Statement to the
Department of Health and Human Services
National Committee on Vital and Health Statistics
Subcommittee on Privacy and Confidentiality

Regarding The Impact
of the
HIPAA Privacy Rule on Media Access
to Protected Health Information

July 14, 2004

Presented by:
Sara M. Howley
Director of Corporate Communications
North Broward Hospital District
Fort Lauderdale, Florida

Good afternoon.  My name is Sara Howley and I’m director of corporate communications for the North Broward Hospital District in Fort Lauderdale, Florida.  I’m pleased to be here today to share hospitals’ perspectives on the impact of the Health Insurance Portability and Accountability Act (HIPAA) has on media access to protected health information.

The North Broward Hospital District is a tax-assisted, not-for profit network of 35 healthcare facilities offering a full spectrum of services to meet virtually any medical need. We are the medical safety net for the northern two-thirds of Broward County, providing services to all regardless of ability to pay, and one of the largest public hospital systems in the United States. We reach out to all segments of the community through four fully accredited medical centers, a children’s hospital, community and school-based healthcare centers, family health centers, specialized diagnostic and treatment facilities, health education and preventative programs, free and low-cost screenings, and business partnerships.

Each day, we strive to improve the quality of life in our community by working to prevent disease, improve infant mortality rates, and provide quality healthcare and health education to all residents, including those who otherwise might not have access to medical care.

Commitment to Privacy

At the North Broward Hospital District, we were always very sensitive to patient rights and privacy, even before HIPAA was in place.  Like most hospitals, we gave out very limited information to the media until we had consent from the patient or family.  One exception was public record patients – patients who are brought to us by law enforcement or fire rescue personnel – which allowed more leeway in the timeliness and type of information we could provide.  While we always used our best judgment in tough situations, we put the patient and their family first and gave out limited information.

Support of HIPAA

The North Broward Hospital District began its HIPAA education and compliance campaign in October 2001.  As the third largest employer in Broward County and one of the largest public health systems in the nation, our task was huge.  We needed to educate more than 7,500 employees and 1,600 members of our medical staff – not to mention the thousands of vendors and ancillary service providers.

Our aggressive education campaign continues today.  Everyone takes part in briefings –  from the nutritional services and facilities personnel to our top administration – by a dedicated HIPAA compliance department that was created and has worked aggressively to educate our staff and volunteers.

We also examined how we release patient information to the media and took several steps within our health system to change our activity.  We revised our policies on release of information to the media.  We revised our release of information consent form and translated it into English, Spanish, Creole and Portuguese reflecting the needs of our community.  We examined and relocated media staging at all facilities to better protect the privacy of our patients and their families.  We trained all media relations personnel — totaling 15 staff members and more than 25 ancillary staff members — on our new policies and procedures.

Hospital staff does not work in isolation; we work with staff from fire, police, emergency medical and public health departments so we went beyond our four walls to help educate others who would feel the impact of the new privacy rules.  We held discussions with the Florida Law Enforcement Public Information Officers organization.  We recognized that more education was needed among key parties and worked to convene hospitals, media and law enforcement agencies prior to HIPAA’s effective date.  This resulted in a HIPAA Media Summit targeted at South Florida reporters, editors, producers, police, fire and hospital personnel.

This event, held April 2, 2003, featured speakers from the American Hospital Association and the Florida Hospital Association, who presented information about HIPAA’s expected changes and how it will affect the working relationships between hospital media staff, fire and police personnel and the media.  The significant question and answer period at the program’s end was extremely helpful in gauging the reaction of the nearly 100 attendees.  During the Summit, we provided significant resources for the attendees, including contact lists, the AHA’s Guidelines for Releasing Patient Conditions and copies of the speaker presentations.  This Summit was an important first step in starting a dialogue between those most affected by HIPAA’s privacy rules.

Outreach to the Media

The Media Summit was our first large-scale initiative to educate the media on the changes they could expect from hospitals in our region.  Prior to that, many of my colleagues in the hospital field had conversations with reporters to explain the pending changes.  In addition, part of our strategy was to educate the law enforcement, fire and emergency service personnel, and ensure they understand HIPAA’s requirements and support us in our efforts with the media.

We continued to communicate with the media, law enforcement and others after HIPAA’s effective date with mass e-mails and newsletters,  providing information and documents that could be easily accessed, printed and passed around the newsrooms and agencies.

In April of this year – with one year under our belt – we held a roundtable panel discussion with the media and our hospital system media representatives.  We invited one of our two major local newspapers and our ABC News affiliate (WPLG) to discuss media issues.  All discussions seemed to turn into questions about HIPAA and release of information on patients.  Since this was a major topic, we plan to follow up with an expanded version of the roundtable to get additional feedback from the media on HIPAA and other issues.  This will most likely take place in September or October of 2004.

Consequences

We expected that HIPAA would require us to make adjustments in our media relations’ practices – all of which have become reality.

Media relies more on fire rescue and law enforcement for health details and information on public record patients or patients involved in a police investigation, since these agencies are not bound by HIPAA.  For example, last month, a plane crash took the life of pilot and a female passenger.  The pilot’s son was in the plane and transported to one of our facilities.  The pilot’s wife (and mother of the son) is a prominent businesswoman in the community and was very upset that fire rescue personnel were allowed to talk to the media about the injuries and crash.  She wondered why they were not held to the same privacy standards as the hospital and why they were able to give medical information about her family.  It’s difficult for us to explain to families why this is the case.

Our job in media relations is to help reporters do their job while protecting our patients’ rights.  Sometimes, there is conflict in doing just that.  Reporters’ job is to get the story.  We understand that.  But we have a responsibility to honor a patient’s right to privacy.  We’ve seen members of the press do whatever they have to do to get the story, including sneaking into hospitals, calling hospital rooms, standing guard outside facilities for family members or patients as they are coming and going, and contacting the family and friends at home or in their places of business since they do not have access to the patient.  While we understand reporters’ desire to get the story first, our first responsibility is to our patients.

One area made more difficult with the new privacy rules is John/Jane Doe patients.  HIPAA adds additional hurdles for hospitals trying to help identify these patients.  In the past, we may have shared a photo to help identify the person; under HIPAA, we can share some personal information but it’s more restricted, and we certainly cannot share photos.  This makes it more difficult to locate a family member or necessary information in order to treat the patient.

Getting updated patient information over the phone or in person from our own medical and nursing staff in order to do our jobs is much more difficult.  On the one hand, it’s good to know that our staff takes the privacy rules very seriously.  On the other, it’s hard for many of us who need access to this information to do our job in a fast-paced environment.  Again, these delays make it harder for us to provide the appropriate information to reporters.

We’ve noticed a decline of calls from reporters since they know we are unable to provide most patient information.  The collateral damage here is that we are getting less support from the media to cover our positive news stories or get the word our about important services or health information that could be useful for the public.  In addition, many of our local media relations personnel and nursing supervisors (who handle weekend and evening media calls) err on the side of caution when releasing information since they are frightened of the potential consequences, which are quite significant if they violate these privacy rules.  Since this does not happen at all facilities, the media is frustrated by different standards at different hospitals.

Finally, HIPAA has not only increased paperwork, it has increased the public’s concern about the HIPAA consent forms.  We’ve found that many patients believe their rights are being taken away when they sign the consent forms.  In general, despite education efforts, most patients are not aware of the medical privacy rules.  When confronted with additional paperwork, they tend to see it as another administrative hurdle added by the hospital.

Recommendations

Personally, I am impressed with the amazing local and national initiatives to educate healthcare providers about HIPAA.  I do, however, see a major opportunity to educate the general public.    I would like to offer the following recommendations:

  • Educate the general public about HIPAA before they or a loved one becomes a patient so that at their most vulnerable time, they are not inundated with HIPAA information.  I would encourage the Department of Health and Human Services (HHS) to provide more information for consumers in an easily understood and user-friendly format.
  • Law enforcement and fire rescue personnel need additional information about HIPAA.  I would recommend that HHS consider specific brochures for these groups.  Recognizing that HHS doesn’t have jurisdiction over these groups, it would be helpful if HHS could encourage them to conform to the same limits on information that hospitals follow.
  • The media still needs to understand and report more on HIPAA. They can be the avenue to generate awareness and I would encourage HHS to see them as a partner in getting this important information out to the public.
  • Additional detailed questions and answers from HHS on real world scenarios would be helpful to those of us on the front lines of care.  This further guidance is needed to help hospitals “use their best judgment” more consistently.  This would also be helpful for the attorneys and others who advise hospitals on HIPAA compliance matters.

In conclusion, ensuring the privacy of patients’ medical information is a responsibility that America’s hospitals have always taken seriously.  Hospitals have undertaken a great deal of effort to ensure that their staff, physicians, vendors and volunteers understand the new rules and follow them.  We understand that reporters have a job to do and want to help them do their job – within the rules – while still protecting our patients’ privacy rights.  We believe that the HIPAA privacy rules are working but there are areas where greater education is needed.  Hospitals stand ready to help ensure that the public and the media know and understand the rules.