HIPAA likely standard for state privacy actions
ED gossip could be costly, lawyer warns
Although the Health Insurance Portability and Accountability Act (HIPAA) does not create a private right to sue health care workers who leak information, state laws do, points out Stephen A. Frew, JD, a web site publisher (www.medlaw.com) and risk management consultant for Physicians Insurance Co. of Wisconsin in Madison. More importantly, Frew adds in a recent report, HIPAA probably will come to be the standard of care for these state actions.
"Emergency departments [EDs] are the place to work for those who have inquiring minds and want to know every little tidbit about what is going on in the community," says Frew, a longtime specialist in Emergency Medical Treatment and Labor Act (EMTALA) compliance. "Unfortunately, the good’ information leaks out hospitalwide within minutes to hours, and into the community almost as fast. That has been one of the factors giving rise to HIPAA privacy regulations."
In a case decided before HIPAA implementation, he says, Wisconsin courts upheld a verdict against an emergency medical technician (EMT) for $3,000 plus more than $30,000 in attorneys’ fees, double court costs, and interest dating back to the date of the event for leaking information about a patient.
Costly gossip
The EMT responded to a 911 call for a woman for "possible overdose," Frew continues. After transporting the patient to the hospital, the EMT called a friend who worked for the woman and told her that the woman had attempted suicide with a drug overdose. The story got out immediately — the friend had a reputation as a major gossip — but even if it hadn’t gone further, he explains, a violation of the patient’s right to privacy occurred with the telling of just one person.
The patient sued for invasion of privacy that involved intentional actions, Frew says, and qualified for additional damages under Wisconsin law. The EMT, the volunteer fire department for which she worked, the gossip, and others were named in the suit. Another format for suit is simple medical malpractice for breach of confidentiality, he notes.
In most cases, the plaintiff will sue for all possible causes of action and seek the maximum recovery, Frew points out. Whether the leak is intentional or caused by negligence, it can result in significant liability. Breach of a health care provider’s own HIPAA policies is generally proof of negligence, he adds.
While HIPAA rules are ungainly and do not conform to usual operating practices in most EDs, Frew says, it is time for a culture change. Just as EMTALA brought about a drastic change in how hospitals operated with regard to transferring and treating patients, HIPAA will bring a drastic culture change in the ED, hospital, and physician office when it comes to gossip and snooping, he predicts.
"HIPAA may be a pain, but the message is being sent just like it was with EMTALA," Frew says, "and hopefully folks will get the message a lot faster than they got’ EMTALA. This is serious business, and I can assure you there are plaintiffs’ lawyers who will be advertising on TV with bargain rates and free consultations for privacy violations."
ED staffing levels addressed
Regarding the ongoing challenge with EMTALA compliance, Frew reminds health care providers that while EMTALA itself does not specify ED staffing levels, the Medicare conditions of participation do require adequate staffing. Frequently, hospitals ask what the proper staffing ratios are, he says, and the Centers for Medicare & Medicaid Services (CMS) typically does not provide an answer, except in cases where the staffing levels result in other EMTALA violations. Even then, he adds, CMS generally does not specify a level, but ultimately must be satisfied with a specific level in the plan of correction.
Providers throughout the country should be aware that California rules have had a profound influence on what CMS deems appropriate under EMTALA, Frew suggests. "California has announced its revised staffing ratio regulation, and you may see its influence creep into your own regional EMTALA enforcement in years to come."
The California standard is a maximum of four patients per registered nurse in the ED, but that ratio is not the end of the specifications, he notes. Use of the word "maximum" indicates staffing need is based on high-volume periods, Frew says, and then backup provided for contingency situations. Another catch, he adds, is that triage nurses, nurses assigned to emergency medical service radio, and other nurses assigned to special duties are not counted in determining the staffing level compliance.
Yet another catch, Frew points out, is that admitted patients who are held in the ED generally are expected to receive the standard of care that an admitted patient in the destination service would receive, which means that additional nurses — preferably from the destination unit — have to be added in many cases.
A question that so far is unanswered, he says, is whether the standard is for patients in treatment only, or also applies to patients awaiting care. While at present, only California facilities will be judged on these ratios in EMTALA citations and medical malpractice suits, Frew adds, they may be coming soon to other EDs.
Although the Health Insurance Portability and Accountability Act does not create a private right to sue health care workers who leak information, state laws do, says Stephen A. Frew, JD, a web site publisher and risk management consultant for Physicians Insurance Co. of Wisconsin in Madison. More importantly, Frew adds in a recent report, HIPAA probably will come to be the standard of care for these state actions.
Subscribe Now for Access
You have reached your article limit for the month. We hope you found our articles both enjoyable and insightful. For information on new subscriptions, product trials, alternative billing arrangements or group and site discounts please call 800-688-2421. We look forward to having you as a long-term member of the Relias Media community.