Here’s a critical analysis at the scope for reporting a DV case.
A patient presents at a hospital emergency room with injuries that she says are from falling down stairs, but the medical staff determines they are from domestic violence. She asks them not to report the incident to police. What should the staff do? Report it anyway because she could be in more danger? Or respect her wishes and protect her privacy? And how do state laws on investigating domestic abuse come into play?
This is the scenario one privacy official posed to his co-workers and to his colleagues through a listserv. “This was a good scenario that we tossed out there to see how others dealt with it,” says Steve Stark, information technologies manager at Skaggs Community Health Center in Branson, Mo. “We took this all the way to our legal department ..[and] what we learned through this is that, in the state of Missouri, it is perfectly legal for a physician to report [an incident] even after a request.” With or without a victim’s request, protected health information (PHI) is not protected if a crime was involved, Stark found. “Our attorney told us that if we feel that a patient is in danger, we have every right to report it [and] we could probably be held liable if we didn’t.”
But there is a twist. Stark says caregivers want to be cautious and not jump to conclusions or make false accusations. “You wouldn’t want to do anything.that would prevent patients from seeking care because they might start to think that every time they come in, their privacy is going to be breached.”
Jon Burke, a consultant on privacy and security issues, agrees. He says a hospital should take advantage of all the options it has before contacting police. “If a patient comes in with a variety of wound patterns that show an abuse context, it is a no-brainer: Make the call,” he tells RPP. But, he says, “in a normal hospital, there is a psychiatrist on call or a social worker on call. Before you put someone in the system, you really need to consider [those options].. Try to relate to what you would do in the course of normal life. Knowing what you know, how likely would you be to report this? If you know that someone is beating the hell out of somebody else, yeah, report it. But if you’re not sure, then ask.” Burke, who received Stark’s scenario through a listserv, points out that “in most abuse cases, if the victim gets to the hospital, it is the spouse that abused them [who] drives them there. If the abuser knows [he is] going to jail, that victim is not going to get to the hospital.”
So, to report an incident against the patient’s will could put him or her more at risk, Burke says. For example, “in California, the state can take over as the plaintiff. So a guy would be out of the house that night and maybe in jail,” and probably pretty upset, Burke says.
In one case that illustrates confusion on this issue, a case manager at a hospital in Louisiana sued two police officers after they arrested her for obstruction of justice for delaying the investigation of a domestic abuse case. A nurse called the police to report the incident. The case manager would not let officers speak to the victim, however, saying that she had asserted her right to privacy of medical treatment under HIPAA, according to court documents. The officers allege that she barred them from seeing the victim and threatened them with a lawsuit, court documents say.
The case manager was later arrested after the officers obtained a warrant. She filed suit against the officers and the city for false arrest, seeking damages of $170,000. Part of the case manager’s argument was that her actions were justified by HIPAA, according to court documents.
Josephus Verheijde, a physical therapist and bioethicist at Mayo Clinic, explains that when the nurse called police and informed them about the potential abuse, state laws went into effect, so law enforcement was under the obligation to investigate, which is “on a totally different level [than HIPAA].”
“You can ask the question, ‘is any health care provider obligated to disclose this information?'” says Verheijde, who is a certified compliance professional. “[HIPAA] allows disclosure about a victim of a crime.and you can disclose if it is expressly authorized by a state or to prevent any serious harm to the victim,” he points out.
Court Dismisses Case The U.S. District Court for the Western District of Louisiana dismissed Maier’s suit on March 30. Her attorney, Paul Marx, says they do not intend to appeal, but they maintain that Maier was correct. “There is no question a state cannot violate patient confidentiality provided by federal law,” he tells RPP. “Since that issue was not before the court, anything in the ruling on that subject is just commentary, and has no legal import.”
“Maier’s claim that the police officers should have known that her actions were justified by HIPAA regulations and thus lacked probable cause has no basis in law or in fact,” the court’s opinion says. “HIPAA prohibits hospital personnel from disclosing protected health care information to third parties. It does not bar police officers from obtaining information related to a perpetrated crime directly from a patient nor does it prohibit hospital personnel from allowing police officers access to a patient who was a victim of a crime,” the court explains.
Stark says this last quote from the opinion “should be added to every HIPAA training manual in existence and should be relayed to existing staff and all new staff.”
“This case demonstrates the risks hospitals take on when not fully understanding the rules and regulations of HIPAA. It is the responsibility of the [privacy and security officer] to train its staff members on when and how to apply HIPAA. Case worker Maier acted as well as she knew how to at the time, but obviously was violating Louisiana state statutes.,” he says.
“I think hospitals should rehearse events exactly as described in this court case and see how nurses respond,” Stark continues. “Only when a nurse is presented with this type of scenario can one learn how their staff members will react.. I know it is hard letting go of PHI to anyone who is not a care provider, but ultimately we as health care professionals have a higher goal of protecting the patient and, many times, in order to accomplish this, we must rely on [law enforcement officials],” he adds. Verheijde says it is also important to know what your state laws say. “I would think that most – if not all – states have some regulation that says these types of crimes require an investigation.”
“[HIPAA] clearly.allows disclosure of information about an individual even without consent to prevent serious harm. But it’s a judgment call too,” Verheijde says, according to Sec. 164.512 of the HIPAA Privacy Rule.
“It is important that institutions have policies that are well written and detailed enough so the staff knows how to handle these cases. Once the call is made, you’re done. The state laws take over. And most states have statutes that say [officials] will investigate domestic violence and prosecute if appropriate.”
[Reprinted from the May 2007 issue of REPORT ON PATIENT PRIVACY, the industry’s most practical source of news on HIPAA patient privacy provisions.]