HIPAA

The Health Insurance Portability and Accountability Act’s (HIPAA) medical privacy regulations govern the use and release of a patient’s personal health information, also known as “protected health information” (PHI). According to HIPAA, patient information needs to request patient by name and only the following information can be placed in a hospital directory.

• The patient’s name
• The patient’s location in the health care provider’s facility
• The patient’s condition, described in general terms, that does not communicate specific information about the individual
• The patient’s religious affiliation

Patient Condition Reports and Information
Patient condition may be provided consistent with HIPAA privacy standards. If an inquiry is made using the patient’s name, general condition information may be provided that does not communicate specific information about the individual. The American Hospital Association has suggested the following one-word descriptions of a patient’s general condition.

• Undetermined – Patient awaiting physician assessment
• Good – Vital signs are stable and within normal limits. Patient is conscious and comfortable. Indicators are excellent.
• Fair – Vital signs are stable and within normal limits. Patient is conscious but may be uncomfortable. Indicators are favorable.
• Serious - Vital signs may be unstable and not within normal limits. Patient is acutely ill. Indicators are questionable.
• Critical – Vital signs are unstable and not within normal limits. Patient may be unconscious. Indicators are unfavorable.
• Treated and Released – Received treatment, but not admitted.
• Treated and Transferred – Received treatment, transferred to a different facility.
• Expired – Release of information about a patient’s death should not be released until efforts have been made to contact the next of kin. Information about the cause of death must come from the patient’s physician, and a legal representative of the deceased must approve its release. Hospital representatives cannot share information with the media on the specifics about sudden, violent or accidental deaths, or deaths from natural causes, without the permission of the decedent’s next-of-kin or other legal representative.

Minor Children
HIPAA guidelines are meant to preserve current state laws regarding minors. Generally, minor children (under the age of 18) may have information released with the consent of a parent or legal guardian, in accordance with the preceding guidelines.

Emergency Circumstances
The covered health care provider must provide patients with the opportunity to object to the use and disclosure of directory information, when feasible. When this opportunity cannot be practically provided because of an individual’s incapacity or emergency treatment circumstance, a covered health care provider may use or disclose an individual’s information in the hospital’s directory if the use or disclosure is consistent with a prior expressed preference of the individual’s best interest as determined by the covered health care provider, in the exercise of professional judgment. Both conditions must be true for a provider to release patient information contained in the hospital’s directory under HIPAA.

Disasters
Hospitals or other covered entities, pursuant to the HIPAA privacy regulations, may disclose information regarding a patient’s health to a pubic or private entity authorized by law to assist in disaster relief efforts. Information may also be released to these types of organizations for the purpose of coordinating with such entities in contacting a family member, personal representative or person directly responsible for a patient’s care. Please see the crisis communications plan for specific disaster information.

Media Access to Patients
When the media requests to interview or photograph a patient, the Marketing Communications representative or other authorized spokesperson should check with the patient and patient’s physician to determine if the patient is physically and emotionally capable. The hospital spokesperson must obtain the patient’s permission using the approved release for information form. If the patient is a minor, permission must be obtained from the parent or legal guardian. If the patient is under arrest, permission also must be obtained from the law enforcement officer in charge of the patient’s custody.

When in any BHC facility, media representatives should be accompanied by a member of the Marketing Communications staff at all times.

Public Information
Police reports and other information about hospital patients are often obtained by members of the media. However, health care providers are still required to observe the general prohibitions against releasing health information about patients that are found in the HIPAA privacy standards, state statutes or regulations, and the common law, regardless of what information is in the hands of public agencies or the public in general.

Media members may be referred to www.hhs.gove/ocr/hipaa for further information.