What is HIPAA?
HIPAA is an acronym that stands for the Health Insurance Portability and Accountability Act of 1996. HIPAA includes regulations that govern the use and release of a patient's personal health information. HIPAA also limits the kind of information hospitals can disclose regarding patients.

When does the law go into affect?
HIPAA regulations became effective on April 14, 2001, and April 14, 2003 is the date on which hospitals must be in compliance with the new HIPAA privacy rule. The rule governs the use and disclosure of individually identifiable health information. Among its provisions are standards for releasing medical information about patients to the media and clergy.

What kind of organizations, specifically, are subject to the new HIPAA guidelines?
All health care providers, including hospitals, physicians, emergency medical or ambulance personnel who transmit protected health information in electronic form in connection with certain administrative and financial transactions are subject to the requirements of the rule. Police, firefighters and family members are not considered covered entities under HIPAA.

How does HIPAA affect the media?
HIPAA's privacy standards place new limitations on hospitals’ ability to release information about patients to the media. This may represent a significant change over previous practices in obtaining patient condition reports and accessing patients for interviews.

How will HIPAA change the way medical providers release patient
information to the media?
Under new HIPAA regulations, BayCare hospitals will maintain a directory of patients who have given their consent for release of certain personal health information. Patients have the right to object to or restrict the use or disclosure of information contained in the directory.  If a patient does not object to this information being included in a hospital directory, a reporter asking for the patient by name can be privy to the general condition of the patient. If media does not ask for the patient by name, no individual identifiable information about the patient may be disclosed.

If a patient has been given the opportunity but has chosen not to restrict their information, what kinds of condition information may be disclosed?
If HIPAA privacy standards are met, general-condition information may be provided that does not communicate specific information about the individual. BayCare Health System adheres to The American Hospital Association’s recommendations for the following one-word descriptions of a patient's condition:

Undetermined:  Patient awaiting physician and assessment.

Good:  Vital signs are stable and within normal limits. Patient is conscious and comfortable. Indicators are excellent.

Fair:  Vital signs are stable and within normal limits. Patient is conscious but may be uncomfortable. Indicators are favorable.

Serious: Vitals signs may be unstable and not within normal limits. Patient is acutely ill. Indicators are questionable.

Critical:  Vital signs are unstable and not within normal limits. Patient may be unconscious. Indicators are unfavorable.

Treated and Released:  Patient received treatment but was not admitted.

Treated and Transferred:  Received treatment. Transferred to a different facility. (Although a hospital may disclose that a patient was treated and released, it may not release information regarding the date of release or where the patient went upon release without patient authorization.) 

What about patients who are unconscious or otherwise unable to give advance consent for release of their information?
If patients are unable to speak for themselves, the patient's health care clinician must give verbal permission to determine if it is in the patient's best interest to release a one-word condition report to the public relations staff or AOD for release to the media.

So, for example, if a reporter is covering a traffic accident and calls the hospital asking for information about the condition of a vehicle's occupants, citing the location of the accident but not the victims' names, can the hospital provide a condition report?
No. Information in the directory may be released only if the media or the public asks for the patient by name and only if the patient has not objected to or restricted the release of such information. If patient are unable to communicate for the purpose of objecting to or restricting the use of directory information, the patient's health care clinician must give verbal permission to determine if it is in the patient's best interest to release a one-word condition report to the public relations staff or AOD for release to the media.

What if the reporter asks about the accident victim by name?
If an individual, including a representative of the media, asks for information about the patient by name, only the general condition may be released, provided the patient has not objected to or restricted the release of that information.

What if a reporter calls with information that is already part of the public record, such as name or condition of the patient obtained from police reports?
Members of the media often obtain police reports and other information about hospital patients. The assumption is frequently made that once information about a patient is in the public domain, the media are entitled to any and all information about that individual. This is not accurate. Health care providers are required to observe the general prohibitions against releasing patient information found in the HIPAA privacy standards, state statutes or regulations and the common law, regardless of what information is in the hands of public agencies or the public in general. 

Can a hospital confirm that a patient has died?
Yes, but only if the person is still in the facility, and only if the next-of-kin
have already been notified. However, a hospital may not disclose information regarding the date, time, or cause of death.

Do restrictions on the release of patient information change if a disaster occurs?
No. However, hospitals may release general information on how many victims are being treated, along with some general categorical information, such as how many are children vs. adults, or how many are male vs. female. No blanket condition will be provided for the group as a whole, and condition reports are only available on a patient-by-patient basis, provided that the media has the patient(s)’s name(s) and that these individuals have not restricted use of their personal health information.

Question: How does HIPAA apply to minor children?
Minor children (under the age of 18) may have information released with the consent of a parent or legal guardian, in accordance with the guidelines listed above.