More HIPAA madness? On Wednesday, in a crime that cast a chill through the mental health community, a Manhattan therapist was brutally slaughtered in her office by a man whose actions seemed consistent with those of a current or former patient with a grudge. The assailant escaped on foot, and although his image had been captured on surveillance tape, police were nowhere near beginning to know where to start looking for him: “Because of privacy laws, police hadn’t been able to access patient records as of late yesterday, sources said.” (New York Post, Feb. 14)(via Bader). On medical privacy laws and the Virginia Tech rampage of Seung Hui Cho, see Jun. 16, 2007.
More: Commenter Supremacy Claus says not to blame HIPAA, which has an exemption for police reports.
Friday morning sequel: This morning’s New York Post sticks with the original story and fleshes out the HIPAA role somewhat:
The hunt for the savage beast who butchered an Upper East Side therapist has hit a roadblock – because detectives can’t access her patients’ medical records under federal privacy laws, The Post has learned.
Police believe the meat-cleaver-wielding psycho who killed Kathryn Faughey on Tuesday night inside her office on East 79th Street could be the doctor’s patient – and need access to her records to identify him.
But police sources said because of the Health Insurance Portability and Accountability Act, signed by President Bill Clinton in 1996, investigators are having a hard time gaining access to those records.
“A case like this gets complicated because of medical privacy protections,” a source close to the investigation told The Post yesterday.
The federal law states that doctors, hospitals and health-insurance companies must protect the privacy of patients – even in a murder investigation – and that only through the use of subpoenas can authorities hope to obtain such information.
Police sources said investigators have applied for a subpoena, but have yet to receive it. Even if the subpoena is issued, patients can sue to keep their records private. …
[D]etectives have tried to get around the law by tracking down patients through sign-in sheets at the building’s front desk and through surveillance cameras in the lobby, sources said.
(Murray Weiss, Jamie Schram and Clemente Lisi, “Vexed by ‘Slay File’ Madness”, New York Post, Feb. 15). My Times (U.K.) article on the problems posed by health privacy laws is here.
14 Comments
“HIPAA madness”? I wonder who’s bullshit is more disturbing – the poorly reported cases like this or those that blog about cases like this who try to make connections to laws they clearly don’t understand.
Walter: HIPAA permits reports to the police. Appellate rulings have upheld such reporting.
Patients may not file civil suits against providers under HIPAA. There are criminal sanctions. However, after 27,000 complaints by patients, only 3 cases resulted in any prosecution.
No. This case is the fault of the pro-criminal and pro-lawyer rent seeking Supreme Court. For 30 years, it has required a dangerous act, and a hearing employing three lawyers before patients can be forced to get treatment. There was never any widespread abuse, and plenty of remedies deterred doctors from commitments in bad faith, in 1975.
Now, this patient qualifies for commitment under these lawyer job generating Supreme Court rules.
Lawyers get low end jobs, 10’s of 1000’s of people die by suicide or homicide from untreated mental illness.
How does the police report exemption work? In this case the police would not be seeking data on a particular person for whom a probable cause might apply. Rather, the police would want the list, with pictures if possible, of the doctors patients. That would violate the privacy of those not involved in the crime.
Personally, I would trust the police here.
While there are exceptions in HIPPA, most medical organizations internal policies do not recognize them or do not understand them. So it is possible that there are delays getting the organization to understand the applicability.
Here, a court upheld the arrest of staff obstructing police access to a patient:
http://www.ama-assn.org/amednews/2007/05/21/gvsc0521.htm
Nice review of police conduct here. The police scrubbed in, took possession of the surgically removed bag of cocaine, arrested the patient.
http://www.wisbar.org/res/capp/2007p/2007AP000822.pdf
If the makers of baby products have ads waiting at the house after learning of wife’s pregnancy, the police should be able to get the file of a maniac butcher still at large.
As SPQR mentions, the rules are not always completely understood.
And with the reaction AT&T got for cooperating “”in good faith” with the government, you can be sure that no one will lift a finger to help until the situation is thoroughly vetted by their lawyers since it could mean jail time or ruin.
Stonewall and be legally safe. Cooperate and risk liability. Odd way of setting up the system I would think.
SPQR has the right of it. Most providers and insurers either don’t understand the law, or, more probably, are too afraid of informing their employees of the true scope of the law. They see the least amount of risk by simply ignoring the existence of the exclusions. Most employees of these providers and insurers can’t be trusted to exercise proper discretion in determining when an exclusion exists to permit disclosure.
Yes, once again, it’s fear of litigation.
If the authorities have not been able to get a subpoena issued in very short order, that is where the finger of blame should be pointed.
yclipse,
I’ll confess ignorance about the details of this case and the law in general. But if the folks in the office are not identifying the individual as a patient because they fear legal action, how would the police justify a subpoena? Would a Judge issue them a hunting license to look through all the files? That seems doubtful.
I think the police would want to start with her appointment book, and a subpoena for that should be specific enough. I suspect the hold up is in police or prosecutor bureaucracy, rather than anything to do with HIPPA.
Police have made an arrest in the case, of a mentally disturbed man who has told investigators of having been committed to a mental institution 17 years ago by Dr. Kent Shimbach, the doctor who was injured in the rampage (and who shared offices with the therapist who was killed, Kathryn Faughey). Dr. Shinbach apparently has told investigators that he did not recognize the assailant and has no memory of any contact with him in the past. More details are in today’s New York Times.
Thank the lawyer rent seeking aims of the Supreme Court in O’Connor v Donaldson. Now the psycho butcher qualifies for involuntary commitment.
Discussion continues at this more recent post.
[…] Are HIPAA privacy rules suspended during emergencies? No, and what lovely situations that’s likely to cause [HIPAA blog, more] […]