Post Virginia Tech: HIPAA Implications

Walter Olson reviews the implications of Health Insurance Portability and Accountability Act of 1996 (HIPAA) following the Virginia Tech massacre:

Under HIPAA’s terms, doctors and other covered persons who improperly release information about identifiable persons’ health care are subject to fines and even prison terms of up to ten years. That a disclosure is well-meaning rather than malicious is no defence: disclosures to patients’ own parents or roommates, as well as disclosures to other medical or custodial institutions, can very much trigger liability; and the exact scope of what is deemed proper disclosure is by no means precisely defined.

Unintended consequences soon blossomed, in large quantity. Frantic family members dialed emergency rooms in vain seeking confirmation that their unconscious loved ones were there. Preferring to play it safe, some hospitals removed patients’ names from doors. Clergy were ordered not to drop in on ill parishioners unless on specific request. Wider areas within clinics were closed off to unescorted visitors; Santa Claus could drop by only with a proper release form on hand for each ailing child.

Infringement of medical privacy is a lamentable thing, but experience soon suggested that other things can be even worse. After a Washington, D. C. pedestrian was fatally struck by a car, his family learned nothing of it for two weeks until a $17,000 hospital bill arrived in the mail. In rural Colorado, where ambulance dispatchers had been casually accustomed to naming the family whose home needed a run (get over to the Wilson ranch, Vern is having chest pains) it was thought advisable to rely on unfamiliar street addresses instead, leaving drivers to fumble.

In my experience, if a referring clinic knows me they will send a patient's records without requiring written authorization for release of records from the patient. Are they breaking the law by releasing this information to me without a "consent form" being signed?

Technically, I suppose they are.

Yet here we are, forced to comply with a mandate that isn't enforced, has significant limitations, and in many ways limits the quality of health care delivery.

-Wes