[ Tuesday, August 28, 2007 ]
PHI and the Cops: There was an interesting to-and-fro yesterday on the AHLA Health Information Technology listserv about hospitals disclosing patient discharge data to the police. The question stemmed from an initial inquiry of what to do when the local constabulary calls, asks if a particular person of interest is currently a guest of the hospital, and asks if the hospital staff would please let the cops know when the patient has been discharged. The original question noted that the hospital's policy was to tell the police, if they called, that the patient was in the hospital or had already checked out, but that the police were now asking if the hospital would call to let them know that the patient had been discharged, with the only distinction being whether the call was initiated by the police or by the hospital.
One respondant stated that, "We won’t acknowledge or deny if someone has been, or is, a patient to any law enforcement agency without a warrant, subpoena, or 'administrative order' – even if they purport to know that the patient was/is 'ours'. " Another said, "We have a very strict policy on this. We never call the police. If they want control of the patient they must maintain custody."
Now, HIPAA does allow a covered entity to maintain and disclose "directory information" unless the patient requests to not be included in the directory. If your Aunt Edna calls to see if you are in the hospital, I'm betting both of those hospitals replying above would tell her that you were there or that you had been dismissed. But they won't tell the police. That strikes me as very odd. "We never call the police." What if there's a mad gunman running around the hospital campus shooting folks? I'm guessing that hospital administrative officer would not discourage staff from calling the police then. And I'm guessing that officer would want the police to treat the hospital folks with a lot more courtesy than the hospital folks are able, under that "very strict policy," to show to the cops when they call. Why the animosity toward the cops, or conversely, why the love for the criminal (in many cases, the dude the cops are after is a suspect for a very good reason)? I feel like I'm stuck in a 1960's Forrest Gump scene.
It strikes me as very odd that some people seem to hold out as a proud emblem their disdain for law enforcement types. I'm not proposing some fawning fealty to those who wear the badge, not do I think that just because someone's a cop you have to do what they say. We all have protections against unreasonable searches and seizures, and we all have some right to just be left alone. But it really skews the balance to say that I'll tell anyone
except the cops that John Doe is in the hospital.
Sure, as some HIT list posters (like Oklahoma's Teresa Burkett) indicated, the cops have an interest in making their arrest after the patient has been dismissed, rather than while the patient is still in the hospital; if they arrest him while he still needs hospital care, the cops will probably have to pay for his hospital care. If he's not a dangerous criminal, but a criminal nonetheless, I can understand why the government wouldn't want to take on financial responsibility for his care; if he's a dangerous criminal, the police have an obligation to arrest him and guard him even while he's still in the hospital. Assuming the police are doing their public safety duty (not leaving a dangerous dude on the loose even while he's in the hospital), it's really a dispute between the patient, the hospital, and the cops as to who gets stuck with the criminal's hospital bill. Since the criminal's probably not going to pay (I'm not sure what the Crips' health plan looks like, but I'm suspecting it's low on the benefits side), it ultimately becomes a fight between the hospital and the government over who should pay, but that's really a different issue awaiting a political settlement.
Kristin Rosati, the absolutely go-to HIPAAcrat in Arizona, spelled out the actual obligations under HIPAA perfectly:
I had the opportunity to sit down with most of the major law enforcement agencies in Arizona (for about a year!), and negotiate a protocol re: hospital-law enforcement interactions on behalf of the Arizona Hospital and Healthcare Ass'n. It was a very enlightening experience in many ways.
Teresa is right on re: the reasons why some law enforcement agencies ask to be called when a patient is being discharged-- to avoid paying for the hospital stay by arresting the patient after discharge. I did learn, however, that in some circumstances the law enforcement agency truly does not have the resources to devote officers as 24-hour guards for patients who are not a danger to the hospital personnel, such as where a person would have been arrested and then released immediately from custody. Certainly, where a patient may pose a danger to hospital personnel or other patients, refusing to arrest the patient to avoid paying for care is completely inappropriate. In those circumstances, I urge the hospital CEOs to immediately call the head of the law enforcement agency to discuss posting law enforcement as guards, or to call 911 if there is an immediate threat.
That being said, I don't think it violates the HIPAA Privacy Rule to call law enforcement upon discharge, as long as the patient has not opted-out of the facility directory, and as long as the information provided does not go beyond that provided to anyone who calls and asks for the patient by name. I take the position that, if a CE may disclose the patient's location in the facility under the facility directory rule, the CE can also disclose an anticipated discharge to law enforcement. But any additional information beyond that--such as the patient's address-- is not permitted and if the agency wants more information, it has to find another HIPAA rule to justify the release. Of course, even if permitted by HIPAA, such a disclosure is completely optional, not required, and many hospitals choose not to take on this burden.
As Kristin said, assuming the patient did not opt out of "directory" information, the hospital could tell anyone who called whether the person was in the hospital, and if they were discharged. If the hospital can answer the question, I see no reason why they couldn't call the police to tell them the same information, if so requested. Would they prefer that the police call their switchboard every 10 minutes to ask the same question? The result would be the same, but the hassle factor would be dramatically increased, taking up valuable hospital and valuable police resources.
I know there's a public policy argument that you want people to seek healthcare when they need it and not be discouraged from doing so for fear that the police might find out their whereabouts. But personally, I'd rather people be afraid to break the law than feel that they can break the law and get "free" healthcare (which I, as a taxpayer and an insured individual, ultimately share in the costs of) without fear of being caught. People are incentivized enough to get healthcare when they need it (people tend to avoid kicking the oxygen habit, given the choice); I guess I'd rather the public policy promote law-abiding behaviour.
Jeff [4:00 PM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
