The U.S. House Energy and Commerce Subcommittee on Oversight and Investigations held hearings last month surrounding issues with the release of information under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). According to the Department of Health and Human Services (HHS), the HIPAA Privacy Rule, one of five rules regarding Administrative Simplification under Title II of the act, was designed “to create national standards to protect individuals’ medical records and other personal health information.”
The rule was issued by HHS, and covered entities were ordered to comply by 2003, to set national standards to “address the use and disclosure of individuals’ health information” and for individuals “to understand and control how their health information is used.” The Office for Civil Rights (OCR) has responsibility for implementing and enforcing the Privacy Rule with respect to voluntary compliance activities and civil monetary penalties.
The basic principle of the rule is “to define and limit the circumstances in which an individual’s protected heath information may be used or disclosed by covered entities.”
Barry Haimo, a South Florida estate planning attorney, says there are four documents everyone should prepare to avoid any confusion: A living will, a healthcare surrogate, durable power of attorney and a HIPAA release form.
“(The HIPAA release form) is something you want to include in your estate planning documents,” said Haimo. “Unless you engage in estate planning then you are not going to be able to override these laws unless there is a specific exception that has been carved out.”
Without a release form, parents are too often unable to learn of their children’s critical addiction and mental health problems, particularly as they enter adulthood. The release of information — or lack thereof — fundamental to effective health care is at the heart of Gregg Wolfe’s personal tragedy.
Wolfe, who testified before the House subcommittee, lost his son, Justin, a Temple University student, in December 2012 to an accidental heroin overdose at the age of 21. At least two of Wolfe’s son’s three doctors were made aware of his heroin use. However, Wolfe and his son’s mother were not.
“With the HIPAA regulations, if I would have known, and would have been apprised that he was doing heroin, a whole different strategy would have been proposed and mandated as far as him getting the proper care that he deserved and needed,” said Wolfe.
He says the danger to the patient or others caused by these health problems should take precedence over all else. Wolfe pointed to at least three examples of his son’s behavior that could have endangered others, including a time when he fell asleep with a cigarette in his hand that left burn marks and could have caused a fire in his apartment. Days before his passing, Wolfe said Justin was driving “a little recklessly” with his youngest son in the car, presumably under the influence of heroin.
“He could have taken out my son’s life — my other son — he could have taken out other people’s lives, not realizing what he was doing, not being malicious,” Wolfe said.
Months prior, Justin told his father that he wanted to acquire a Pennsylvania state driver’s license to purchase a gun. Wolfe would not allow it.
“Not knowing that he was on heroin, but because there was no reason for him to have a gun,” said Wolfe. “Now, picture an individual on heroin and them not being of sound mind — or any mental disorder — and that’s where the problems have come in our society.”
There was a consensus at the hearing that the current laws in place allow the release of this kind of information. However, Wolfe said the law needs more clearly defined language. At the time of his death, Wolfe’s son was covered by his father’s insurance as part of the Affordable Care Act that had gone into effect allowing children to stay on their parents’ health care insurance until the age of 26.
“We should have an exception where the parents or legal caretakers of a minor or emancipated adult with drug abuse or mental health histories who continue to cover them with health coverage or continue to support them financially, have access to their health care records until the age of 26 to prevent them from harming themselves or society,” he said.
HIPAA has made confidentiality its highest priority, but its detractors point to its ambiguity. The law is too often left open to interpretation by health care providers and administrators. In fact, according to the Capitol Hill testimony there is a lack of information available, and many doctors are unclear about where their safe harbor lies. They, and other administrators, remain defensive and frustrated 10 years after the rule’s enactment, wary of fines of up to $11,000 per violation and punishment from the federal government. They are also left unsure about how to interpret the language.
For example, it is widely understood that health information can only be disclosed with the individual’s written authorization by way of a HIPAA consent form. However, under HHS’s “Permitted Uses and Disclosures,” doctors can and should communicate to a patient’s family if there is serious risk to health or safety or imminent danger of harm to oneself or others. In fact, HIPAA provides “clear authority” in these instances according to the testimony of Leon Rodriguez, Civil Rights Director of HHS, if the patient’s health would be seriously adversely affected.
“HIPAA recognizes that professional codes, state laws, professional standards of care recognize a duty and authority to warn of situations where a patient may pose a danger to themselves or others, or may have disclosed information indicating a threat by another to either themselves or a third person,” said Rodriguez.
“In those cases where there is a serious and imminent risk of harm to health or safety, HIPAA has a clearly recognized exception for disclosure in those cases. When I say an imminent risk to health or safety, it is not simply the scenario of an individual going out to commit a violent crime, but in fact, it covers a number of possible scenarios that a health care provider, particularly a mental health care provider, may encounter. We take our obligations to educate providers and patients on these flexibilities seriously.”
There is also the issue of mandatory obligation to report versus the idea of permissive disclosure. Professional codes and state laws are sometimes in conflict with HIPAA, leaving gray area and uncertainty for providers, but Rodriguez assured them that disclosing this information is compliant with HIPAA, particularly as it pertains to a “Duty to Warn.”
“It’s one of the issues that the drafters of our rule in this area were attempting to tackle. We are talking about both duties and authorities to warn. When we are talking about the (1976 case of Tarasoff v. The Regents of the University of California) example there we are talking about an actual duty to warn or to protect.
“HIPAA is really meant to get out of the way of those duties and authorities and to clear a wide enough lane for those duties and authorities to be utilized and implemented by providers and for professional judgment to really be the hallmark of when disclosure occurs.”
OCR has placed more of an emphasis on the protection of the confidentiality of electronic health information which covered entities were required to comply with beginning in 2005 — known as the Security Rule — and less on enforcement of use and disclosure issues, the Privacy Rule. In fact, OCR first and foremost will work with the entity to correct the deficiency involved in an alleged HIPAA violation, but the fear of violating the HIPAA law persists in the health care community.
Misinformation combined with fears of punishment from OCR has left covered entities with a misconception of HIPAA’s privacy rule, but Wolfe hopes something will get done to avoid another parent having to suffer the loss of a child.
“There are circumstances involved when you have mental disorders and addictions when people are not of their right, sound mind,” he said. “In those cases, there must be an exception to avoid threats or harm to society and to the persons themselves.”
“Can we save more lives by preventing it and knowing the situation? The answer is yes.”
