Government studies released in the last few months show the frustration is widespread, an unintended consequence of the 1996 law.
Hipaa was designed to allow Americans to take their health insurance coverage with them when they changed jobs, with provisions to keep medical information confidential. But new studies have found that some health care providers apply Hipaa regulations overzealously, leaving family members, caretakers, public health and law enforcement authorities stymied in their efforts to get information.
The law is unclear, and in most cases the safest thing to do is not share information:
Some reports blame the language of the law itself, which says health care providers may share information with others unless the patient objects, but does not require them to do so. Thus, disclosures are voluntary and health care providers are left with broad discretion.
Teaching staff to protect records is easier than teaching them to share them, said Robert N. Swidler, general counsel for Northeast Health, a nonprofit network in Troy, N.Y., that includes several hospitals.
“Over time, the staff has become a little more flexible and humane,” Mr. Swidler said. “But nurses aren’t lawyers. This is a hyper-technical law and it tells them they may disclose but doesn’t say they have to.”
Of the 27,778 privacy complaints filed since 2003, the only cases investigated, she said, were complaints filed by patients who were denied access to their own information, the one unambiguous violation of the law.
So as long as you give patients access to their own information, there is no penalty for being secretive with most others, leading to situations like this:
Birthday parties in nursing homes in New York and Arizona have been canceled for fear that revealing a resident’s date of birth could be a violation.
Patients were assigned code names in doctor’s waiting rooms — say, “Zebra” for a child in Newton, Mass., or “Elvis” for an adult in Kansas City, Mo. — so they could be summoned without identification.
Nurses in an emergency room at St. Elizabeth Health Center in Youngstown, Ohio, refused to telephone parents of ailing students themselves, insisting a friend do it, for fear of passing out confidential information, the hospital’s patient advocate said.
State health departments throughout the country have been slowed in their efforts to create immunization registries for children, according to Dr. James J. Gibson, the director of disease control in South Carolina, because information from doctors no longer flows freely.