HIPAA Compliance Strategies

Featured Health Business Daily Story May 22, 2008

HIPAA Privacy: What Should a Hospital Do When a Patient May Have Violated His or Her Parole?

Reprinted from REPORT ON PATIENT PRIVACY, the industry's most practical source of news on HIPAA patient privacy provisions.

If Ron Gaasch has learned one thing in his nearly decade-long career as a compliance officer at a community hospital, it's that privacy issues aren't always black-and-white — especially when they intersect with law enforcement.

This was recently brought home to him when a doctor at his hospital called a patient's parole officer to report that the man had tested positive for the presence of illegal drugs, a probation violation.

The privacy rule states that CEs may disclose PHI to law enforcement officials when "the covered entity in good faith believes [the PHI] to be evidence of a crime that occurred on the covered entity's premises; when "consistent with applicable law and ethical standards;" and when such a disclosure is made "to a law enforcement official reasonably able to prevent or lessen a serious and imminent threat to the health or safety of an individual or the public."

In this case, the emergency physician at Gaasch's hospital, Community Hospital of the Monterey Peninsula in Monterey, Calif., knew the patient was on parole for an illegal drug conviction. And when he tested positive for a drug, the physician decided on his own to contact the man's parole officer. The man was not seen using drugs, nor did he have any in his possession.

Sometime afterward, the man's wife called to complain, first to the hospital's administration. The vice president of medical affairs at the hospital contacted the physician, and Gaasch was notified. He phoned the wife and also spoke to the physician.

Man Disputes Drug Use

Gaasch acknowledges being "somewhat handicapped" in following up the incident because he didn't want to violate the patient's privacy by talking to his wife; the patient himself did not contact the hospital. He said the wife told him that the man had not violated his parole, disputed that he had used illegal drugs, and contended that the doctor's call has jeopardized the man's parole, although she did not say it had been revoked.

The doctor told Gaasch he had the right under the privacy rule to report the man, and he gave two reasons why: because his drug use was a crime, and because by using drugs, he was a threat to his own health and safety.

Gaasch wasn't so sure about the crime angle, but tended to agree on the danger-to-himself theory.

"My understanding is that, if we feel a patient is a threat to our staff or the public, we can notify" authorities, he says. "We can also report it if we [feel] there is a crime that was committed on the premises."

Still, he wanted to be sure the hospital had not unwittingly violated the man's privacy.

Lack of Consensus From Peers

So he did a little research and reached out to his peers. To get the advice of colleagues on whether the reporting was permissible, Gaasch posted the scenario on a compliance listserv run by The Council of Ethical Organizations.

Knowing this was a complicated issue, Gaasch wasn't too surprised to read that there was no consensus on whether the doctor should have reported the man.

Wrote one poster, "You may be able to report under the exception to prevent or lessen a serious and imminent threat to the health or safety of an individual or the public, but I would make sure the provider documented the rationale in the record."

But others disagreed. "Unless the parolee used the drugs on your premises or was in possession on your premises, no crime was committed there," said one of the two who disagreed.

Yet a fourth was more certain that the situation did warrant a call to the man's parole officer.

"We are not a hospital, but a residential provider," this individual wrote to the listserv. "We absolutely report such things to law enforcement, citing the sections of HIPAA [pertaining to personal endangerment]. Our notice of privacy practices given to every client clearly says that we will report such things to law enforcement, to protect the health and safety of our other clients.

Does Choice of Drug Matter?

Greg Young also understands the larger issues CEs face when a patient uses illegal drugs. A former cop, he says employees in this situation face a "moral dilemma," while the institution's response must show consistency.

"From a HIPAA perspective, it is probably more important that a CE maintain the appearance that it treats all its patients' information the same than it is to turn in a drug user on probation," says Young, the privacy and security officer at Mammoth Hospital in Mammoth Lakes, Calif. "If an employee comes across information that a patient is using illegal drugs and somehow knows that patient is on probation for using illegal drugs, he or she cannot reveal the patient's medical information without the patient's consent. Obviously, that's not going to happen — getting the patient's permission."

So, in deciding how to proceed, "I would weigh the seriousness of the drug use. If the person is using marijuana, I am not too concerned. If someone is using an opiate of some sort, I might drop a dime to the probation officer and anonymously suggest that the officer require the probationer to take a random drug test…now! If the probation officer is doing a good job, then a test will be ordered. It is usually a condition of probation that a probationer is subject to such tests at the whim of the officer," Young says.

"A probationer usually must also submit to search and seizure, meaning any law-enforcement officer may at any time search the person for drugs. Such conditions are accepted because it is better than going to jail. It also is supposed to encourage the probationer to stay on the straight and narrow," he adds.

Training Should Follow

Gaasch ultimately decided that there was a compelling reason under the privacy rule to report the patient. But he also concluded that some follow-up training with the medical staff was necessary.

"My main message will be that HIPAA is a complex law, and that we need to be sensitive to privacy issues," he says, adding that he is considering whether to write an article for the medical staff newsletter.

"We may think we are doing the right thing to report a patient who is abusing drugs, but we could be violating their privacy. It seems kind of counterintuitive, but the rule is not black-and-white," Gaasch says.

And Gaasch's final thought to the medical staff on this issue? When in doubt — and before you make that call — give him a ring. He'll be "delighted" to talk.

Advertise With AIS

Privacy

Site Map