy Fitzgerald because they mistakenly believed that if they stayed in, they would be solicited for donations, Watto observed.
"Now that they understand better, more are staying in," said Watto.
Scullin said hospital officials automatically opt some patients, such as those in the psychiatric unit, out of the directory,but their families usually know they are there.
Scullin said there have been cases where families of Crozer-Keystone patients have been upset because they can’t get information about loved ones they know are in the hospital, but who have opted not to be in the directory.
"Patients also have the right to change their minds," said Scullin. "If a family is agitated at us about not releasing information, we ask the patient if he wants to keep out of the directory."
If they do opt out after being advised of the outcome of their decision at Riddle, no further comment is made to the patient, said Burt. He said patients would only be advised of issues that may make them want to opt back into the directory under extenuating circumstances.
"Deliveries to patients that have opted out are not accepted as the staff person that receives them would not know they are a patient at the hospital. Flowers are returned to the florist and mail is returned to the post office," said Burt.
If a phone call comes in or a visitor or flowers arrive for patients who have opted out of the directory at Mercy Fitzgerald, an information representative at the front desk will try and check with the patients to see if they want to receive them, said sister.
Members of the clergy are among the most inconvenienced by HIPAA, she noted.
"They feel people are falling through the cracks because they can’t get the information. They used to be able to get a print out of names. They miss people and the family doesn’t always understand why the pastor hasn’t come to visit," said sister.
Under HIPAA clergy are permitted to have a list categorizing, according to religion, the names of patients who have said upon admission that they would like clergy visits.
"There have always been a lot of misconceptions about what the clergy can and cannot do," said Bucher. "We’ve had a couple clergy brunches to try and help them understand they can still interact with their parishioners."
Local health care providers also are implementing systems in waiting rooms of diagnostic and outpatient areas to ensure patient privacy, such as assigning patients numbers or providing them with pagers.
"HIPAA really doesn’t prohibit you from calling out names, but in our obstetricians’ office we just use the patient’s first name. In the psychiatric practice, we don’t say any names. The physician personally greets the patient," said Bucher.
Delaware County Director of Emergency Services Ed Truitt said radio dispatchers are in the difficult position of getting information directly from victims and their loved ones who, often reveal very personal details in an emergency. He said even before HIPAA, dispatchers were trained to use general terminology in sensitive situations, for example, referring to a rape as an assault when broadcasting information to emergency medical technicians.
"Once a dispatcher gets a medical unit to a patient we assume from that point forward they can’t tell us everything because of HIPAA. Then they just tell whoever is involved with the medical environment," said Truitt.
In the 28 years he has been emergency services director, Truitt said he has been uncomfortable with personal patient information going over the public air waves on scanners. That problem should be somewhat addressed as mobile computers are installed in ambulances, he noted.
Most people whose lives have been made more complicated by HIPAA understand that the law is well-intentioned.
"Anything to protect the patient’s health information is a good thing. We try to make people understand that it is really in the best interest of the patient," said Bucher.
Trooper McCunney feels the benefits of HIPAA probably outweigh the challenges, especially in these days of identity theft.
"With the HIPAA laws we do run into problems with certain hospitals and with certain hospital units. It’s harder for us, yes, but completely understandable," noted McCunney.
Kovach said HIPAA has definitely created additional hoops for investigators in the district attorney’s office to jump through.
"Sometimes it’s incumbent on us to be specific, to say we’re not violating the act," he admitted.
Sgt. Sivo can see both sides of the HIPAA issue.
"I think it has good intentions but in some ways it is hurting people," said the state police sergeant. "Can you imagine living a couple states away and not being able to find out how your mom is doing?"
