A campus police officer is shot and wounded. A student athlete breaks an ankle and is taken to the hospital for surgery. The college president flips his car on the highway and fractures his skull.
Many news stories require reporting on the injuries and ailments of public figures, and the public has a clear interest in — and entitlement to — information about stories that implicate the health of campus newsmakers.
And yet, whether through ignorance or deliberate obstructionism, government agencies continue to cite HIPAA, the federal health privacy law, to withhold or heavily edit public records in situations where HIPAA plainly does not apply.
In a recent interview, investigative health-care journalist Charles Ornstein described how he and his colleagues repeatedly have been denied information about patients’ medical information even with the patients’ explicit consent. That is how overwrought government agencies have become over secrecy: They will refuse to release information even when the person whose privacy they’re protecting tells them they should.
HIPAA — the Health Insurance Portability and Accountability Act of 1996 — provides criminal penalties for the unauthorized disclosure of people’s medical information. But here is the key: To be a violation of HIPAA, the information must come from a “covered entity.” And the federal government defines “covered entity” to mean only (1) a provider of health care services such as a doctor or dentist, (2) a health care insurance or billing company, or (3) an association or umbrella group of medical providers or insurers, such as the American Medical Association.
And that’s it.
Notice who is not covered: Coaches of sports teams. Police officers. Family, friends and co-workers.
Or journalists. A journalist cannot violate HIPAA by disseminating information about a person’s medical condition — period. If a journalist becomes privy to confidential medical information– even if the information is leaked by a physician who is violating HIPAA — the First Amendment protects the right to publish that information. And so long as the information is truthfully reported and is newsworthy, the disclosure is not legally actionable.
Nor — despite what campus police officers sometimes believe — can a student violate medical privacy simply by photographing or videotaping a person being tended by paramedics in a public place. While it may be wise ethical judgment to stand a respectful distance back from the scene of a medical emergency and to select images judiciously to minimize undue embarrassment, police can neither shut down the non-disruptive filming of a medical emergency scene nor destroy or confiscate the footage a journalist has shot.
What’s more, the HIPAA statute and accompanying regulations enacted by the federal Department of Health and Human Services explicitly allow for the release of “directory information” about a patient, even without getting approval from the patient or a family member — e.g., “Coach Smithers is in the cardiac unit in serious condition.” So a hospital spokesperson who claims to be legally barred from confirming that Coach Smithers is in intensive care is mistaken — or lying.
College journalists routinely are told by campus police and public-safety departments that HIPAA precludes the disclosure of, for example, the nature of a car-crash victim’s injuries. This is simply false. A police officer’s narrative write-up from the scene of an accident (or a crime) is not a patient’s medical record. Police reports are created for the benefit of law enforcement — and the public — not for use in delivering medical treatment.
A different confidentiality law, the Family Education Rights and Privacy Act, or FERPA, may sometimes apply to the release of a named individual student’s medical records. But not when the information is gleaned from police records or from a publicly observable vantage point, such as videotaping courtside athletic trainers bandaging a player’s wound.
In an extreme case that is making its way through the South Carolina courts, a county medical examiner is claiming that an autopsy report — the kind of document that routinely is released as a matter of public interest — is a confidential HIPAA medical record. As one open-government expert told Charleston’s Post and Courier, “If you’ve got a coroner for your health care provider, you’re in deep trouble.”
When a request for public records is met by a claim of HIPAA confidentiality, a journalist’s first assumption should be that the explanation is bogus. “Show me where in the law it says that,” is an excellent response to this and to many other half-baked rationalizations for dishonoring information requests.