Category Archives: HIPAA

January 9, 2018

Reporting HIPAA Breaches: Annual Deadline Approaches

By Kim Stanger

The HIPAA breach notification rule requires covered entities to report breaches of unsecured protected health information (“PHI”) to affected individuals, HHS and, in some cases, local media. (45 CFR § 164.400 et seq.). The notice must be sent to individuals as soon as reasonably possible but no later than 60 days after it was discovered. (45 CFR § 164.404). The timing of notice to HHS depends on the number of persons affected by the breach: if the breach involves 500 or more persons, the covered entity must notify HHS at the same time it notifies the individual; if the breach involves less than 500 persons, the covered entity must report the breach to HHS until no later than 60 days after the end of the calendar year, i.e., by March 1. (45 CFR § 164.408(b)-(c)).

Is Your HIPAA Breach Reportable? Under the breach notification rule, covered entities are only required to self-report if there is a “breach” of “unsecured” PHI. (45 CFR § 164.400 et seq.). Continue reading

September 26, 2017

Police, Providers, Patients and HIPAA

By Kim Stanger

Recent cases have highlighted the conflict that may occur when police seek access to patients or patient information. Here are some general guidelines for physicians and other healthcare providers when facing demands from police or other law enforcement officials.

Disclosing Patient Information. The HIPAA privacy rules (45 CFR § 164.501 et seq.) generally prohibit healthcare providers from disclosing protected health information to law enforcement officials without the patient’s written authorization unless certain conditions are met. HIPAA allows disclosures for law enforcement purposes in the following cases:

  1. Court Order, Warrant, Subpoena, or Administrative Process. A provider may disclose information in response to a court order, warrant, subpoena or other administrative process if certain conditions are satisfied. (45 CFR § 164.512(f)(1)(ii)). These situations are discussed more fully in our separate client alert here.
  2. Avert Harm. A provider may disclose information to law enforcement to prevent or lessen a serious and imminent threat to the health or safety of an individual or the public. (45 CFR § 164.512(j)(1)(i)). Many states have specific statutes authorizing or requiring providers to make disclosures when credible threats are made against third parties.
  3. Required by Law. A provider may disclose information to law enforcement when a law requires the disclosure, e.g., to report child or adult abuse or neglect, injuries from gunshots or criminal activity, etc. Providers should comply with the strict terms of the law, and not disclose more than is required by the law. (45 CFR § 164.512(a), (f)(1)(i); see also § 164.512(b)(1)(ii) (child abuse) and § 164.512(c) (adult abuse)).
  4. Facility Directory. HIPAA generally allows, but does not require, providers to disclose limited information to persons who ask for a patient by name unless the patient has objected to such disclosures or the provider believes that the disclosure is not in the patient’s best interests. (See 45 CFR § 164.510). The provider may only disclose the patient’s name, general condition, and location in the facility. (Id.).
  5. Identify Person. If law enforcement requests information to help identify or locate a suspect, fugitive, material witness or missing person, a provider may disclose the following limited information: name and address, date and place of birth, social security number, ABO blood type and rh factor, type of injury, date and time of treatment, date and time of death, and a description of distinguishing physical characteristics. Other information related to the individual’s DNA, dental records, body fluid or tissue typing, samples, or analysis cannot be disclosed under this provision, but may be disclosed in response to a court order, warrant, or written administrative request. (45 CFR § 164.512(f)(2)). The disclosure must be in response to a request from law enforcement, which may include a response to a “wanted” poster or bulletin.
  6. Victim of a Crime. If law enforcement requests information about a person who is suspected of being a victim of a crime, a provider may disclose information if: (a) the individual agrees to the disclosure, or (b) the officer represents that the information is necessary to determine whether someone other than the victim has committed a crime, the information will not be used against the victim, the information is needed immediately and the law enforcement activity would be adversely affected by waiting to obtain the victim’s agreement, and the provider determines it is in the victim’s best interest to disclose the information. (45 CFR § 164.512(f)(3)).
  7. Death. A provider may disclose information to notify law enforcement about the death of an individual if the provider believes the death may have resulted from a crime.
  8. Crime on Premises. A provider may disclose information to law enforcement if the provider believes the information evidences criminal conduct on the provider’s premises. (45 CFR § 164.512(f)(5)).
  9. Crime Away from Premises. If, in the course of responding to an off-site medical emergency, providers become aware of criminal activity, they may disclose certain information to police as necessary to alert law enforcement to the criminal activity, including information about the commission and nature of the crime, the location of the crime or any victims, and the identity, description, and location of the perpetrator of the crime. (45 CFR § 164.512(f)(6)).
  10. Report by Victim. If a person affiliated with the provider is the victim of a crime, the person may disclose information necessary to report the crime to law enforcement; however, the person may only disclose the limited information listed in 45 CFR § 164.512(f)(2)(i). (45 CFR § 164.502(j)(2)).
  11. Admission of Violent Crime. If a person has admitted participation in a violent crime that a provider reasonably believes may have caused serious physical harm to a victim, a provider may disclose information to law enforcement necessary to identify or apprehend the person, provided that the admission was not made in the course of or based on the individual’s request for therapy, counseling, or treatment related to the propensity to commit this type of violent act. (45 CFR § 164.512(j)(1)(ii)(A), (j)(2)-(3)).
  12. Fugitive. A provider may disclose information to law enforcement to identify or apprehend an individual who appears to have escaped from lawful custody. (45 CFR § 164.512(j)(1)(ii)(B)).
  13. Prisoners. If law enforcement or a correctional institution requests protected health information about an inmate or person in lawful custody, a provider may disclose information if police represents such information is needed to provide health care to the individual; for the health and safety of the individual, other inmates, officers or employees of or others at a correctional institution or responsible for the transporting or transferring inmates; or for the administration and maintenance of the safety, security, and good order of the correctional facility, including police on the premises of the facility. (45 CFR § 164.512(k)(5)).
  14. Medical Examiners and Coroners. A provider may disclose information about a decedent to medical examiners or coroners to assist them in identifying the decedent, determining the cause of death, or to carry out their other authorized duties. (45 CFR § 164.512(g)(1)).

Continue reading

May 25, 2017

HIPAA and Disclosure to Media

by Kim Stanger

Last week, a Texas health system agreed to a $2,400,000 HIPAA settlement arising out of a hospital’s disclosure of a patient’s name in a press release. (See here). Last year, a New York hospital agreed to pay $2,200,000 for allowing media to film in its facilities. (See here ). Given these cases, it is a good time to review the HIPAA rules on disclosures to the media.

Protected Health Information. HIPAA applies to a patient’s protected health information (“PHI”), which includes any individually identifiable information concerning a patient’s health, healthcare or payment for their care. (45 CFR § 160.103). It includes the patient’s name or any other identifiable information even if additional details of treatment are not included. A provider may not avoid HIPAA by simply omitting the name; PHI includes any information “[w]ith respect to which there is a reasonable basis to believe the information can be used to identify the individual”. (Id.). Accordingly, details about an individual that would allow others to identify the individual are considered PHI even if the usual identifiers are omitted. PHI remains protected by HIPAA even if the information is widely known in the community or the patient has disclosed the information himself or herself.

Disclosures to Media. HIPAA generally prohibits healthcare providers from disclosing a patient’s protected health information to media unless either (i) the patient or their personal representative authorizes the disclosure, or (ii) the disclosure fits within a HIPAA exception. (45 CFR § 164.502).

1. Authorization. When seeking to disclose information to the media, the safest course is to obtain the patient’s or their personal representative’s written authorization to make the disclosure. Providers should ensure that the authorization clearly covers the information that will be disclosed, describes the purpose of the disclosure, and identifies the persons or entity permitted to make and receive the disclosure. (45 CFR § 164.508). For more information about valid authorizations, see In addition to obtaining a HIPAA authorization, the provider may want to obtain a separate media release.

2. Response to Media Inquiries. HIPAA’s “facility directory” exception is often used to justify disclosures to news media, but it is very limited in scope. Under this exception, a provider may disclose certain limited information “for directory purposes”, i.e., to notify persons who inquire about the patient of the patient’s general condition and location in the facility. (45 CFR § 164.510(a)). To make the disclosure, the following standards must be met:

  1. Disclosure is Consistent with Patient’s Wishes. The exception will only apply if either (i) the patient or personal representative “is informed in advance of the use or disclosure and has the opportunity to agree to or prohibit or restrict the use or disclosure” for directory purposes, or (ii) “[i]f the opportunity to object … cannot practicably be provided because of the individual’s capacity or an emergency treatment circumstance,” the provider concludes that the disclosure is “consistent with the prior expressed preference of the individual, if any” and the disclosure is “[i]n the individual’s best interest….” (45 CFR § 164.510(a)). The provider’s Notice of Privacy Practices likely contains a provision that notifies the patient that disclosures may be made for facility purposes unless the patient objects. For competent patients, the notice arguably provides the required “opportunity to agree to or prohibit” disclosures for facility purposes; however, the OCR has stated:
    The patient must be informed about the information to be included in the directory, and to whom the information may be released, and must have the opportunity to restrict the information or to whom it is disclosed, or opt out of being included in the directory. The patient may be informed, and make his or her preferences known, orally or in writing.

    (OCR FAQ here). If the patient objects, the provider may not make the disclosure. If the patient is incompetent, the provider will have to establish both (i) that the disclosure is consistent with the patient’s prior expressed preferences and (ii) that the disclosure is in the patient’s best interests. That may be difficult to do in the case of media disclosures, and virtually impossible if the provider has never treated the patient before.

  2. Ask for Patient by Name. Assuming that disclosure is consistent with the patient’s wishes, disclosure for directory purposes may only be made “to persons who ask for the [patient] by name.” (45 CFR § 164.510(a)(1)(ii)(B)). Thus, providers may not disclose PHI in response to general media inquiries where media do not identify the patient by name.
  3. Disclose Only Limited Information. If the foregoing conditions have been satisfied, the provider may only disclose the limited information set forth below (45 CFR § 164.510(a)(1)(i)):
    1. The patient’s name. Of course, the media already has the patient’s name because they can only obtain PHI if they asked for the patient by name.
    2. The individual’s location in the healthcare provider’s facility. Providers should not disclose the location in the facility if it would effectively disclose the nature of the patient’s treatment, e.g., the psychiatric unit, labor and delivery, or a drug and alcohol treatment facility.
    3. The individual’s condition described in general terms that does not communicate specific medical information about the individual, e.g., “fair, critical, stable, etc.” (65 FR 82521). The American Hospital Association has recommended the following one-word descriptions of a patient’s condition.
Undetermined: Patient awaiting physician and assessment.
Good: Vital signs are stable and within normal limits. Patient is conscious and comfortable. Indicators are excellent.
Fair: Vital signs are stable and within normal limits. Patient is conscious but may be uncomfortable. Indicators are favorable.
Serious: Vital signs may be unstable and not within normal limits. Patient is acutely ill. Indicators are questionable.
Critical: Vital signs are unstable and not within normal limits. Patient may be unconscious. Indicators are unfavorable.
Treated and Released: Patient received treatment but was not admitted.
Treated and Transferred: Received treatment. Transferred to a different facility. (Although a hospital may disclose that a patient was treated and released, it may not release information regarding the date of release or where the patient went upon release without patient authorization.)

(AHA, HIPAA Privacy Regulations: Frequently Asked Questions, available here). The OCR has stated, “[t]he fact that a patient has been “treated and released,” or that a patient has died, may be released as part of the directory information about the patient’s general condition and location in the facility, provided that the other requirements at 45 CFR § 164.510(a) also are followed.” (OCR FAQ here).

To summarize, the “facility directory” exception may allow limited disclosures to the media, but it is difficult to satisfy all the necessary prerequisites, including patient notice and consent. Moreover, I question whether such disclosures to the media are really for “facility directory purposes”—the reason the exception exists. Finally, the exception does not require disclosures to the media; it merely allows the disclosures if the conditions are satisfied. Out of respect for their patient’s privacy, the patient’s best interests, and regulatory intent, providers may appropriately decide it is safer not to disclose PHI to the media, or to limit the disclosure, unless the patient or the patient’s personal representative expressly consents to such disclosures.

Media Access to or Filming in Treatment Areas. The provider’s primary duty is to care for his or her patients. Media access, if not managed in an appropriate way, may impede care along with violating patient privacy, including the privacy of patients who may not be the subject of the media inquiry. Per the OCR’s FAQ:

Health care providers cannot invite or allow media personnel, including film crews, into treatment or other areas of their facilities where patients’ PHI will be accessible in written, electronic, oral, or other visual or audio form, or otherwise make PHI accessible to the media, without prior written authorization from each individual who is or will be in the area or whose PHI otherwise will be accessible to the media. Only in very limited circumstances, as set forth below, does the HIPAA Privacy Rule permit health care providers to disclose protected health information to members of the media without a prior authorization signed by the individual….
There are very limited situations in which the HIPAA Privacy Rule permits a covered entity to disclose limited PHI to the media without obtaining a HIPAA authorization. For example, a covered entity may seek to have the media help identify or locate the family of an unidentified and incapacitated patient in its care. In that case, the covered entity may disclose limited PHI about the incapacitated patient to the media if, in the hospital’s professional judgment, doing so is in the patient’s best interest. See 45 C.F.R. 164.510(b)(1)(ii). In addition, a covered entity may disclose a patient’s location in the facility and condition in general terms that do not communicate specific medical information about the individual to any person, including the media, without obtaining a HIPAA authorization where the individual has not objected to his information being included in the facility directory, and the media representative or other person asks for the individual by name. See 45 C.F.R. 164.510(a).
The HIPAA Privacy Rule does not require health care providers to prevent members of the media from entering areas of their facilities that are otherwise generally accessible to the public, which may include public waiting areas or areas where the public enters or exits the facility.


Remember Other Laws. HIPAA preempts less restrictive laws, but providers must comply with more restrictive privacy laws. It may be that state or other federal laws prohibit media disclosures even if HIPAA might allow them. For example, 42 CFR part 2 places stringent privacy requirements on federally assisted drug and alcohol treatment programs. Providers should consider other potentially applicable laws or common law duties before making any disclosure.

In short, when it comes to dealing with the media, it is generally safer to simply explain that federal and state law prohibits your disclosure of health information. If a disclosure is to be made or media access allowed, providers must take extreme caution to comply with the HIPAA rules.

For questions regarding this update, please contact:
Kim C. Stanger
Holland & Hart, 800 W Main Street, Suite 1750, Boise, ID 83702
email:, phone: 208-383-3913

This news update is designed to provide general information on pertinent legal topics. The statements made are provided for educational purposes only. They do not constitute legal advice nor do they necessarily reflect the views of Holland & Hart LLP or any of its attorneys other than the author. This news update is not intended to create an attorney-client relationship between you and Holland & Hart LLP. If you have specific questions as to the application of the law to your activities, you should seek the advice of your legal counsel.

May 2, 2017

HIPAA: Releases of Information v. Authorization

by Kim Stanger

Healthcare providers are often confused by or misunderstand the rules governing the release of a patient’s information at the patient’s request. HIPAA allows certain disclosures without the patient’s written authorization, including disclosures to other providers or third party payers for purposes of treatment, payment, or healthcare operations; to family members or others involved in the patient’s care or payment if certain conditions are met; or for certain government or public safety concerns if regulatory requirements are satisfied. (45 CFR 164.502, 164.506, 164.510 and 164.512). Other disclosures generally require the patient’s consent or written authorization. (45 CFR 164.502). The rules for such written releases of information (“ROI’s”) differ depending on who is requesting the records and to whom the disclosure will be made.

1. Disclosures to the Patient or Personal Representatives. Under HIPAA and subject to limited exceptions, a patient or the patient’s personal representative1 generally has a right to obtain a copy of the patient’s protected health information maintained in the patient’s designated record set.2 (45 CFR 164.524(a)(1)). If the provider chooses, the provider may require such requests to be in writing so long as the provider informs the individual of the requirement. (45 CFR 164.524(b)(1)). The provider must produce the records in the form or format requested (e.g., paper or electronic format) if readily producible. (45 CFR 164.524(c)(2)). It is usually a good idea to require written requests to document the date, scope, and format of the request. Once received, the provider has 30 days to respond to the request. (45 CFR 164.524(b)(2)). Although the provider may respond immediately, it is usually a good idea to take some time to collect and review the requested records before responding, thereby ensuring that the records provided are accurate, complete, and do not contain inappropriate information. Providers may charge the patients or personal representatives a reasonable cost-based fee for the records. (45 CFR 164.524(c)(4); see article at The patient’s right to access information generally includes all information in their designated record set, including records created by or received from other providers. (OCR, Individuals’ Right under HIPAA to Access their Health Information 45 CFR § 164.524, hereafter “OCR Guide” available here). Continue reading

April 25, 2017

HIPAA: Should You Ask Patients for Consent to Disclose Information?

by Kim Stanger

Healthcare providers often limit unnecessarily their ability to use or disclose protected health information without the patient’s consent, thereby increasing their potential liability for unauthorized disclosures. For example, providers often:

  • Tell the patient that the provider will only disclose the patient’s information to those persons identified by the patient, thereby precluding disclosures to others who are not identified.
  • Ask the patient to list those to whom the provider may disclose information, thereby expressly or impliedly suggesting that they will not disclose information to others.
  • Ask that the patient authorize disclosures to payers and/or other providers, thereby expressly or impliedly agreeing that they will not disclose information to payers or providers if not authorized by the patient.

They do so under the mistaken belief that HIPAA requires such. In reality, such practices may actually increase potential HIPAA liability. Continue reading

January 19, 2017

Report HIPAA Breaches Without Delay

by Kim Stanger

If you experience a HIPAA breach, make sure you investigate and report the breach “without unreasonable delay and in no case later than 60 calendar days after discovery of the breach” or you may be subject to HIPAA fines. (45 CFR 164.404(b)). The Office for Civil Rights just settled for $475,000 its first case against a covered entity for unreasonable delay in reporting a HIPAA breach.

On October 22, 2013, Presence St. Joseph Medical Center (“Presence Health”) discovered that its paper-based operating schedules were missing from its surgery center. The schedules contained protected health information of 836 persons, including names, birthdates, procedure information, and medical record information. Because the breach involved more than 500 persons, Presence Health was required to report the breach to HHS and local media at the time it notified affected individuals. However, due to a miscommunication between its workforce members, Presence Health did not report breach to HHS until January 31, 2014 (101 days after the breach was discovered); did not notify affected individuals until February 3, 2014 (104 days after the breach was discovered); and did not notify the media until February 5, 2014 (105 days after the breach was discovered). The HIPAA Breach Notification Rule requires that covered entities notify individuals and, if the breach involves more than 500 persons, report breaches to HHS and local media without unreasonable delay and in no event later than 60 calendar days after discovery of the breach. (45 CFR 164.404-.410). A separate HIPAA violation occurs for each day the covered entity fails to report the breach beyond the deadline. Presence Health settled the alleged violations for $475,000. A copy of the OCR’s press release is available here. Continue reading

November 23, 2016

Responding to Negative Internet Reviews: Beware HIPAA

By Kim Stanger, Holland & Hart LLP

As a healthcare provider, you may log onto the internet one day only to discover a negative review from a disgruntled patient or family member. Undoubtedly, the review contains inaccurate, incomplete, or downright defamatory information. Your first impulse may be to post a response online, but doing so may subject you to HIPAA fines, adverse licensure action, or privacy lawsuits.

HIPAA generally prohibits healthcare providers from using or disclosing a patient’s protected health information without the patient’s authorization. (45 CFR 164.502). “Protected health information” includes information that “[r]elates to the past, present, or future physical or mental health or condition of an individual [or] the provision of health care to an individual, and … that [i]dentifies the individual, or [w]ith respect to which there is a reasonable basis to believe the information can be used to identify the individual.” (45 CFR 160.103). Thus, posting any information that identifies the individual as a patient likely violates HIPAA even if specific medical information is not disclosed; a patient does not waive their HIPAA rights by posting his or her own information, and there is no HIPAA exception that allows a healthcare provider to disclose information in response to a negative review. In 2013, Shasta Regional Medical Center paid $275,000 to settle claims that it violated HIPAA when it disclosed a patient’s health information to the media in response to a negative newspaper article. (See Press Release). ProPublica recently published a report identifying numerous HIPAA violations resulting from providers’ ill-considered responses to negative internet reviews. (See article).

Continue reading

October 26, 2016

Conduct a Thorough HIPAA Risk Analysis or Pay Big Fines

by Kim Stanger, Romaine Marshall, and C. Matt Sorensen, Holland & Hart LLP

St. Joseph Health recently agreed to pay $2.14 million to settle allegations by the Department of Health and Human Services Office for Civil Rights Office (“OCR”) that its data security was inadequate.

In its investigation of St. Joseph’s handling of a 2012 data breach that exposed 31,800 patient medical records, OCR claimed St. Joseph did not change the default settings on a new server, which allowed members of the public to access via search engines the personal health information of 31,800 patients for a full year. By failing to switch off its servers’ default setting, St. Joseph potentially violated the HIPAA Security Rule’s requirement to conduct a technical and nontechnical evaluation of any operational changes that might affect the security of ePHI.

In addition to paying $2.14 million, St. Joseph Health agreed to implement a corrective action plan that requires it to conduct an enterprise-wide risk analysis, develop and implement a risk management plan, revise its policies and procedures, and train its staff on these policies and procedures. St. Joseph had conducted an enterprise-wide risk analysis in 2010, but the OCR deemed that to be inadequate because the analysis did not include an evaluation of the technical specifications of St. Joseph’s servers. Continue reading

January 8, 2016

HIPAA Privacy Rule Modified to Permit Covered Entities to Make Certain Limited Disclosures to the National Instant Criminal Background System

by Teresa Locke, Holland & Hart LLP

On Tuesday, January 6, 2016, the U.S. Department of Health and Human Services (the Department) issued a final rule, effective February 5, modifying the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to expressly permit – but not require – certain HIPAA covered entities to disclose to the National Instant Criminal Background System (NICS) certain personal health information (PHI) related to individuals who are subject to a Federal “mental health prohibitor” that disqualifies them from shipping, transporting, possessing, or receiving a firearm. Among the persons subject to the Federal mental health prohibitor established under the Gun Control Act of 1968 and implementing regulations issued by the U.S. Department of Justice are individuals who have been: (a) involuntarily committed to a mental institution; (b) found incompetent to stand trial or not guilty by reason of insanity; or (c) otherwise determined by a court, board, commission, or other lawful authority to be a danger to themselves or others or to lack the mental capacity to contract or manage their own affairs as a result of marked subnormal intelligence or mental illness, incompetency, condition, or disease. Fearing that States might not be fully reporting relevant information to the NCIS because of actual or perceived barriers related to HIPAA, the Department enacted the revision to the Privacy Rule by adding a new category of permitted disclosures to 45 CFR 164.512(k). The new rule is narrowly tailored to appropriately balance public safety goals with important patient privacy interests to ensure that individuals are not discouraged from seeking voluntary treatment for mental health issues.

The new category of permitted disclosures is very limited in scope, applying only to a specific subset of HIPAA covered entities who, under narrow circumstances, may provide discrete personal health information to the NICS. Specifically, the new rule is limited in three ways. First, it applies only to covered entities involved in ordering involuntary commitments or other adjudications that make an individual subject to the Federal mental health prohibitor. It does not apply to disclosures about individuals who are subject to state-only mental health prohibitors. Moreover, the Federal mental health prohibitor does not apply to individuals in a psychiatric facility for observation or who have been admitted voluntarily. Thus, the new rule does not create a permission for most treating providers to disclose PHI about their own patients for these purposes. The Department recognized that encouraging voluntary treatment is critical to ensuring positive outcomes for individuals’ health as well as the public’s safety. The new rule was designed to balance that goal with public safety interests served by the NICS. Continue reading

November 9, 2015

Responding to HIPAA Breaches

by Kim C. Stanger, Holland & Hart LLP

HIPAA privacy and security breaches can result in fines of $100 to $50,000 to covered entities (including healthcare providers and health plans) and their business associates. (45 CFR 160.404). If the violation resulted from “willful neglect”, the Office for Civil Rights (“OCR”) must impose a mandatory fine of $10,000 to $50,000. (45 CFR 160.404). To make matters worse, covered entities and their business associates must self-report breaches of unsecured protected health information (“PHI”) to the affected individual and to HHS (45 CFR 164.400); failure to do so may constitute “willful neglect” resulting in additional fines. The good news is that the OCR may not impose a fine so long as the covered entity or business associate did not act with “willful neglect” and corrected the problem within 30 days. (45 CFR 160.410(b)).

Responding to Possible Breaches. Given the potential consequences, it is critical that covered entities and business associates respond appropriately to potential HIPAA breaches to avoid or minimize their liability. Below are steps that you may follow to help you identify and timely respond to HIPAA breaches. Continue reading