Health Information Compliance Alert

There was a wide range of reader questions this month, so we tried to single out a few HIPAA doozies. Sit back and relax as Brian Gradle, HIPAA expert and attorney with the Washington office of Hogan & Hartson, answers your compliance queries. 
  

'Marketing,' 'Research' - or Just Plain QA?

Question: I work for a chemical dependency care facility, and we're considering creating new services and products, but we'd like former patients to provide input on what they found most useful to them. Is contacting former patients for the purpose of creating new products/services considered "market-ing" under HIPAA?

Answer: The answer to this question depends on how you're planning to use a patient's protected health information and what you're planning to contact these former patients for. "It's certainly permissible for a provider to use an individual's PHI to talk with them about treatment or services or products that they offer, just like an insurance company can contact its members to tell them about a new benefit or something of that nature," advises Gradle. 
 
Where you can get into trouble is if you're using peoples' health information to contact them about something unrelated to that treatment, or for a more commercial enterprise like fundraising, says Gradle. But HIPAA doesn't prohibit you from talking treatment with former patients.

PHI Disclosure and The Badge

Question: Here's a hypothetical situation, but one that happens all too often: A traffic accident sends several people to the hospital. A state trooper arrives at the emergency room and asks for information on the victims brought in, explaining that they are believed to be involved in a hit-and-run. What's the minimum amount of info we can give the trooper and still be in compliance with the privacy rule?

Answer: Take a look at 164.512 of the final privacy rule; that's where the law enforcement provisions are located. Section 512 (F)(3) pertains to this question and reads, "except for disclosures required by law as permitted by paragraph (F)(1), a covered entity may disclose protected health information in response to a law enforcement official's request for such information about an individual who is or is suspected to be a victim of a crime." 
 
So, if someone was in a hit-and-run accident and a law enforcement officer asked for info about the individual, you may hand over PHI if the individual agrees to a disclosure. If the individual is incapacitated, then you'd want to speak with someone there who had the legal standing to represent that individual in that context, says Gradle. "And a lot of that is going to be determined by state law, so wherever the CE is located, it needs to look at state law to see what the law says in terms of incapacitation," he adds. "It could very well be that the incapacitated victim's spouse says that under no circumstances is the entity to provide that information to anyone."

A Marriage of...... compliance?

Question: How does HIPAA affect married couples? Does HIPAA allow for more disclosure to a spouse than to a stranger, assuming no specific waiver or authorization has been signed?

Answer: As a matter of fact, HIPAA does affect married couples differently, notes Gradle. For example, if a spouse goes to a meeting with a physician and the physician is talking to both spouses about the patient's condition, it is legitimate for the physician to conclude that the patient has agreed to disclosures to that spouse about his condition. There's an entire section of the privacy rule ( 164.510) that deals not only with spouses, but also with family members and friends. Gradle calls this section 'HIPAA-lite' because it doesn't require written authorization but it requires at least the opportunity for the individual to object orally. And the rule is not limited to spouses - it could also include close friends or a close companion of some kind.
 
There are no greater rights for a spouse compared to those of a close companion, other than the fact that when the covered entity looks at whether the individual was the personal representative or not, that is largely determined by state law, so frequently with the incapacitation of the spouse, the remaining spouse is deemed to be the personal representative, and HIPAA recognizes that, Gradle explains.