HIPAA Quick Reference Guide for Media
The Health Insurance Portability and Accountability Act of 1996 (HIPAA)
mandated regulations that establish standards to protect the privacy of
each person's individually identifiable health information. All hospitals
must comply with these privacy standards - and the rules regarding the
way hospitals may use or disclose Protected Health Information (PHI).
As providers of information, Baton Rouge General is obligated to ensure
that the facts, they are authorized to release, are as accurate as possible.
The hospital's first responsibility is to protect the confidentiality,
health and legal rights of each patient. To ensure that reporters receive
timely and accurate information, please contact the General's Media
Relations staff. Media should not contact Baton Rouge General patients directly.
The Hospital Directory
Under the Privacy Rule, a hospital must provide each of its patients with
a Notice of Privacy Practices that, among other things, describes the
uses and disclosures that the hospital may make of patients' PHI,
including uses and disclosures in its Hospital Directory of patients.
HIPAA privacy regulations restrict the information health care providers
may include in a patient directory and release to the public, including
news media.
Disclosure of Directory Information
The Notice of Privacy Practices requires hospitals to inform the patient
of the persons to whom the hospital may disclose the PHI that is included
in the Hospital Directory:
- The hospital may disclose the patient's name, location in the hospital,
and general condition, only if the inquiry specifically identifies the
patient by name. No information may be given if a request does not include
a specific patient's name or if the patient requests that the information
not be released. This includes inquiries from the press.
- As long as the patient has not requested that information be withheld,
hospitals may release the patient's one-word condition and location
to individuals who inquire about the patient by name.
Definitions of Patient Conditions
Under the Privacy Rule, the Hospital Directory may include a one-word,
general description of the patient's condition that does not communicate
specific medical information about the individual. These one-word descriptions
should be disclosed only if 1) the patient has not opted out of the Hospital
Directory, and 2) the person inquiring about the patient asks about the
patient by name. The following terms are recommended by the American Hospital
Association's Society for Healthcare Strategy and Market Development:
- Undetermined - Patient awaiting physician assessment.
- Good - Vital signs are stable and within normal limits. Patient is conscious
and comfortable. Indicators are excellent.
- Fair - Vital signs are stable and within normal limits. Patient is conscious,
but may be uncomfortable. Indicators are favorable.
- Serious - Vital signs may be unstable and not within normal limits. Patient
is acutely ill. Indicators are questionable.
- Critical - Vital signs are unstable and not within normal limits. Patient
may be unconscious. Indicators are unfavorable.
Option to "Opt Out" of the Directory
The hospital must give the patient the opportunity to restrict or prohibit
some or all of these permitted disclosures of the PHI that is to be included
in the Hospital Directory, including restricting the use or disclosure
of one or more categories of PHI (e.g., a patient could opt to have his
or her name and location, but not his or her condition, included in the
Directory.)
Patients Who Are Unable to Consent to Inclusion in the Hospital Directory
If a patient is unconscious or otherwise incapacitated when he or she is
brought to the hospital and cannot agree or object to his or her inclusion
in the Hospital Directory, the hospital may use and disclose the Hospital
Directory Information to people who ask about the individual by name if
such disclosure is consistent with any known preference of the patient
(e.g., if the patient expressed a preference when he or she was a patient
at the hospital in the past) and if the hospital believes that such disclosure
is in the patient's "best interest." The hospital must notify
the patient of his/her right to agree or object to inclusion in the Hospital
Directory as soon as the patient is conscious and able to make that decision.
Beyond the One-Word Condition: Media Access to Patients
Media representatives and photographers should contact the hospital's
designated spokesperson for assistance in obtaining interviews and/or
photographs of patients, employees and areas of the hospital. Hospital
policies usually require that a hospital representative accompany news
personnel any time they are on hospital grounds. No photographs, audio/visual
recordings or interviews of patients may be taken within the facility
or on hospital property without the patient's prior written consent,
or the written permission of a parent or legal representative. Even with
permission, news media representatives should use good judgement when
airing images or printing photographs of patients who are ill or injured.
Deceased or unconscious patients should NEVER be photographed under any
circumstance, regardless of whether they are in the hospital or on hospital property.
The following activities require a written and signed authorization that
meets all HIPAA privacy standard requirements from the patient:
- Releasing a detailed statement (includes anything other than a one-word
condition); the patient or his/her legal representative must sign the
written authorization approving any detailed statement;
- Taking photographs (either video or stills) of the patient; and
- Media interviews with patients.
Matters of Public Record
Matters of public record refer to situations that are reportable by law
to public authorities, such as law enforcement agencies, the coroner or
public health officer. Patients who are involved in public record situations
have the same privacy rights as all other patients. Inquiries should be
directed to the appropriate public authority. The public authority will
be guided by the applicable federal or state statutes as to whether or
not it can release information. Celebrity and public figures are not subject
to different standards than other patients when it comes to hospital policies
for releasing information to the media.
Requests for Extensive Patient Information
If a member of the press is seeking information about a patient's condition
and/or treatment at the hospital that goes beyond the basic information
that is provided in the Hospital Directory (e.g., a detailed statement
about the patient's condition, a photograph of the patient, or an
interview with the patient), the hospital public relations department
must obtain written authorization from the patient to use and disclose
that PHI. This authorization must describe in detail how the information
will be used and to whom this information will be disclosed, and must
establish a specific point in time (a date or an event related to the
patient or the purpose of the use or disclosure) at which the authorization
will terminate and the use and/or disclosure of PHI will no longer be
permitted.
Written Policies and Procedures
The Privacy Rule specifically requires that each hospital adopt and implement
written policies and procedures that are designed to ensure its compliance
with the Privacy Rule. Hospital public relations staff should understand
these policies and procedures, and should ensure that the hospital's
Administrative Policies and Procedures reflect any protocols that have
been changed to comply with the Privacy Rule.
Penalties for Wrongful Disclosure
Hospitals can face serious penalties for disclosing PHI about their patients
without proper permission. The U.S. Department of Health and Human Services
views wrongful disclosure of PHI as a violation of civil rights and has
delegated the civil enforcement responsibilities for the Privacy Rule
to its Office for Civil Rights (OCR). OCR will monitor compliance with,
and enforce civil penalties for violations of the standards set forth
in, the Privacy Rule. OCR will refer criminal violations to the U.S. Department
of Justice. The criminal penalties for wrongful disclosure of PHI fall
into three categories:
|
FINES |
IMPRISONMENT |
|
Knowingly
|
Up to $50,000
|
Up to 1 year
|
|
False Pretense
|
Up to $100,000
|
Up to 5 years
|
|
Intent to Sell, Transfer or Use for
Commercial Advantage, Personal Gain
or Malicious Harm
|
Up to $250,000
|
Up to 10 years
|
Members of the press could be subject to common law tort liability for
breach of privacy by writing, producing, and publishing a story that uses
PHI disclosed to them in violation of the Privacy Rule.
Working Together
Hospitals and news media rely on each other to provide the public with
important, timely and accurate health care information. At Baton Rouge
General, we understand this and want to work with you to keep our community
well informed while protecting the rights of all of our patients and their
families. We encourage you to contact us at any time, day or night, if
you have questions or need assistance.
Louisiana Legislative Auditor (LLA) Hotline