Federal courts in Illinois, Michigan, New York and Pennsylvania are sending hospitals conflict- ing signals about the privacy of patient medical records in recent rulings relating to lawsuits involving so-called partial-birth abortions.
The federal ban on such abortions, as well as other recent legislative debates over the government's role in personal medical decisions, perhaps set the stage for this latest privacy dilemma (Oct. 27, 2003, p. 4). Hospital officials, healthcare lawyers and privacy experts say that hospitals and their patients might be shocked to learn just how little privacy protection the Health Insurance Portability and Accountability Act of 1996 affords patients in court.
While hospitals and their patients were not parties to the three federal trials that began last week challenging the constitutionality of the Partial Birth Abortion Ban Act, nonetheless they've had to defend themselves and the privacy of their patient medical records.
"The Justice Department has said that under HIPAA the public no longer has a reasonable expectation of privacy," said Washington healthcare privacy lawyer Jim Pyles of the law firm Powers, Pyles, Sutter & Verville. "These (abortion) trials show that the purpose of the HIPAA privacy law has been violated and that the trust it was designed to ensure has been destroyed."
Though the hospitals have taken no position on the controversial abortion law itself, they were dragged into the litigation in Novem- ber 2003 when U.S. Attorney General John Ashcroft subpoenaed from at least seven hospitals the medical records of abortion patients of physicians who had filed one of the challenges.
The trials that began March 29 in Lincoln, Neb., New York and San Francisco attack the constitutionality of the ban passed last year. The Planned Parenthood Federation of America filed the San Francisco challenge, while the Center for Reproductive Rights filed the Nebraska lawsuit and the National Abortion Federation, along with seven physicians who perform abortions, filed the lawsuit in New York. In each case the plaintiffs allege the law makes no exception for preserving the life of the mother and said that in some cases the procedure Congress banned may be medically necessary. In response, Ashcroft subpoenaed the medical records of those doctors' patients to determine whether the procedures they allegedly performed were medically necessary.
Legal ripples across nation
While attention shifted last week to the constitutional challenges posed in the three trials, with testimony from physicians and the U.S. Justice Department's defense of the law, the hospitals whose records Ashcroft sought were not far from the line of fire, and there were new legal developments in their cases.
Also on March 29, the 2nd U.S. Circuit Court of Appeals in New York delayed an order by U.S. District Judge Richard Casey-who is presiding over the New York lawsuit-that would have compelled two New York-Presbyterian Healthcare System hospitals to produce medical records of abortion patients. In his order, Casey wrote there is no expectation of a right to privacy concerning patient medical records.
Just minutes before Columbia Presbyterian Medical Center and New York Weill Cornell Medical Center were required to produce the records on the first day of the trial, however, the appeals court issued a stay order and announced it would schedule an expedited hearing for April 20. On March 31 the government appealed for reconsideration and its motion was denied. Casey told both sides to reschedule their witnesses and the trial continued.
New York-Presbyterian spokeswoman Myrna Manners said the system was grateful that the court granted its request to delay Casey's order. "This recognizes our commitment to protecting the rights of our patients and the privacy of their medical treatment," Manners said. While the system was reluctant to comment further, given the pending legal proceeding, Manners said, there is considerable legal and logistical expense involved.
"And we are undertaking this expense because we believe this is an important issue," she said.
In the course of the trials' discovery process, the judges have learned that some of the hospitals whose records have been subpoenaed have not offered the banned abortion procedure and that some of the doctors challenging the law have not performed it, or at least not within the period defined by the subpoenas.
On March 26, a three-judge panel from the 7th U.S. Circuit Court of Appeals in Chicago affirmed an earlier ruling-although citing different reasons-by U.S. District Judge Charles Kocoras that had quashed Ashcroft's subpoena seeking the medical records of Cassing Hammond, a physician from Northwestern Memorial Hospital, Chicago. Northwestern spokeswoman Kelly Sullivan said while the hospital has not stated its position on the lawsuits, it felt obligated to protect its patients' privacy interests.
"Therefore, our hospital acted vigorously to protect our patients' confidential health information from disclosure. Both the U.S. District Court and Court of Appeals made a fundamental finding that the significant intrusion into patient privacy outweighed the government's need for these records to prove its case," she said.
The same day as the Chicago ruling, a Philadelphia federal judge threw out a similar subpoena that sought abortion patient records from Hahnemann University Hospital, Philadelphia. Hahnemann Chief Executive Officer Michael Halter said the hospital was pleased with the ruling. "Hahnemann's principal concern is protecting the rights of its patients and the privacy of their records," Halter said. "(U.S. District) Judge (Charles) Weiner's order allows it to continue to do just that."
Like New York-Presbyterian, the University of Michigan Hospitals and Health Centers in Ann Arbor, Mich., faced a judicial order to produce its abortion records. But the system's legal team negotiated with Justice Department lawyers to narrow the focus of the subpoenas to certain procedures and allow Timothy Johnson, one of the plaintiff physicians challenging the law, to search through the hospital's medical records to see if he had performed any of the identified procedures at that facility during the prescribed time period.
The hospital's deputy general counsel, Edward Goldman, said U.S. District Judge Avern Cohn felt compelled by Ashcroft's subpoenas and Casey's Dec. 31, 2003 order to ask the hospital to produce the records.
"We sought to find a way to produce those records in a way that would not embarrass our patients," Goldman said. "We got an agreement from the government that if we had any records that we could first de-identify them and remove 18 identifiable data entries, hand-deliver them to Cohn in a sealed envelope, which he agreed to send unopened to Casey to determine their relevance to the case."
Johnson and University of Michigan officials searched the records and found he had not performed any of the relevant procedures at the hospital during the specified period. The physician and hospital told Cohn and the Justice Department there were no records to produce.
"But this took a lot of time and effort to accomplish for a case in which we were not involved," Goldman said. "We did not have a dog in this fight. We did it for our patients."
While it's not uncommon for U.S. District judges in different circuits to produce rulings that are at odds, if the 2nd Circuit Court compels the release of medical records, that would create a split between the circuits due to the 7th Circuit Court's decision and could open the door for a U.S. Supreme Court challenge.
Pyles said most troubling to him and his hospital clients is the likelihood of future demands by government agencies requesting medical records. Pyles, who is not involved in the hospital abortion cases, said Ashcroft and Casey are relying on HIPAA as their legal authority for obtaining the medical records. He said that under HIPAA, patient medical records can legally be disclosed in fully identifiable form without redaction of patient names, even though Ashcroft has insisted in court filings that hospitals remove identifying information.
"The HIPAA privacy rule is really a disclosure rule that allows the use and disclosure of identifiable patient healthcare information much more broadly than ever (before) in the history of this country without the notice to, knowledge or consent of patients," Pyles said.
HIPAA precedents in works
The abortion cases are the first under HIPAA to involve court orders and subpoenas, Pyles said, noting that those same abortion records are completely disclosable to insurers as long as they are intended for treatment, payment or healthcare business operations.
"What hospitals and doctors failed to understand when this rule was being amended in August 2003 was that when you eliminate the patients' right to privacy, then you turn the hospitals and doctors into information conduits. And that patient data can be mined," he said.
Pyles said the U.S., inspired by the Hippocratic oath, has a long tradition of respecting the confidentiality of patient medical information and requiring patient consent for its use and disclosure. He said the ethical standards of the American Medical Association, most physician associations and the Joint Commission on Accreditation of Healthcare Organizations all require patient consent for disclosure. But he said the HIPAA privacy rule authorizes that disclosure for routine and other purposes without patient notice and even despite their objections.
Pyles filed a lawsuit last year in a Philadelphia federal court challenging the constitutionality of HIPAA's privacy provisions. That suit was dismissed late last week. "How can a woman having an abortion feel confident her medical records are protected after this?" Pyles said. "Records can be transmitted around the globe in seconds, but we have less privacy protection than we had before HIPAA."
Jill Callahan Dennis, a principal at Health Risk Advantage, a consulting firm, and a privacy expert, said the conflicting court rulings in the hospital abortion cases confuse hospital healthcare information professionals. Dennis said hospitals must learn how to respond to government demands for medical records. "This is putting hospitals between a rock and a hard place," explained Dennis, who said hospitals are routinely asked for medical records by law enforcement agencies. "But this is different. Hospitals are willing to stand up to protect patient privacy, but it's an expensive and laborious process and while patients appreciate it, there is no return on that expenditure of time and money."
She said that with some electronic medical records, data elements can be deleted without much trouble. Some software programs, however, lack those functions. Paper records present an even more onerous challenge. The process of de-identifying medical records to fully comply with HIPAA can be long and tedious work that involves masking 18 identifiable data elements from every page of a medical record that could include hundreds of pages. Failure to completely de-identify a record could expose a hospital to HIPAA violations and significant fines and penalties.
"This puts hospitals at some peril through no choice of their own," Dennis said. "It may astonish patients to know that this rule they believe will protect them actually opens the door for others to examine their personal healthcare information."
Dennis said hospital medical records professionals in charge of releasing that information should be educated about HIPAA to assert patients' rights to privacy. "It looks like we're going to have to be ready for this," she said.
This cover story is the first of a two-part series on patient privacy. The second part of the series will appear in the April 12 issue and will examine how well providers coped during their first year under HIPAA's privacy requirements.
What do you think?
Write us with your comments. Via e-mail, it's [email protected]; by fax, 312-280-3183.