The Health Insurance Portability and Accountability Act, or HIPAA, exists to protect the privacy of patients, but what happens during a pandemic, when the world wants to know who is sick, where they are, and with what illness?
HIPAA was passed by Congress in 1996 and came about for several reasons.
Computer access to patient health information meant that we needed to elevate our privacy standards, as there had been large breaches of medical records.
HIPAA developed a life of its own to make sure that a balance was maintained between healthcare professionals and patient privacy. Doctors can share patient information with other relevant healthcare staff, like nurses that will be caring for the patient, or for billing purposes. To protect their privacy, that's all the disclosure they can give, even during a disease outbreak.
"All of this is intended to recognize the disease in those that have it so that proper treatment can be administered to the extent that we have treatments available," said Dr. Michael Ewer, who has his J.D. and L.L.M. degree in Health Law and a PhD in Public Health. He also practiced medicine at MD Anderson for 40 years.
He tells us that all hospitals need to say when inquired about specific cases, is that public information is being provided to the proper authorities. It's better to err on the side of caution.
So, personal liberty and transparency are often at odds with each other.
During a pandemic, public health officials can require healthcare providers and hospitals to report positive cases with relevant details. It is then up to the public health entity to decide what to divulge to the public.
Most often, that includes the patient's age, travel history, and treatment. Even some locations can in certain instances be enough information to trigger further scrutiny for enforcing HIPAA rules.
An individual can complain that there was a HIPAA violation, and that may result in a fine to the entity. Patients are within their rights to sue for a privacy breach. The HIPAA violation could help in that litigation, but HIPAA is a fluid law, and the outcome of that case could depend on many factors.
The bottom line is that even during a global crisis, people are awarded basic rights to privacy, and hospitals and public health organizations are expected to respect those rights while still informing the public. The line is a fine one. Ultimately, this knowledge should be used as a tool to contain the spread, which Dr. Ewer says hasn't happened.
"We have failed terribly at containing this, as it's now all over the world. It was foreseeable that it would spread," Dr. Ewer says. "We want to protect you should you have the disease and we want to protect all of those that may have been in contact with you to make sure they don't spread it further as a protection of the community."