Incident highlights lack of HIPAA understanding
Incident highlights lack of HIPAA understanding
CM denied police access to victim
A 2007 lawsuit involving an incident at a Louisiana hospital illustrates the lack of understanding among providers regarding the provisions and applications of the HIPAA privacy rule, notes Elizabeth H. Hogue, Esq., a Burtonsville, MD-based attorney specializing in health care issues.
The suit filed March 30, 2007, by a case manager at Lafayette (LA) General Medical Center related to a series of events that began on April 9, 2005, when a female victim of domestic violence came to the hospital's emergency department (ED) with injuries to her head, face, and forearm, Hogue says.
A nurse on duty called 911 to report the incident of domestic violence, she adds, and when an officer from the Lafayette police department arrived to investigate, he was told by a nurse that a woman had reported to the hospital with injuries she said were caused by her husband.
When the police officer tried to speak with the victim, according to reports, a hospital case manager named Elizabeth Maier refused to allow him to talk to the woman and repeatedly threatened to sue if the officer continued in his efforts to do so.
Maier based her actions on the Health Insurance Portability and Accountability Act of 1996 (HIPAA), contending that the hospital could not provide further information or access to the patient in the hospital due to legal prohibitions she believed were imposed by HIPAA.
When the police officer's superior arrived and explained to Maier that a Louisiana statute required an investigation of all incidents of domestic violence and that hospital personnel cannot deny police access to crime victims, Hogue recounts, the case manager continued to block access to the victim and threatened a lawsuit.
The two police officials then spoke to an attorney for the hospital and based on that conversation, understood that Maier would contact them when the patient was discharged, according to reports. Instead, the woman was discharged into the care of her husband, the alleged assailant, and Maier did not contact the police, Hogue says.
Police contended that Maier's actions obstructed and delayed their investigation of the domestic violence incident, and a warrant was issued for her arrest on the charge of obstruction of justice, she adds.
Maier was arrested and taken to the Lafayette Parish Prison in May 2005, Hogue says, but the prosecutor ultimately decided not to pursue the charges against her. Almost two years later, Maier filed suit against the police department, alleging violations of her civil rights (Elizabeth Maier v. Morgan Green et al; Civil Action No. 06-715, March 30, 2007).
Maier claimed the police officers should have known her actions were justified by HIPAA regulations, Hogue says, but the court stated that HIPAA does not bar police officers from obtaining information related to crimes directly from patients, nor does it prohibit health care personnel from allowing police officers access to patients who are victims of crimes.
The court further said that during her deposition, Maier could not identify any HIPAA provision that would prohibit police officers from asking patients who are victims of crimes to identify perpetrators. Instead, Hogue says, Maier asserted that the nurse who called police to report the domestic abuse violated HIPAA and the victim's confidentiality.
While noting that the exact issue presented in the case is not addressed in HIPAA regulations, the court went on to point out information provided by the U.S. Department of Health and Human Services (HHS) in "HHS Questions and Answers, FAQs on Privacy of Health Information/HIPAA Disclosures in Emergency Situations:"
"Providers can share patient information with anyone as necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public consistent with applicable law and the provider's standards of ethical conduct."
Based on this provision, and considering the seriousness of domestic violence offenses in general, the substantial injuries the victim suffered, allegedly at the hand of her husband, and the fact that she was released from the hospital to the care of her husband, the court found, the HIPAA regulations did not prohibit providing access as requested by police.
The lawsuit filed by Maier was dismissed, Hogue notes, after the court concluded that her actions were based on an obvious "misconstruction" of the provisions of HIPAA, and that the police had probable cause to arrest her for obstruction of justice.
The implications of the failure to understand the HIPAA provision demonstrated by this case are potentially serious for both patients and providers, Hogue says. "Practitioners should review the privacy rule along with applicable statutes in the states in which they practice to avoid serious consequences."
(Editor's note: Elizabeth Hogue can be reached at [email protected].)
A 2007 lawsuit involving an incident at a Louisiana hospital illustrates the lack of understanding among providers regarding the provisions and applications of the HIPAA privacy rule, notes Elizabeth H. Hogue, Esq., a Burtonsville, MD-based attorney specializing in health care issues.Subscribe Now for Access
You have reached your article limit for the month. We hope you found our articles both enjoyable and insightful. For information on new subscriptions, product trials, alternative billing arrangements or group and site discounts please call 800-688-2421. We look forward to having you as a long-term member of the Relias Media community.