Merry Christmas!

A Christmas Present from Jon and Alice

Normally, we at Veteran’s Press and EMR Legal, our HIPAA publishing and consulting companies, reserve new policies that I write for our Premium Members. But in the spirit of Christmas, which you may certainly enjoy even if Christianity is not your religion or even if you have no religion, my Vice President and Editor of our publications, Alice McCart, and I thought that we would give our readers a Christmas present—that is, in this case, a sample release of information to the media policy. The necessity for such a policy has been highlighted by the active shooter disasters in Nevada, Texas, and Florida, as well as by the natural disasters in states along the Atlantic and Caribbean coasts. These disasters, particularly the shooting in Las Vegas, prompted the Office for Civil Rights (“OCR”) of the Department of Health and Human Services (“DHHS”) to publish an update to its guidance for disclosure of protected health information (“PHI”) during disasters. See my blog post of November 28, 2017.

The following sample media policy is complete for a large hospital, a long-term care facility, or a large physician practice and may have sections or language that you do not need if you are in a small practice. Simply delete language that is not applicable to your practice. Make certain that you make any changes necessary to comply with your state(s) laws.

If you have a disaster drill, consider having someone play the part of an aggressive reporter, and see how well your staff  handle disclosures to the media.

Our Vice President of Operations, Joseph Borich, our Director of IT, Sarah Smith, Alice, and I wish you the best Christmas and New Year.

Release of Information to Media Policy

 

Introduction

 

[Name of facility] has adopted this Release of Information to Media Policy to comply with our responsibility to protect individually identifiable health information under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as modified by the Health Information Technology for Economic and Clinical Health Act (“HITECH Act”) (hereinafter HIPAA); the Department of Health and Human Services (“DHHS”) security and privacy regulations implementing HIPAA; the Joint Commission’s accreditation standards; and other federal and state laws protecting confidentiality of health information. All workforce members of [name of facility] must comply with this policy. Demonstrated competence in the requirements of this policy is an important part of every [name of facility] workforce member’s responsibilities.

 

Assumptions

 

This Release of Information to Media Policy is based on the following assumptions:

 

• Although patient medical records are the “property” of the facility, patients have rights of privacy in the information contained in the records and otherwise collected, used, and maintained by the facility or elsewhere under the control of the facility regardless of whether or not they are contained in the formal clinical record.
• Health information is more than just clinical information and also includes financial, demographic, and lifestyle information.
• Other than disclosures authorized by the DHHS Standards on the Privacy of Individually Identifiable Health Information (“Privacy Rule”) and federal and state law, [name of facility] must obtain a consent or an authorization or give the individual an opportunity to object to a use or disclosure in order to use or disclose medical information.
• Any use or disclosure of confidential patient or other information carries with it the potential for an unauthorized use or re-disclosure that breaches confidentiality.
• Some elements of the Press may be very aggressive in trying to access health information, particularly in celebrity, criminal, disaster, and other scenarios.
• Although the function of the Press is to inform people of the news and although the people may have a so-called right to know, an individual’s right to health information privacy usually outweighs the public’s right of access to this information.
• HIPAA, its implementing regulations, particularly the Privacy Rule, and other federal and state statutes and regulations limit the public’s right of access to health information. In addition, court decisions and ethical rules may limit such right of access.
• Patients and clients have a right to some degree of control over the use and disclosure of health information concerning them,
• Providers should inform patients and clients concerning potential disclosures of health information concerning them and their rights to limit such disclosures in providers’ notices of privacy practices.
• Improper disclosure of health information to the Press may seriously harm the individual and [name of facility].
• Improper disclosure of health information by a workforce member may subject the offender to employee and professional discipline in accordance with [name of facility]’s sanction policy.

 

Policy

 

All workforce members, especially those authorized to release medical records and health information, must read, understand, and comply with this policy.

 

General Principle

 

[Name of facility] has a legal and an ethical responsibility to preserve the privacy and confidentiality of patient information. Accordingly, all workforce members will adhere strictly to this basic principle: the individual’s or his or her personal representative’s prior consent, authorization, or opportunity to object or a ground specified in the privacy regulations that does not require such consent, authorization, or opportunity to object is required before use or disclosure of patient information to the media.

 

Compliance with Laws and Regulations

 

These policies and practices shall be consistent with state and federal laws and regulations that have not been preempted by HIPAA and its implementing regulations, including the Privacy Rule, and that contain provisions relating to the release of information from patient records. The [legal department], [risk manager], [compliance officer], [office manager], [privacy officer], [other] [is][are] responsible for reviewing any new laws and regulations pertaining to disclosure of health information and amending this policy to comply with changed provisions.

 

General Guidance

 

Under HIPAA, information about the condition and location of a patient may be released only if the inquiry specifically contains the patient’s name. No information can be given out if a request does not include the patient’s name. If the patient has not requested that information be withheld, and the request for information contains the patient’s name, [name of facility] generally may release the patient’s condition and location within the hospital. However, [name of facility] must exercise discretion in releasing a patient’s location, because that disclosure may indicate the patient’s condition. Examples include a mental health unit, labor and delivery, and the like. At no time may [name of facility] disclose a patient’s location in a substance abuse unit without the individual’s or his or her legal representative’s signed consent. These rules apply equally if the patient is deceased. In such a case, the executor or administrator of the estate or the next-of-kin [Delete “next-of-kin” if state law does not empower such an individual to make decisions concerning the patient’s health information.] must sign the consent for release to the media.

 

Patient Condition

 

[Name of facility] may disclose a patient’s condition in general terms that do not communicate specific medical information. In describing the patient’s condition, [name of facility] workforce members should limit their comments to the following definitions:

• Patient is awaiting physician assessment.
• Vital signs are stable and within normal limits. Patient is conscious and comfortable. Indicators are excellent.
• Vital signs are stable and within normal limits. Patient is conscious, but may be uncomfortable. Indicators are favorable.
• Vital signs may be unstable and not within normal limits. Patient is acutely ill. Indicators are questionable.
• Vital signs are unstable and not within normal limits. Patient may be unconscious. Indicators are unfavorable.

 

Deceased Patient Condition

 

The HIPAA Privacy Rule continues to apply to a patient’s health information even after the patient’s death. Again, no information may be released unless the inquiry contains the patient’s name. The death of a patient is considered to be a “patient condition” and may be disclosed using this one-word description.

 

In the event of a patient’s death, [name of facility] will ensure that it makes all reasonable efforts to notify the patient’s next-of-kin prior to the patient’s death being made public. [Name of facility] must verify that there has been no objection to disclosure from the patient’s family or other legal representative and that next-of-kin have either actually been notified or a reasonable attempt has been made to do so prior to making any announcement of a patient’s death. Additional information about a patient’s death, including date, time, and cause of death, should not be released without written authorization from a legal representative of the deceased.

 

Although a hospital may report information about a patient’s death to other agencies, such as coroner, law enforcement, and so forth)—some of which may become public—this disclosure does not affect the scope of information that a hospital may release to the media. Again, [name of facility] may not release any information unless the inquiry contains the patient’s name.

 

Under the Privacy Rule, the death of a patient is a “patient condition” and [name of facility] may disclose it using only the one-word description. [Name of facility] must not release additional information about a patient’s death, including date, time and cause of death, without written authorization from a legal representative of the deceased.

 

Media Access to Patients

 

[Name of facility] may deny the media access to a patient if it determines that the presence of photographers or reporters would aggravate the patient’s condition or interfere with medical care. [Name of facility] workforce members should refer requests for media access to patients to the [Privacy Officer] [other official] if possible. To safeguard patient privacy, a [name of facility] spokesperson must accompany media representatives at all times. If the media takes photographs, the spokesperson must have the patient or his or her representative sign a model’s release. See Appendix A.

 

Celebrities and Other Public Figures

 

The rules for release of information and permissible disclosures are the same for public figures or celebrities as for other patients. To safeguard patient privacy, a [name of facility] spokesperson must always accompany media representatives. [Name of facility] workforce members should verify with the patient (or the patient’s representative) that there is no objection to the disclosure of information to the media even in cases where no opportunity for objection is required.

 

Minor Patient

 

HIPAA defers to state law with respect to the rights of parents to obtain access to or control the disclosure of information concerning their children. Typically, when a parent or guardian has the authority to make medical decisions on behalf of a child, that parent or guardian also has the right to object to (or authorize) disclosure of medical information to the media. In those cases where the minor has the legal authority to consent to a health care service, that minor also has the ability to object to (or authorize) the release of information regarding that health care service, regardless of whether a parent or guardian has given authorization. Under state laws, minors may receive some health care services for which they can legally consent and other treatments requiring the authorization of a parent or guardian. In these cases, the minor has the authority to object to (or authorize) the disclosure of some medical information, while the parent or guardian has this authority for the other services.

 

Emancipated minors (those that the law gives the ability to function as adults in certain areas) generally have the authority to make health care decisions for themselves. In these circumstances, emancipated minors also have the ability to authorize (or object to) the disclosure of their health information. In those circumstances, however, where a parent or guardian has the right to make health care decisions for an emancipated minor, the parent or guardian has the right to object to (or authorize) the disclosure of the health information involved.

 

Incapacitated Patient

 

When a patient is incapacitated, but has previously designated a representative to make health care decisions, such as closest available relative, conservators, or designated agent or surrogates under a Power of Attorney for Health Care or Advance Directive, the designated individual also has the right to authorize (or object to) the release of the patient’s information to the media. If a patient is incapacitated and there is no designated representative, [name of facilit] may disclose some or all of the allowed information if such disclosure is consistent with a prior expressed preference of the patient or is considered to be in the best interest of the patient. [Name of facility] should, however, use discretion in making this decision and inform the patient of the use or disclosure of information as soon as it is practical to do so.

 

Unidentified (John Doe) Patient

 

[Name of facility] workforce members sometimes provide care to patients who cannot be identified. When these situations occur, health care facilities sometimes provide a photo of the unidentified patient to the news media in order to help find the patient’s next-of-kin. [Name of facility] workforce members may do so if it makes certain determinations:

• Is the patient “present or otherwise available,” and does the patient have the capacity to make health care decisions?
• If a “John Doe” patient is determined to be both “present and otherwise available” and is not incapacitated, [name of facility] workforce members may release information only if the patient agrees or is provided a reasonable opportunity to object and does not do so.
• If, however, the unidentified patient is incapacitated and is not “present and otherwise available,” [name of facility] workforce members may disclose only the minimum necessary information that is directly relevant to finding a patient’s next-of-kin, if doing so is in the best interest of the patient. Under no circumstances, however, may [name of facility] release a patient’s substance abuse [or] [mental health], [developmental disability], [HIV], [other] information [Refer to relevant state law for which, if any, of these categories may get extra privacy protection and hence control over HIPAA,] ,

 

When Not to Release Patient Health Information to the Media

 

A patient’s right to privacy surpasses the media’s desire for information—even if some of the information can be considered a matter of public record. Under HIPAA, the following situations dictate that health care facilities not release patient information:

 

• Patients who opt out of providing information. [Name of facility] must inform patients what information will be included in the [name of facility] directory and to whom that information will be disclosed. The patient has the option to expressly state that he or she does not want information released, including confirmation of his or her presence in the facility under the Privacy Rule right to request restriction.
• Information that could embarrass or endanger patients. [Name of facility] should not report any information that may embarrass a patient. Such information could include the room location of the patient, such as admission to an obstetrics unit following a miscarriage or admission to a substance abuse treatment ward or facility. [Name of facility] should not report a patient’s location within the facility—or even confirm the patient’s presence in the facility—if that information could potentially endanger the patient, such as if the health care facility has knowledge of an abusive partner, who has communicated a threat, and so forth.
• Other federal or state laws provide more privacy protection than HIPAA. Some federal and state laws specifically prohibit hospitals and other facilities from releasing any information about patients who are being treated for alcohol or substance abuse or mental or developmental disabilities. This prohibition includes acknowledging, even in response to specific inquiries, that a patient is being treated in a facility if doing so would identify the patient as being the recipient of these services. Other laws govern other categories of health information in this jurisdiction and limit disclose to the media as follows: [List such categories of health information that provide extra privacy/confidentiality protection.]

 

• Matters of Public Record. Matters of public record refer to situations that are reportable by law to public authorities, such as law enforcement agencies, the coroner, or a public health officer. Public record cases, however, are no different from other cases with regard to the release of information. Thus, even though public record cases may result in increased media inquiries, health care facilities must take the same precautions to protect patient privacy as in other situations, including the HIPAA requirement that information be released only if the inquiry specifically contains the patient’s name. For example, in the case of a facility patient who is physically harmed by elder abuse that is reported to the appropriate state agency as required by law, a media representative must have the abuse victim’s name before [name of facility] can provide any patient information. The fact that [name of facility] has an obligation to report certain confidential information to a government agency does not make that information public and available to the news media. [Name of facility] should refer media questions on matters of public record to the appropriate agencies, such as police, fire, coroner’s office, child protective services, and so forth, for their determination as to whether release to the media is proper.

 

Disasters

 

Disaster situations require facilities to operate in fluid, often life-threatening situations. [Name of facility] must balance the need to keep the public informed against the privacy rights of patients and their families. In such highly charged situations, [name of facility] may release information that is beneficial to the public good, but extra care must be taken to protect information that can be linked to a specific patient. Rules governing the release of patient information to the media do not change in disaster situations—that is, a reporter must have a patient’s name before any information can be released to the media.

 

• When possible, notify next-of-kin before disclosing information to the media. Although it is desirable to notify next-of-kin before releasing patient information, in disaster situations involving multiple casualties, it may be necessary to share patient information with other health care facilities and/or rescue/relief organizations prior to next-of-kin being contacted. [Name of facility] workforce members may tell the media the number of patients that have been brought to the facility by gender or age group, such as, for example, adults, teens, children, and so forth, and the general cause of their treatment needs, such as, for example, an explosion, an earthquake, and so forth, so long as it is not identifiable to a specific patient.
• [Name of facility] may release patient information to hospitals, other health care facilities, and relief agencies in situations where multiple facilities are receiving patients from one disaster. [Name of facility] workforce members are encouraged to cooperate and facilitate the exchange of information regarding patients’ location and status to such organizations. [Name of facility] may disclose patient information, such as location, general condition, or death, to a public or private organization assisting in relief efforts for the purposes of notifying family members or others responsible for a patient’s care.
• [Name of facility] will have a designated spokesperson available at all times during an emergency. Because of the rapidly changing nature of disasters and the critical role that [name of facility] may play during and following a disaster, a [name of facility] spokesperson should be available to the news media at all times. The spokesperson should have immediate access to [name of facility] administrative and clinical workforce members so that he or she can provide accurate, up-to-date information to the media. [Name of facility] should, where appropriate, designate a central media gathering location to release information in a press conference format that does not compromise patient privacy or the [name of facility]’s need for added security in a disaster situation. In the case of mass casualties, the spokesperson may release basic patient information, such as the aggregate number of victims, their genders, and their general conditions. [Name of facility] may not, however, release individually identifiable patient information except as authorized above.

 

Enforcement

 

All officers, agents, employees, and other workforce members of [name of facility] must adhere to this policy, and all supervisors are responsible for enforcing this policy. [Name of facility] will not tolerate violations of this policy. Violation of this policy is grounds for disciplinary action, up to and including termination of employment, and criminal or professional sanctions in accordance with [name of facility]’s medical information sanction policy and workforce members rules and regulations.

 

_________________________________                  ______________________________

Signature of Officer, Agent, or Employee                 Date

 

_________________________________                  ______________________________

Title of Officer, Agent, or Employee                         Printed Name of Officer, Agent, or

Employee

 

_________________________________                  ______________________________

Witness                                                                       Printed Name of Witness

 

Appendix A

 

SAMPLE MODEL RELEASE

 

For valuable consideration, receipt of which is hereby acknowledged, I, the undersigned model (“Model”), hereby grant [name of facility], [name of facility]’s legal representatives and successors, as well as persons and companies acting with [name of facility]’s permission, the irrevocable right and permission, throughout the world, in connection with the photograph(s), videos, and/or recording(s) in any other form, format, or medium that [name of facility] has taken of me, or in which I may be included with others, the following: (a) the right to use and reuse and publish, in any manner at all, said photograph(s), videos, and/or recording(s) in any other form, format, or medium, in whole or in part, modified or altered, either by themselves or in conjunction with other photograph(s), videos, and/or recording(s) in any other form, format, or medium, in any medium or form of distribution, including the internet, and for any purposes whatsoever, including, without limitation, all promotional and advertising uses, noncommercial or commercial display, broadcast, exhibition of the final production, and other trade purposes, as well as using my name in connection therewith, if [name of facility] so desires; and (b)  the right to copyright said photograph(s), videos, and/or recording(s) in any other form, format, or media in [name of facility]’s own name or in any other name that [name of facility] may select.

 

I waive the right to inspect or approve the finished product or copy and any use thereof.

 

I agree that the photographs, reproductions, and negatives thereof, videos, and/or recording(s) in any other form, format, or medium shall constitute [name of facility]’s sole property and that [name of facility] has the full right to dispose of any and all of them in any manner whatsoever.

 

I hereby forever release and discharge [name of facility] and [name of facility]’s respective representatives, licensees, successors, and assigns from any and all claims, actions, and demands arising out of or in connection with the use of said photograph(s), videos, and/or recording(s) in any other form, format, or medium, including without limitation, any and all claims for invasion of privacy and libel.

 

I acknowledge that I signed this release document willingly and of my own accord, and I certify that I am not a minor and that I am free and able to give such consent.

 

Model’s name: ___________________________________________________________

 

Model’s signature: ___________________________________ Date: ________________

 

Model’s address: _________________________________________________________

 

Model’s phone: ____________________ Model’s email address: ___________________

 

For [name of facility]: Printed name: ___________________________________

 

Signature: __________________________________________ Date: _______________

 

Note: The above form is only a guide to get covered entities started with developing a model release form. It may need editing/additions/deletions. As with any sample of this nature, qualified legal counsel should review and approve the final version.