John Shufeldt, MD, JD, MBA, FACEP
One of the moderately entertaining aspects of law school was answering hypotheticals (“hypos”) in class. They would go something like this: “Mr. Shufeldt, suppose that an off-duty police officer witnesses what she believes is an aggravated assault. Without identifying herself as a police officer, she disarms the assailant and, while doing so, the gun discharges and the bullet strikes and kills a bystander, who happens to be an emancipated minor. What causes of action, if any, do the child’s parents have against the gun manufacturer, the assailant, the officer, and the municipality?”
One of the moderately entertaining aspects of law school was answering hypotheticals (“hypos”) in class. They would go something like this: “Mr. Shufeldt, suppose that an off-duty police officer witnesses what she believes is an aggravated assault. Without identifying herself as a police officer, she disarms the assailant and, while doing so, the gun discharges and the bullet strikes and kills a bystander, who happens to be an emancipated minor. What causes of action, if any, do the child’s parents have against the gun manufacturer, the assailant, the officer, and the municipality?”
Using this method, let’s go through a few HIPAA hypos that you may run across in your practice. One caveat. I cannot tell you how many times I hear, “It’s against HIPAA!” People with little or no knowledge of this complex set of sometimes conflicting privacy regulations seem to throw out this comment all the time – particularly when they don’t want to do something. “Do you know where I can get a diet Mountain Dew?” “Yes, and I would tell you if it was not against HIPAA!” I’m not kidding. My response to those sorts of retorts is that, “I would kill you if it was not against HIPAA!” So if you only learn one thing from this article, please learn not to simply throw out that phrase “It’s against HIPAA!” like you have “HIPAA Tourette’s.”
Hypothetical #1
An employer sends in for evaluation a female employee who sustained a hip injury after a 3-foot fall while working. As part of their customary practice, the employer requests that a drug screen be performed. Before performing an x-ray of the pelvis, you appropriately perform a pregnancy test, which comes back positive. After informed consent, she refuses an x-ray of her pelvis and hip. The employer calls and wants to know the findings of the exam and x-ray.
Question: Under HIPAA, are you allowed to tell the employer that the patient refused the x-ray because she is pregnant?
Answer: Not without the patient’s consent. Her pregnancy is (hopefully) not work-related and thus it is protected personal health information (PHI) and the employer has no right to know. Health information related to work is still protected PHI, the difference is that if the employee-patient wants her injuries to be paid for by the employer under Workers’ Compensation, then the employee waives her right to confidentiality regarding medical information related to the injuries at issue. They remain PHI but are disclosable because of implied (or express) consent.
On the other hand, if employee-patient learns something during the course of your exam that she does not want disclosed and would rather forego Workers’ Compensation benefits to keep that information confidential, she has a right to do that and the doctors cannot disclose information to the employer (of course employee-patient will now foot the bill for the exam and subsequent treatment).
Question: While performing the urine drug screen, your staff observes the patient pour a vial of what is believed to be her dog’s urine into the container (yes, this happens). After she is confronted, she ultimately is able to void without the benefit of her canine and her drug screen comes back negative. Under HIPAA, are you allowed to tell her employer about her attempt to fabricate the results?
Answer: Yes. Her drug screen was obtained under the direction of her employer and they have a right to know about her attempt to alter the results. From a HIPAA perspective, the reason you can disclose it is because an attempt to conceal or fabricate test results isn’t PHI. The results of the test are PHI and can be disclosed to the employer IF THE PATIENT CONSENTS (if the patient is submitting to treatment under Workers’ Compensation then consent is implied), but the behavior on the part of the employee-patient to manipulate those results is not PHI, and so, not covered under HIPAA and thus disclosable for that reason.
Question: While being evaluated for her hip pain, the woman also complains about symptoms of a sexually transmitted disease (STD). Should you document the results of her pelvic exam and cultures in the same record as the exam for her hip contusion?
Answer: No. Her hip injury is a work-related injury for which she is seeking treatment where payment for that treatment will be made by Workers’ Compensation, thus her consent to disclosure of work-related injury information is implied. The STD is not a health matter for which she is seeking treatment under Workers’ Compensation and thus there is no implied consent to disclose this information; it remains confidential and cannot be disclosed.
Hypothetical #2
Now let’s look at a different scenario. Two parents bring their teenage child in for an evaluation. The child refuses to interact with you and refuses any sort of exam or testing.
Question: If the parents demand that you test their child for drugs, are you obligated to straight-cath the child against his or her will? What information do you need to help with the determination?
First, some background information. Over the last decade, the ability of minors to consent to their own care has expanded dramatically, particularly as it relates to mental health, substance abuse, and sexual or reproductive health care services. HIPAA privacy rules encompass a compromise between the statute and state laws and the Federal Educational Rights and Privacy Act (FERPA) as well as provider discretion. These provisions represent a compromise between rival viewpoints about the importance of parental access to minors’ health information versus the accessibility of confidential health care services available to minors.
In two large nationally representative studies, the predominant theme demonstrated was that adolescents would not seek health care if they believed that their parents would be notified. The overarching public policy is that although parental involvement in their minor child’s care is desirable, many minors, as proven by the studies, will not seek the care they need if they know their parents will be contacted.
So, although the parents may want to know and even demand to know, different states have different standards for disclosure of protected health information. Although this is technically not “HIPAA-related,” the information falls under what is deemed PHI and you thus need to understand your duties and the patient’s rights.
Generally, in most states, the cutoff consent laws apply to minors 12 and older. In some states however, the consent laws only apply if the minors are married, pregnant or are already parents. In a few states, the legislature has not enacted applicable laws and providers typically treat without parental, consent provided that they deem the minor mature enough to have capacity to understand.
Answer: No. If the minor is over 12, you cannot force treatment or testing (unless you believed it was in a life-or-limb threatening circumstance) treatment or testing.
Question: The parents demand that you “examine their child to see if they are sexually active.” The child who is not emancipated refuses. What are your duties? If the patient tells you in confidence that he or she is sexually active, are you obligated to tell the parents?
Answer: No. The minor, if over 12, does not need to submit to an exam nor should you share PHI with the parents under this circumstance.
Question: The parents demand that you determine if the child is pregnant. The child acquiesces and provides a urine specimen but affirmatively tells you not to disclose the results of the test to the parents. Is it a HIPAA violation if you do tell the parents the results?
Answer: Yes, it is protected PHI. However, there may be a caveat here when it deals with the child’s health if the child is making choices that are against his or her best interest medically (and I don’t mean having sex under age). For example, if a child who is over 12 is found to be sexually active and as a result has an STD or a pregnancy that may pose a health risk for the child based on previous health history and the child refuses treatment because he or she doesn’t want parents to know, and the doctor believes it to be in the child’s best health interest that he or she receive treatment for that condition, professional judgment will generally protect the provider if he or she discloses this to parents.
Hypothetical #3
A police officer brings in a suspect and demands you draw a blood alcohol test to determine if the patient was driving under the influence. The patient agrees but tells you in confidence that he or she was not drinking alcohol but had taken 20 mg of valium, which is why the test results are altered.
Question: Are you obligated, despite the patient’s request not to disclose, to tell the police officer the real reason for the patient’s altered mental status? What if the police officer demands a copy of the patient’s medical record?
Answer: The police officer can only receive that information with a court-ordered subpoena. Even after receipt of the court order, it remains protected PHI but you now have the authority to disclose it. I make these distinctions only because if someone thinks this information loses its status as PHI after a court order, they may feel they are at liberty to disclose it to all more freely because it is no longer protected; that is not the case.
If the police ask for a blood alcohol level and the suspect agrees, then the provider can release the results of the blood alcohol test. There would be no reason to volunteer other information, especially if it wasn’t asked for and this isn’t a crime that is subject to mandatory reporting. But what if the police ask for a toxicology screen and the patient agrees to submit to it but then asks you not to release the results? This becomes much trickier. By agreeing to the screen in the first place, hasn’t the suspect consented to disclosing the information? And if the suspect later says don’t disclose, is that more akin to withdrawing consent, at which point the police would have to seek a court order to have results released? And, of course, if the suspect refuses to agree to the screen, then you can’t even perform it without a court order.
Hypothetical #4
A patient presents to the urgent care center and tells you that he was beaten up by his domestic partner. You correctly determine that the patient is the victim of intimate partner violence. The patient tells you not to call the police. On exam you determine that the patient is bruised but has no fractures.
Question: Are you obligated to call the police since this was an assault? What other information do you need?
Answer: Most states do not have mandatory disclosure laws unless a violent crime was committed. This generally means the assault was carried out with a gun, knife or some other life-threatening object. This is a good example of how to deal with mandatory reporting rules but what about HIPAA implications? For example, what if police were on the scene, suspect DV, and ask you about it. Can you disclose then? Yes, but only with court order.
Question: The patient now states that he was pistol-whipped with a loaded gun, which was pointed at him. He still insists that you don’t notify the police. Are you obligated to inform the police despite the patient’s request and HIPAA?
Answer: I believe this crosses the threshold for a violent crime that has to be reported even if the state does not have mandatory reporting laws for intimate partner violence. As for HIPAA, this falls under the crimes exceptions where there is harm to others and disclosure is thus acceptable.
Hypothetical #5
A patient presents who was out allegedly “celebrating” an 18th birthday and whose mental status is altered due to an unknown ingestion. A suicide note was found at the scene. The parents arrive and demand to know what you found. They also tell you that their child has had previous suicide attempts and relate a detailed history of the child’s previous psychiatric diagnoses.
Question: You now have all the information and results back. The parents want to know the condition of their child. Can you tell them?
Answer: Although it is technically PHI, if you determine that disclosing the information will ultimately benefit the health of the patient and improve the chance for a good outcome, the answer is that you can share the information. Assuming the kid lives at home and the parents will be involved in the payment or treatment of the kid for this issue, yes. If the kid is on his own, the parents are not involved in caring for the kid and they do not pay for his medical care, then it becomes murky.
Conclusions
- Urgent care providers must be knowledgeable about their state’s minor consent laws, including provisions regarding disclosure of information to parents, particularly in instances where minors can consent for their own care.
- When state and other laws are silent or vague, providers must exercise professional judgment and grant or deny parents’ requests for information about care for which minors may legally consent. At the end of the day, do the right thing for patients and always act in their best interests.
- Health care professionals must be aware that the HIPAA privacy rule grants legal significance to agreements with parents that favor their adolescents’ receiving at least some health care on a confidential basis (see http://www.guttmacher.org/statecenter/spibs/spib_OMCL.pdf for a specific state by state reference). These rules provide that in some situations, minors generally assume the right to control access to information and their medical records.
