The typical requests for patient information are easy to understand for compliance with the Health Insurance Portability and Accountability Act (HIPAA), but staff members will face unusual situations that test their confidence and prompt them to play it safe by not disclosing. That situation was the case with a social services agency that Elizabeth G. Litten, JD, partner and HIPAA privacy officer with the law firm of Fox Rothschild in Princeton, NJ, recently counseled.
The social services agency received a telephone call one day that went to voicemail. On the recording, no one was speaking to deliver a voicemail message to the agency staff, but a person could be heard talking in the background, perhaps to someone else on a cell phone. In that partial conversation, the person mentioned a violent crime that had been committed on the premises. The social services agency had the phone number of the caller, and staff members determined that the call came from the home of one of its clients, though the client was not the one speaking.
The staff members concluded that their client could be in danger because of the violence described in the conversation.
“They wanted to call the police, but they were afraid to do so because they were concerned that, even though there was no health information directly involved, the police might put two and two together and realize that some of the social services they provided were healthcare services,” Litten explains. “They also thought it would be apparent that the people who receive these services have a particular health condition. They were very reluctant to call the police.”
Litten told the agency staff members that it was a stretch to think that calling the police would constitute a disclosure of their client’s health information. And even if it did, she explained, the agency had a duty to protect the safety and welfare of the client, which would override any HIPAA concern.
“If the client returned home and was subjected to a violent crime at their own place of residence, and the agency could have called the police and prevented it, then shame on the agency for standing behind HIPAA and saying they couldn’t call the police,” Litten says. “That was a strange situation, but it is an example of how you can take HIPAA to the extremes and, out of an overabundance of caution for protecting privacy, you can actually put someone’s life in danger.”
