HIPAA Rules After a Tragedy: Common Misconceptions

Posted: June 16, 2016 to Compliance.

Tags: HIPAA, Compliance, NIST

With the tragic events that unfolded in Orlando at the Pulse nightclub, a lot of questions about LGBT safety, gun control, and terrorism are being asked. And rightly so. Unfortunately, what has been lost in the tragedy is how HIPAA laws are used and how even those within the medical community often lack proper education with regard to HIPAA regulations. Considering the sheer volume of wounded that came in, anyone would say the Orlando Regional Medical Facility performed admirably. Unfortunately, when it came to being inundated with requests from friends and family for updates on the status of their loved ones, the hospital hit a wall. According to the medical facility’s CEO, they were unable to give out any information and consequently petitioned the White House to waive HIPAA regulations for this very special circumstance, which, understandably, it did. The problem is: none of that was necessary. According to the to the FAQ on the website of the department of Health and Human Services, when asked if a patient’s health information can be given out to friends, family or others involved that patient’s care or the payment of it, it states:

Yes.  If the patient is not present or is incapacitated, a health care provider may share the patient’s information with family, friends, or others as long as the health care provider determines, based on professional judgment that it is in the best interest of the patient.  When someone other than a friend or family member is involved, the health care provider must be reasonably sure that the patient asked the person to be involved in his or her care or payment for care.  The health care provider may discuss only the information that the person involved needs to know about the patient’s care or payment.

Unfortunately, it’s not uncommon for hospital staff to not fully understand HIPAA regulations, but the events in Orlando highlight why it’s important for them to have just that. It was unnecessary for officials at the medical facility to contact the White House. Doing so likely took time and resources away from treating the wounded. Worse yet, it kept friends and family from getting information on the status of their loved ones when they needed it the most.

Protect Your Business Today

Petronella Technology Group has provided cybersecurity, compliance, and managed IT services from Raleigh, NC for over 23 years. Contact us today for a free consultation and technology assessment.