Following Sunday's mass shooting that left 50 people dead and dozens of others wounded, there were reports that the White House waived federal privacy law restrictions that prevent healthcare organizations in Orlando from openly discussing patients cases.
But no waiver was given nor was one required, according to HHS.
"HIPAA allows health care professionals the flexibility to disclose limited health information to the public or media in appropriate circumstances,” according to Kevin Griffis, assistant secretary for public affairs at HHS. “These disclosures, which are made when it is determined to be in the best interest of a patient, are permissible without a waiver to help identify incapacitated patients, or to locate family members of patients to share information about their condition. Disclosures are permissible to same sex, as well as opposite sex, partners."
A waiver would have been rare. One was issued in 2005 after Hurricane Katrina inundated New Orleans and other Gulf Coast communities, destroying medical records in its wake.
HIPAA already gives providers latitude if they choose to use it, according to Kirk Nahra, a partner with the Washington, D.C., firm Wiley Rein and a specialist in healthcare privacy law.
“If the hospital says I'm prohibited by law from telling anybody anything, that's clearly not true,” Nahra. “What you often see in complicated situations like this, it's easier to say no because you don't violate the law if you say no, but it isn't helpful.
“The regulations build in appropriate judgment to be reasonable and compassionate in circumstances like this,” Nahra said. “But then, you have to be sure who you're talking to.”
And that's the tricky part, Nahra said, identifying who has a legal and legitimate connection to the patients.
HIPAA grants permission to hospitals, for example, to create a patient directory, so if a relative called the hospital, staff could say the whether or not that person was a patient, Nahra said. If the person was conscious, the hospital could ask if he or she wanted their condition reported to the person on the phone, or to speak with them.
If the patient is unconscious, it gets a bit more tricky, but "there is a particular (HIPAA) provision that gives the physicain professional judgment."
A national HIPAA waiver was granted to an ad hoc health information exchange, Katrina Health, to create a database of prescription drug information on residents in the disaster area. It enabled refugees from the flooding to obtain electronic copies of their prescription drug records.
Certain HIPAA requirements–for example, the requirement to obtain a patient's agreement to speak with family members or friends involved in the patient's care–can be waived, but only if the president declares an emergency or disaster and the HHS secretary declares a public health emergency.
But no HIPAA waivers have been granted since Katrina, including not after the 9/11 attacks on the World Trade Center and Pentagon, according to Joy Pritts, a privacy lawyer and the former chief privacy officer at HHS.
“I think that most of the time, given that it's been relied upon once, most healthcare organizations realize there are other ways of getting out this information short of a waiver,” Pritts said.