PRIVACY/HIPAA RELATED QUESTIONS AND ANSWERS
PERTAINING TO RELEASE OF PATIENT INFORMATION TO NEWS REPORTERS

Updated September 2002

Under Ohio's public records law, the public has the right to access information regarding births, deaths, admissions and discharges from hospitals deemed public entities. Under the HIPAA privacy regulations, however, this component of Ohio's public records law would be preempted since it provides for more access to protected information than HIPAA. HIPAA allows a hospital to develop a facility directory that contains only the following information: the patient's name, location, and the patient's condition described in general terms that does not communicate specific medical information (i.e., the condition can be described as "fair", "critical", etc.). The hospital may also include the religious affiliation of the patient if the patient wishes it included. Note, however, that it is optional for the hospital to even include the religious affiliation.

Each patient, during the registration process, must be informed of the existence and use of the facility directory and given an opportunity to "opt-out" of being listed or to place restrictions on what information is included and/or to whom it is provided. If the patient has not opted-out of being listed or otherwise restricted the type of information included or the persons to whom it may be given, the hospital can release the directory information to any person who requests the information by the name of the patient; in other words, if someone asks for information about Mary Smith, the information may be provided. Hospitals are not permitted to give out information if the caller merely asks "who has been admitted in the last hour." In addition, if the hospital collects religious affiliation information, that information may only be shared with members of the clergy.

Although this information may be deemed "public information" under Ohio's public records law for purposes of information that must be released by public entities, such as government owned and operated hospitals, the HIPAA privacy regulations will preempt any state statutes which are less stringent than HIPAA in terms of protecting privacy. Thus, whether your organization is a public entity or not, this information should not be released to news reporters except as may be allowed in directory information under HIPAA.

No. There are numerous reporting statutes in most states which deal with reports for everything from child abuse to gunshot wounds. However, the fact that a hospital has an obligation to report certain confidential information to a governmental agency does not make that information public and available to news reporters. In addressing questions from news reporters regarding such information, the hospital may want to refer the reporter to the public entity which receives such reports such as the police, fire or health department. The public entity will be guided by the applicable statute as to whether they can release any or all of the information received.

This practice requires discretion. The regulations provide that if the opportunity to "opt-out" of the facility directory listing cannot practicably be provided due to the patient's incapacity or emergency treatment situation, the facility may use and/or disclose some or all of the allowed information if such use/disclosure is consistent with a prior expressed preference of the patient that is known to the facility or if such use/disclosure is considered in the best interest of the patient as determined by the facility. In these cases, the patient should be informed of the use/disclosure as soon as it is practical to do so.

The commentary to the rule encourages facilities to take the following into account when deciding whether to include some or all of the patient information in the directory:

• Whether disclosing that an individual is in the facility could reasonably cause harm or danger to the individual (e.g., if it appeared that an unconscious patient had been abused and disclosing the information could give the attacker sufficient information to seek out the person and repeat the abuse);

• Whether disclosing a patient's location within a facility implicitly would give information about the patient's condition (e.g., whether a patient's room number revealed that he or she was in a psychiatric ward);

• Whether it is necessary or appropriate to give information about patient status to family or friends (e.g., if giving information to a family member about an unconscious patient could help a physician administer appropriate medications); and

• Whether an individual had, prior to becoming incapacitated, expressed a preference not to be included in the directory.

The fact that the media may know the name of a patient who may, for example, have been involved in an accident or a crime, does not give them any additional rights with respect to confirming the patient's treatment, admission, or other patient related information. The only rights they would have would be with respect to information contained in the hospital directory to the extent the patient has not limited or opted out of having that information made available.

While the HIPAA privacy regulations restrict the information health care providers may release, patients are free to release their own personal information or to consent to interviews providing it does not interfere with their medical treatment.