Years ago, one could drive through West Texas and hear reports of who had been admitted to local hospitals on the radio, recalled Fletcher Brown, a partner at Waller Lansden Dortch &Davis.
Now, despite recent cases of Ebola surfacing in Texas, hospitals there and across the country have to be much more tight-lipped about patients' names, diagnoses and conditions under the Health Insurance Portability and Accountability Act, a federal law that, among other things, aims to protect patient privacy.
Indeed, this week, HHS' Office for Civil Rights released a bulletin reminding providers and others of their responsibilities under the law following Ebola's arrival in America.
“The protections of the privacy rule are not set aside during an emergency,” the bulletin says.
In other words, media and the public might be battering down your doors to hear more details about Ebola patients you're treating—but that doesn't change the law. No matter how strenuously others may argue that it's in the interest of public health to disclose as much information about an Ebola patient as you have, HIPAA says differently.
“The big issue is the tension between an individual's right to privacy and then the public welfare,” said Anna Spencer, a partner at Sidley Austin. “It really boils down to what is an individual's right to maintain the confidentiality of their health information versus the public's right to be made aware of threats to their health.”
HIPAA since its passage in 1996 has generally barred doctors, hospitals and insurers from sharing patients' personal information. Hospitals have been allowed only to confirm a patient's general condition—such as good, fair or critical—and, even then, only when asked about a patient by name and only if the patient agrees to be listed on the hospital's directory or is incapacitated and release of that information is deemed in the patient's best interest.
Hospitals can, however, share patient information with public health authorities such as the Centers for Disease Control and Prevention or state health departments so they can take steps to protect the public.
“In that sense, the HIPAA privacy rule already contemplates and strikes a balance between an individual's right to privacy and then the public's right to know and be protected,” Spencer said.
A health authority may or may not be covered by HIPAA, said Deven McGraw, a partner at Manatt, Phelps & Phillips. HIPAA covers health plans, health clearinghouses and providers that conduct one or more covered healthcare transactions electronically, such as submitting claims to a health plan.
If they're not covered by HIPAA, however, they are likely still covered by state laws, McGraw said. State laws generally place some limits on what can be disclosed, but they sometimes may allow release of patient information, for example if the patient is unresponsive or uncooperative about helping authorities track down others who might get sick.
“What the laws typically do is create a default presumption that information isn't sharable, but there usually are exceptions. … It becomes their judgment call,” McGraw said of public health agencies.
A public health authority might also reveal some patient information to a person who's been exposed to the disease, Spencer said.
“It's not going to be effective to identify and track people without giving them some specifics,” Spencer said.
Under HIPAA, providers may share patient information more broadly only if there's an imminent danger, according to the bulletin. Experts agree that doesn't seem to apply in the case of Ebola, which can only be spread through bodily fluids. The bulletin also says the HHS secretary may waive certain provisions of HIPAA's privacy rule during a public health or other emergency, but nothing like that has been declared.
“The provisions are not so broad as to allow massive disclosure of patient names, particularly in circumstances like Ebola where you're not going to contract Ebola just because you stood in the same room with someone,” McGraw said.
Part of the wisdom behind such a provision is not to discourage people who may really be sick from coming forward. If they think their names will be released if they seek treatment, they might hesitate to do so, McGraw said.
“People who may have been exposed and may not be feeling well, what's the likelihood they're going to go get tested for the disease and allow themselves to be quarantined if one outcome of that is their name is broadcast to the general public and suddenly they become a pariah to the community,” McGraw said.
The names of the Ebola patients in America have been circulating, but that's likely because they or their families made that information public, experts say. Nothing in the law can stop private individuals such as family members, neighbors or anyone else from sharing what they know, said Deborah Gersh, with Ropes & Gray.
“You have a free speech right under the Constitution as an individual that the state can't infringe upon absent a very good reason,” McGraw said. “If you find out your neighbor has Ebola and you feel like it's important to tell people, there certainly isn't any law that prevents you from doing that.”
Follow Lisa Schencker on Twitter: @lschencker
