NEWSLETTER Volume Three Number Twelve December, 2007 Blood Alcohol Testing, HIPAA Privacy and More Although the HIPAA Privacy regulation has been in existence for many years, lawyers continue in their efforts to have the courts apply the rule in ways not intended by regulators. Judicial decisions have made clear, however, that HIPAA does not create a basis for private litigation. A recent Wisconsin case 1 demonstrates another way in which lawyers want to use the HIPAA Privacy Rule: in suppression of blood alcohol level evidence obtained from a patient who received treatment in the hospital setting. What is acceptable practice under the HIPAA Privacy Rule? How does this federal rule relate to state law when it comes to information that may be used in a criminal case involving a patient? The Wisconsin case exemplifies the importance of knowing the rules and what is permissible in terms of information exchange between healthcare professionals in a hospital setting and law enforcement representatives. The Wisconsin Case. Early in the morning of May 16, 2006, E.S. was seriously injured when she ran a red light and her vehicle was struck by a semi-trailer. E.S. was transported to a hospital by helicopter for treatment. A police detective, J.B., went from the scene of the accident to the hospital to obtain a statement from E.S. The patient was incoherent. 2 The detective spoke with a nurse treating E.S. He asked the nurse if the patient s incoherent manner was a consequence of the injury sustained during the accident. The nurse told the detective that E.S. had sustained a massive injury to her left eyethat resulted in blindness and that the patient possibly had sustained a concussion. RMS NEWSLETTER ALL RIGHTS RESERVED 2007 PAGE 1
The nurse went further, telling the detective that she and other members of the hospital staff had smelled alcohol coming from E.S. Further, she indicated that E.S. had told hospital personnel that she had consumed alcohol prior to the accident. 3 E.S. gave consent to drawing a blood sample that was completed and sent to a state laboratory for analysis. The laboratory reported a blood alcohol level of 0.119 grams per 100 milliliters of blood. 4 On January 19, 2006, E.S. had been convicted of operating a motor vehicle while intoxicated and operating a moving vehicle with a prohibited blood alcohol level. Based on the results of the May, 2006 blood test, E.S. was charged with second offenses for both of the previous convictions. 5 Legal counsel representing E.S. sought to suppress the information shared by the nurse with the police detective. The attorney claimed that the action of the nurse was illegal and without her dissemination of medication information, the police would not have had the required probable cause to seek a blood test. The trial court denied the motion to suppress the evidence and E.S. appealed. 6 The case was then heard by the Court of Appeal of Wisconsin. E.S. argued that by sharing medical information with the detective, the nurse had violated both HIPAA privacy requirements and Wisconsin state law. As such, she claimed that these violations of health care privacy laws gave rise to the legal remedy of suppressing the evidence in the criminal case. For its part, the prosecution acknowledged that if the information shared by the nurse was suppressed it could not establish probable cause for the arrest and the blood test results would be inadmissible. 7 Legal counsel for E.S. tried to argue that the police used improper tactics to obtain her medical information. In essence, the lawyer tried to argue that the police were subject to HIPAA and state privacy requirements. These arguments were rejected by the appellate court. As the Wisconsin court noted, HIPAA does not make law enforcement officials covered entities for purposes of the privacy requirements. Even assuming that the detective was subject to HIPAA, it does not create as a remedy suppression of evidence in a state criminal case. The only time suppression of such evidence would be appropriate is when the information is obtained either in violation of a defendant s constitutional rights or legislation specifically denotes evidence suppression as a remedy. 8 RMS NEWSLETTER ALL RIGHTS RESERVED 2007 PAGE 2
E.S. did not claim a constitutional violation. Moreover, it was made quite clear that HIPAA legislation did not create evidence suppression as a remedy. E.S. also claimed that HIPAA preempted Wisconsin state law. This was an important argument, since Wisconsin legislation stated that There is no privilege concerning the results of or circumstances surrounding any chemical tests for intoxication or alcohol concentration. 9 Other Wisconsin laws provided remedies for violations of state privacy legislation. However, these legislative remedies did not include suppression of evidence. The appellate court provided a detailed framework for its legal analysis. It noted that Wisconsin legislation defined patient health records as all records related to the health of a patient prepared by or under the supervision of a health care provider. 10 The protection afforded by the statute applied to health records. It did not encompass the verbal statements made by the nurse that were based on her observations of E.S. Moreover, even if one were to assume that the nurse s statements violated HIPAA and the Wisconsin privacy law, suppression of evidence was not an appropriate remedy under applicable legislation. 11 Observations on the Wisconsin Case. The Wisconsin court decision is consistent with similar cases in other jurisdictions. The HIPAA Privacy Rule does not create a legal remedy that would involve suppression of evidence in a criminal case. This was noted by the Department of Health and Human Services in the Preamble to the HIPAA Privacy rule in December, 2000: We shape the rule s provisions with respect to law enforcement according to the limited scope of our regulatory authority under HIPAA, which applies only to the covered entities and not to law enforcement officials. We believe the rule sets the correct standards for when an exception to the rule of nondisclosure is appropriate for law enforcement purposes. 12 On the specific issue of evidentiary suppression and HIPAA Privacy, the Department of Health and Human Services said in the Preamble: After-the-fact sanctions are important, but they are effective only RMS NEWSLETTER ALL RIGHTS RESERVED 2007 PAGE 3
when coupled with laws that establish the ground rules for appropriate behavior. That is, a sanction applies only where some other rule has been violated. This regulation sets such basic ground rules. Further, under the HIPAA statutory authority, we cannot impose sanctions on law enforcement officials or require suppression of evidence. We must therefore rely on rules that regulate disclosure of protected health information by covered entities in the first instance. 13 Each state has legislation that controls the dissemination of patient information and health care record details to law enforcement personnel. What was discussed in the Wisconsin case may not reflect what may be found in other state laws on the subject of disclosure of patient information to the police. The HIPAA Privacy Rule is at times a confusing maze of regulatory language. As the Wisconsin case suggests, it is not the last word on what and how patient information can be shared with law enforcement personnel. As if it anticipated that there could be confusion, the Department of Health and Human Services offered the following insight in the 2000 Privacy Rule Preamble: we allow disclosure of protected health information in response to a law enforcement inquiry where law enforcement is seeking to identify a suspect, fugitive, material witness, or missing person, but allow only disclosure of a limited list of information. Similarly, it is in the public interest to allow covered entities to take appropriate steps to protect the integrity and safety of their operations. Therefore, we permit covered entities on their own initiative to disclose to law enforcement officials protected health information for this purpose. However, we limit such disclosures to protected health information that the covered entity believes in good faith constitutes evidence of criminal conduct that occurred on the premises of the covered entity. 14 For every nuanced difference found in the facts of a given circumstance, the opportunity exists for legal counsel to pursue a claim that his or her client s case is different. Thus it can be anticipated that new lawsuits will occur involving HIPAA Privacy, state law, and sharing information with law enforcement. The Other Laws to Consider Involving Patient Health Information. There are other federal and state laws that should be considered when deciding what and how patient-specific information may be shared with law RMS NEWSLETTER ALL RIGHTS RESERVED 2007 PAGE 4
enforcement. The Wisconsin case focused on the observations of a nurse and an attempt to suppress the results of a blood alcohol test. But what if the facts involved suspicion of illegal drug use, statements made by an agitated patient purportedly identifying an assailant, drug dealer, or visual evidence of a brutal beating? Does this come within HIPAA or do other laws apply to the situation? There are other federal laws that involve patient health information and privacy. Those that are most often the subject of inquiry in the healthcare setting involve regulations governing disclosure and re-disclosure of treatment records for alcohol, drug and substance abuse. 15 Other provisions under the federal Family Educational Rights and Privacy Act or FERPA allow schools to disclose information from a student's educational record without consent in cases of health and safety emergencies. 16 As seen in the Wisconsin case, state law also includes a host of legislation and regulations that protect the privacy of health information. However, exceptions do exist that permit or require disclosure of health information whether it involves observations made by healthcare providers or details recorded in a health record. The point is that HIPAA is not the sole legislative or regulatory source guiding what and how health information can be shared with law enforcement personnel. These laws go well beyond seemingly straightforward issues such as observations about a patient s status and a blood alcohol level test. The key is for healthcare providers to know what to do in specific situations. Risk Management Strategies for Sharing Patient Health Information with Law Enforcement Personnel. There are some practical risk management strategies to consider in designing a framework for sharing patient information with law enforcement authorities. These include the following: 1. Develop a Matrix on Information that May Be Disclosed. Design a matrix style chart of information that provides clear cut direction for staff regarding disclosure of confidential or private patient information to law enforcement personnel. Consider the following categories for the matrix chart: a. Mandatory reports - for example, child abuse, elder abuse and other legislatively-required reports. b. Reports required or authorized by court order a valid court order may compel release of information. RMS NEWSLETTER ALL RIGHTS RESERVED 2007 PAGE 5
c. Permissible reports - for example, providing to local law enforcement personnel a description of a patient or resident who is believed to have eloped from the healthcare facility. d. Reports authorized by healthcare facility policy and procedure - for example, disclosure of protected health information made in response a police request in order to identify a suspect. e. Reports requiring specific authorization - such a category would capture other requests from law enforcement that are not addressed above. It would also address situations in which there are doubts about the validity of request or court order. 2. Incorporate Professional Licensure Expectations. Review applicable state licensure and registration laws and regulations from. boards of licensure. Use this information to make certain what should be the appropriate response to patient specific queries from law enforcement personnel. Take into consideration requests for blood test results, information about a patient s condition or observations regarding possible alcohol or drug use by a patient. Use this information to design the disclosure matrix so that the actions of healthcare professionals will be consistent with both applicable licensure laws and healthcare facility policies and procedures. 3. Update the Matrix Regularly. Work with legal counsel to review and update the matrix on a regular basis. Take into consideration information from a variety of sources, including legislative and regulatory resources, case law, and possible advisory rulings from licensure boards. Alert leadership to necessary changes with a view to refreshing materials used in orientation and during in-service programs. 4. Orient Employees and Members of the Medical Staff. Provide a practical orientation on the disclosure rules for new employees and new members of the medical staff. Instead of didactic presentations, consider using case studies to help them understand how to use the disclosure matrix. 5. Provide Orientation for Agency and Traveling Personnel. Recognize that agency personnel and traveling nurses may not understand what is expected of them regarding information disclosure to law enforcement officials. The same may be true for physicians fulfilling locum tenens responsibilities. Orient these health care professionals to the information disclosure process. RMS NEWSLETTER ALL RIGHTS RESERVED 2007 PAGE 6
6. Set Expectations with Law Enforcement Representatives. Meet with law enforcement representatives to set expectations about disclosure of patient-specific information. Familiarize them with the healthcare facility s policy and procedure on the topic and develop a practical process for resolving potential disputes. Recognize, however, that part of expectation setting may be to agree to disagree. 7. Have a Plan in Place for Questionable Situations. Anticipate that situations will occur that do not fit neatly within the categories of the disclosure matrix. Develop a process for managing disclosure requests from law enforcement personnel. Anticipate that many requests will be of an urgent nature and not during routine hours. Identify who should be contacted to address such requests. 8. Use Questionable Cases to Refresh Policy, Procedures, and Education. Learn from questionable requests from law enforcement for patientspecific information. Carefully examine the response, too. Use this information to help review current policy, procedure and staff education. When appropriate make changes to policies and procedures and then orient staff to these modifications. 9. Respond to Complaints. Act quickly on complaints that involve allegations of impermissible disclosure to law enforcement authorities of patient-specific information. Investigate such allegations completely and develop an appropriate resolution. 10. Document the Process for Managing Requests of Release Information from Law Enforcement Personnel. Have in place a practical approach for documenting requests for and decisions related to release of patient-specific information to law enforcement personnel. Using auditing techniques to make certain that the process is followed. Conclusion. The Wisconsin ruling is like the tip of an informational iceberg. There may be much more patient-specific information desired by law enforcement personnel than nursing observations about the state of patient. RMS NEWSLETTER ALL RIGHTS RESERVED 2007 PAGE 7
Although there can be confusion and frustration between what is acceptable under the HIPAA Privacy Rule and applicable state law, healthcare organizations can take practical steps to clarify what is acceptable practice. A disclosure matrix, effective policies and procedures, and education exemplify such a practical approach. The net result should be that, when in doubt, healthcare providers should ask what to do and a have ready resource for this purpose. If you would like assistance with developing risk management strategies for a disclosure matrix of patient-specific information, please contact us at (860) 242-1302. 1 Wisconsin v. E.T.S. 20007 WL 4409679 (Wis.App. December 19, 2007). 2 Id. 3 Id. 4 Id. 5 Id. 6 Id. 7 Id. 8 Id. 9 WIS. STAT. 905.04 referenced in Wisconsin v. E.T.S. 20007 WL 4409679 (Wis.App. December 19, 2007). 10 WIS. STAT. 146.81(4)referenced in Wisconsin v. E.T.S. 20007 WL 4409679 (Wis.App. December 19, 2007). 11 Wisconsin v. E.T.S. 20007 WL 4409679 (Wis.App. December 19, 2007). 12 Federal Register 65 (250): 82,462-82,679 December 29. 2000. 13 Id. 14 Id. 15 For information on the confidentiality of alcohol and drug abuse patient records, see generally 42 CFR 2.31 through 42 CFR 2.67 (2007). 16 The FERPA regulation provides: An educational agency or institution may disclose personally identifiable information from an education record to appropriate parties in connection with an emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals. 34 CFR 99.36 (2006). The Family Educational Rights and Privacy Act (FERPA) can be found at 20 U.S.C. 1232g. The FERPA regulations can be found under 34 CFR Part 99. RMS NEWSLETTER ALL RIGHTS RESERVED 2007 PAGE 8