Presented by Dr. Drew Harris, UMDNJ in cooperation with Rutgers University, University of Medicine and Dentistry of NJ Supported by the NJ Department of Health and Senior Services

HIPAA Privacy Rule Health Insurance Portability & Accountability Act

Protects patient privacy

• Gives patient control over how personal health information (PHI) is used or shared
• Expressly permits PHI sharing for public health purposes without authorization.
• Share no more information than absolutely necessary

HIPAA is a federal law that, in part, deals with medical privacy issues. Patients must sign a waiver before their medical information is shared by the health care provider with outside entities. No waiver is needed to share the information for legitimate public health purposes, but no more than absolutely necessary.

Unfortunately, medical staffs are not aware of this provision and will often refuse to release pertinent health data to appropriate public health authorities. The MMWR April 11, 2003 issue outlines the HIPAA requirements and exemptions and could be useful when attempting to explain why permission is not needed to obtain personal health information.

Quiz:
Q. Is a health officer entitled to view the immunization records of a potential pertussis case without permission from the parent?
Yes.
Can they view the patient's psychiatric history?
No, unless it is germane to the outbreak investigation.
Can the health official view the patient’s sister’s record?
A. Yes, if she is a possible contact.

• In some cases, health departments are considered “covered entities.”
• Provider of health care
• Obtain patient's permission before sharing personal health information except for public health purposes
• Must make records available to patient
• Consult with legal counsel for advice

Case Study Courtesy NBC "ER"

Febrile 35-year-old woman dies in respiratory distress shortly after arriving at local Emergency department. Spent past two days at conference at local hotel Unclear how long she was sick. Emergency department doctor suspects bacterial encephalitis but can't rule out SARS, Anthrax. Key questions Who do you report to? Where do you obtain legal advice? What are your responsibilities? Do you quarantine the hotel? What rights do the people have? Can you release the name of victim to media?