HIPAA as a hurdle

Every hospital and healthcare facility has some variation of this sign: “It's the law. Be careful not to discuss patients in public.” Like World War II posters warning that “Loose lips sink ships,” these notices stress that information falling into the wrong hands can lead to disaster. Staff training that emphasizes the punitive consequences of improper disclosures of protected health information reinforces this caution.

The source is, of course, HIPAA, the federal Health Insurance Portability and Accountability Act. As a longtime advocate for patients' rights, especially the right to privacy, I am chagrined that a law intended to protect patients' medical information is so often used as a bar to communication.

And even with my knowledge of what the law really says, I was waylaid by HIPAA when I was denied permission to accompany my sister, who was suffering severe pain, into the office with the triage nurse in an emergency department. My sister practically begged the nurse to let me come with her. Not a chance. But later, when my sister was on a gurney in the ED corridor for two days, patient privacy was absent. We couldn't help but hear about everyone's medical, financial and relationship problems.

At a time when “patient engagement” and “person- and family-centered care” are buzzwords in healthcare, it is an unfortunate reality that a family member has to leap over a HIPAA barrier to become engaged. The irony, of course, is that patients with complex medical needs are discharged from hospitals to the care of untrained and unprepared family members and all too often are readmitted because of failures in communication around discharge planning.

HIPAA is often presented as a series of “don'ts.” And there are good reasons to establish strong security protections and procedures that prevent disclosure to individuals and groups that want this information for reasons that have nothing to do with patient care. After a yearlong examination of cybersecurity and vulnerability to hackers, the Washington Post concluded that healthcare is among the most vulnerable industries in the country, in part because of aging technology and failures to fix known software flaws.

But HIPAA's strong statements about permissible disclosures are often overlooked. When family members ask about a patient's test results, condition, or follow-up care, they may be told, “I can't tell you because of HIPAA.” But here is what HHS' Office for Civil Rights, responsible for monitoring HIPAA, says: “The HIPAA Privacy Rule at 45 CFR 164.510(b) specifically permits covered entities to share information that is directly relevant to the involvement of a spouse, family members, friends, or other persons identified by a patient, in the patient's care or payment for healthcare.” The one caveat: Information cannot be shared if the patient objects.

Of course, this statement doesn't answer all the questions, such as what to do when the patient cannot communicate (information can be shared if it can reasonably be inferred that the patient would not object). The Office for Civil Rights typically defers to professional judgment and experience with common practice in making decisions about the patient's best interests.

There are boundaries, however. Sharing of information should be limited to a few people who the patient identifies or have been identified as directly involved in care. These designated individuals can share information with other family members as they choose. Then, when long-absent Cousin Joe calls and demands to know what is being done to his beloved Aunt Mary, he can be told to contact the designated family member. And the information that can be shared should be limited to the current condition and patient needs. No need to go back 20 years to report an STD or a clinical depression.

HIPAA rules have been periodically updated since they went into effect in 2003. In the most recent revisions, the most significant changes involved the incorporation of the Health Information Technology for Clinical and Economic Health Act, or HITECH, into HIPAA, which significantly increased its enforcement provisions, especially around security and transfer of electronic protected health information. There were no changes regarding sharing information with family or others identified by the patient.

Here are some suggestions to ensure compliance with HIPAA's don'ts and its permissible disclosures:

• Convene a group of senior leaders and staff to review relevant elements of the organization's privacy policies and practices. This should include any specific practices that deviate from the basic HIPAA rules (requiring written consent, for example, for disclosures to family members).
• If this discussion reveals concerns or contradictions, establish a task force to come up with suggestions based on the organization's mission and practice.
• Encourage staff training (or retraining) on HIPAA and HITECH so that all staff follow the same principles and rules.
• Create a simple statement of the organization's policy and practices for patients and families. The United Hospital Fund's Next Step in Care family caregiver guide to HIPAA may be useful.
• Discuss cases that present challenging issues with the organization's privacy officer before taking any action. Raising potentially serious problems is an important step in reducing HIPAA violations and in protecting the institution as well as patient privacy.