Las Vegas hospitals must follow regular HIPAA privacy rule

After natural disasters, HHS sometimes waives certain HIPAA privacy rule requirements. That's not usually the case after man-made disasters, such as Sunday night's massacre in Las Vegas, where more than 50 were killed and hundreds were wounded after a gunman opened fire at a music festival.

Because the HIPAA privacy rule already allows information disclosure in certain cases, such as when public safety is threatened, and because there has been no declaration of a public health emergency, HIPAA waivers have not been necessary in this case.

Local hospitals will have to be careful, especially with so many requests for information from families, friends, and the media, said Mark Swearingen, a Hall Render attorney focused on health information privacy and security.

"Hospitals are going to have to be very careful about vetting and authenticating the individuals who might be calling in to make sure that they're the type of person they can be sharing information with," he said.

After Hurricane Harvey struck Texas in August, HHS Secretary Dr. Tom Price waived certain HIPAA penalties, which can range from $100 to $50,000 per violation. Providers would not be penalized for failing to giving out notices of privacy practices, for instance, nor would they be hit for not granting a patient the right to request privacy restrictions.

Meanwhile, other provisions of the HIPAA privacy rule were still in effect, including those that allow providers to disclose protected health information to patients' families or others involved in their care. Other provisions allow providers to give out protected health information—including to law enforcement—if doing so would lessen a threat to those patients or to the public.

Given those rules, "when you have a shooting, the department has taken the position that a waiver isn't necessary," said Marcy Wilder, a privacy and cybersecurity lawyer with Hogan and Lovells, noting that no penalties were waived after the 2016 mass shooting that killed 49 people and injured 58 at Orlando's Pulse nightclub. "The department wants to be careful here, because if you issue a waiver, that becomes a suggestion that without a waiver, these types of disclosures aren't permitted," she added.

Swearingen warns that Las Vegas hospitals therefore need to be cautious. "The hospital, I would hope, in this circumstance is going to be fairly guarded."

The Las Vegas police has asked those trying to locate people in Las Vegas to call 866-535-5654.