John Wisely never thought that the near-drowning of a 2-year-old would be a dead-end story.
The girl, who reportedly had just learned to open doors, went out a back sliding door and fell into a pond behind her house in mid-May. Unable to swim, her mother found her face-down in the pond and rescued her with the help of a construction crew working nearby. The girl was taken to William Beaumont Hospital in Royal Oak, Michigan.
“Everyone is dying to know what happened to the little girl,” said Wisely, a police reporter at The Oakland Press, a daily newspaper in Pontiac, Mich.
But his story ran the next day with little information on the 2-year-old’s condition and without her name.
Wisely’s difficulty in obtaining important information for his breaking news story was the result of new federal health privacy regulations promulgated by the Department of Health and Human Services (HHS) that went into effect April 14, 2003. The regulations – which stemmed from the Health Insurance Portability and Accountability Act, known as HIPAA – are designed to allow individuals access to their own health information and, at the same time, maintain the confidentiality of that information by limiting its use and disclosure only to health providers who need access to the specific information.
The HIPAA legislation was designed to allow individuals to maintain their existing health coverage when they changed or lost their jobs. A section in the legislation includes provisions that standardized means of electronically submitting health information. To ease concerns that the increase of electronic billing would result in less privacy for an individual’s health information, a privacy section was added, instructing HHS to devise regulations that would ensure medical confidentiality. The regulations set the standard that a covered entity – health plans, health care clearinghouses and health care providers who transmit health information in electronic form – is permitted to use or disclose protected health information to the individual and for treatment, payment, or health care operations. When disclosing this information, an entity must make reasonable efforts to disclose the minimum information necessary.
But in the process, journalists say it has had a chilling effect on newsgathering.
Wisely said the privacy regulations are making it more difficult for him to accurately report on important stories to the community.
“It’s definitely changed the way we get information, and, in many cases, it’s totally eliminated getting information,” he said.
The hospitals Wisely routinely contacts have adopted the policy that no information about a patient will be released unless written permission is granted, he said. In the situation with the 2-year-old, the family would not give permission to release information. In fact, the hospital would not even confirm that she was being treated there.
“And I know she’s there because I practically followed the ambulance,” he said.
His story included a statement from a spokesperson that the hospital was prevented from releasing any information as a result of the new medical privacy law.
Instead, Wisely relied upon information from construction crew members who assisted the girl’s mother after she was pulled from the pond.
While the regulations are making it more difficult for a reporter to get information about an accident victim, Wisely said, they are not helping an individual’s privacy.
“[This] forces us to approach families in a way we never did before,” Wisely said. “Before we would have left the family to grieve, but now we’re going to knock on their door.”
THE HOSPITAL DIRECTORY
The new privacy regulations require health care providers – including hospitals – to maintain a directory that includes the patient’s name, location in the hospital and a general description of the patient’s condition. A reporter – as well as anyone else who is seeking out the patient – cannot obtain the directory information without the patient’s name.
“Unless the name goes out on the police scanner, it’s very difficult” for a reporter to get an accident victim’s name, said Jeannie Cross, head of communications for Healthcare Association of New York State, a hospital advocacy group.
This is a big change for newsrooms, where phone calls to hospitals were a large source of information in the past.
Before the HIPAA regulations, getting information from hospitals used be “quite easy,” said Joey Haws, a night editor at the Standard-Examiner in Ogden, Utah.
The Standard covers five counties with three major and several smaller hospitals, as well as a major trauma center. As a reporter, Haws said, he could call Salt Lake City hospitals with only a description of the accident, and the hospital would release the patient’s name, phone number, address and specific condition information.
At McKay-Dee Hospital in Ogden – one of the newest and largest hospitals in Utah – Haws’ phone call often would be transferred to the patient’s room, where he could talk to the patient or the patient’s family members.
“But those were the good old days that we all long for,” he said.
Now, without a name, the hospital will not release any information to Haws or his reporters. With a name, a reporter only will get a general condition.
The regulations are vague, only stating that a patient’s condition can be released. HHS did not issue any guidance, but the American Hospital Association, in February, released updated guidelines to assist hospitals with the new privacy law.
AHA recommends that hospitals use one-word conditions, such as “good,” “fair,” “serious” or “critical” when describing a patient’s condition.
This was the response that Haws encountered in mid-July when he covered a story about a glider that crashed into a hillside with two passengers onboard.
Haws contacted LDS Hospital in Salt Lake City, where the two men were airlifted. After about 10 minutes of being transferred among hospital personnel who told him they could not release any information, Haws was finally told that one of the patients was in “fair condition.”
Instead of relying on hospitals for patient information, Haws said, he and his reporters now must depend on police and fire crews for specifics. For his story about the glider crash, he had to track down the officer who responded to the scene to get specific information on the two passengers’ injuries.
“It’s a matter of changing attributions in my story” from hospital personnel to police sources, he said.
But reporters say the patient’s condition is still important to their story.
“I’ve always looked at a condition report as a period on the end of a sentence,” said Doug Cummings, a weekend crime reporter for WGN Radio in Chicago.
Cummings, who works on a different deadline than print reporters, said he doesn’t have the time to extensively search for a victim’s name.
“I’m at the scene,” he said. “That’s not the place that you’re going to get the name.”
Plus, Cummings said, if he can hunt down a name to call the hospital, now he will use it in his story. In the past, when all he needed was a general description of an accident victim to get a condition update from a hospital, the person’s name would remain unknown and therefore not be used in his story.
“Where’s the privacy?” he asked.
The regulation also allows patients the opportunity to restrict some of the hospital directory information that is released and even opt-out of the directory entirely.
This is the situation that Wisely encountered with the 2-year old near-drowning victim, where the child’s parents opted-out of the directory.
“It’s really difficult to try to tell that story when the family won’t cooperate,” he said.
If the patient enters the hospital incapacitated or in an emergency circumstance, the hospital must exercise its professional judgment about the release of directory information. Once the opportunity arises, a patient must be informed of his or her right to opt-out of the directory.
But some feel as though this can interfere with newsgathering.
“If the mayor was drunk and ran down a line of kids in his car, and he comes into the hospital unconscious, what do you think the hospital is going to say?” asked Cross.
Another concern for reporters is whether a patient’s death can be reported by the hospital – specifically, is it considered a condition for the purposes of the hospital directory? Deceased patients still maintain their privacy rights under the new regulations.
HIPAA does not define general condition in its regulations; however, AHA stated in its guidelines, “(d)isclosing that a patient is deceased … appears to be a permissible facility directory disclosure as a statement of the patient’s general condition.” But, AHA cautioned, the hospital cannot release any further information, such as the date, time or cause of death.
Media advocates say that HHS, when writing the regulations, misunderstood what information is personal and should be protected.
“Reporting what happened to someone who is injured or sick is not intimate personal information, it is event information,” and the community has an interest in knowing, said Alice Neff Lucan, a lawyer who advises media organizations.
Reporters agree that the restrictions on hospital information do not preclude them from getting information. It just makes other sources, such as police and fire officials who were at the scene of an accident, more important to their story.
But with the possibility of a hefty fine and jail time for noncompliance, many agencies, unsure of whether they are bound by the HIPAA regulations, are being overly cautious.
CONFUSION ABOUT WHO IS COVERED
The regulations apply to health plans, health care clearinghouses and health care providers who transmit health information in electronic form. HIPAA calls them covered entities.
It is pretty clear that a hospital is considered a covered entity, but there is confusion about many prehospital providers – such as EMS or fire – who may give initial treatment and transport an accident victim to a hospital for further care.
The problem is that while these entities do provide health services, as with firefighters, it is often not their primary job responsibility. Does being an incidental health care provider mean that the part, or even the entire, entity must comply with HIPAA?
“I think with police departments it’s pretty clear that they are not covered, but it gets a little trickier with fire departments,” said Molly Hemsley, director of governmental affairs and legislative counsel for the Newspaper Association of America. “The trigger is electronically submitting health information. Police departments do not submit a bill for performing CPR on the scene.
“I can’t say that as emphatically about ambulance services,” Hemsley said.
In the case of Wisely’s story about the 2-year-old who nearly drowned, Wisely, unable to get information from the hospital about the girl’s condition, contacted the fire department, who treated her briefly.
The fire chief with whom Wisely spoke would not release any information about the girl’s condition, saying he did not know what information he was allowed to release to reporters under the new privacy regulations.
The regulations create what is called a “hybrid entity,” which is an entity that conducts both covered and noncovered functions. A fire department, if it transmits electronic health information, could fall under this definition. That entity, the regulations say, has two choices: It can either designate, in writing, the operations that are covered, and that piece of the entity can then comply with HIPAA. Or the entire entity must comply.
Sounds simple. But in reality, it’s caused a lot of confusion. And, like Wisely’s encounter with the fire chief, many people are unwilling to speak with reporters until they figure out whether they must comply with HIPAA.
“A lot of people are taking the approach that you can’t go wrong under HIPAA by being more stringent,” Cross said.
Some reporters said they believe that these departments are using the regulations as another excuse not to talk with the media.
“Whenever you have regulations that are restrictive, the departments that don’t want to talk to the press will use them” to their advantage, Cummings said.
“What reporters are going to have to become sophisticated about is those who are hiding behind (the regulations) and those who are not,” said Tonda Rush, the National Newspaper Association’s director of public policy in Washington.
Whether or not a fire chief can speak with the media makes a huge difference in reporting, especially now that HIPAA restricts how much information a hospital can release and reporters must use secondary sources to supplement bare hospital information.
For example, if there is a fire in a house, and HIPAA is strictly applied, all that can be said is “family of five affected by fire,” said Lucan.
But if the fire department clearly acts as a hybrid entity, the fire chief or public information officer at the scene can speak with the press.
“If the fire chief is making an effort to collect information at the site without going through emergency medical service, (he) may be able to provide more information,” such as the family members’ names and what the injuries were, Lucan said.
Reporters say that they have to rely on fewer sources, especially when fire departments are reluctant to release information.
“Its effects have not been devastating,” said Eric Olson, municipal reporter at the Northwest Herald in Crystal Lake, Ill. “The law has made having police contacts infinitely more important because you can no longer get any meaningful information from firefighters or paramedics.”
DISASTER REPORTING AND PUBLIC HEALTH EMERGENCIES
While HIPAA’s effect is being felt on a daily basis by police reporters, what is still uncertain is the regulation’s effect on disaster reporting.
Incidents such as the Chicago porch collapse in July and public health concerns about SARS have been in the news since HIPAA began enforcement, but another Sept. 11 or Oklahoma City bombing will truly test the limits of HIPAA and its hold on health information.
HIPAA does allow de-identified health information to be released. But information is considered de-identified only when all identifiers are removed. This includes names, any geographic subdivision smaller than a state and all elements of dates.
This limitation has been demonstrated only on small-scale disasters, where a number of hospitals have made policies to deal with these events.
One such hospital is Banner Health, a health care system headquartered in Arizona and located throughout seven other Western states. In a mass-casualty event, the hospital would provide information to a public health agency for the purposes of notifying family members of the condition and location of an injured patient, said Pat Henrikson, Banner’s privacy officer.
The media would not be able to receive any specific information, she said.
“In other extraordinary situations such as disasters, where the public may benefit from releasing general information and specific information is not releasable, our public relations staff would release something like, ëour facility is treating four individuals or 20 individuals as a result of an explosion.’ “
The hospital also can give information such as the number of males and females, as well as how many are children, teenagers and adults.
“We can share information in those grouping or summary information” so the general public can know what is going on, Henrikson said.
But at least one health association member said the privacy regulation may not be preferred in these situations.
Cross of New York state said that one hospital did have a suspected case of SARS.
In the public interest, the hospital should have been able to confirm that they were treating a suspected SARS patient and let the community know that the person is in isolation, that the staff had taken precautions, and informed them of symptoms, she said.
Sarah Lechner was a summer Pulliam/Kilgore legal intern with Baker & Hostetler, SPJ’s First Amendment law firm in Washington, D.C.
