Replies

Sorry, but it doesn't say anything about being CURRENTLY hospitalized.

I should have remembered from our previous discussions that you read things to say what you want them to say, rather than what most people would see. Let’s break it down for you

The directory exception says Covered hospitals and other covered health care providers can use a facility directory to inform visitors or callers about a patient’s location in the facility and general condition.
The Minimum necessary standard says “that protected health information should not be used or disclosed when it is not necessary to satisfy a particular purpose or carry out a function. The minimum necessary standard requires covered entities to evaluate their practices and enhance safeguards as needed to limit unnecessary or inappropriate access to and disclosure of protected health information. “
That means the minimum necessary may be disclosed for the purpose of providing a directory of patients in the hospital or recently discharged.
Disclosing directory information about a patient who was discharged over 50 years ago falls waaaaay outside “carrying out the function” “to inform visitors or callers about a patient’s location in the facility and general condition. “

This is simply a ridiculous excuse. HIPAA didn't make previously disclosed information illegal to disclose. What a stupid, stupid, stupid thing to suggest.

It seems stupid, but you don’t understand HIPAA – that’s the way it works. Hospitals are not allowed to disclose, whether it’s in the public domain or not. Even if the patient discloses the information, the health care entity is still not allowed to publicly release or discuss the information.

Healthcare providers have a continuing obligation to protect PHI following treatment of a patient, and this obligation is not destroyed by a patient’s self-disclosure of the PHI to an online audience. A provider who discloses PHI it obtained or created in treating the patient without the patient’s specific authorization to do so violates HIPAA, even if the patient has publicly discussed the same or similar information with numerous others.. So the fact that the information may have been previously disclosed, even by the patient, has no effect on the hospital’s duty to keep PHI confidential. Unless there is express written permission, it can’t be released.

I just told you the law in Hawaii required permission to disclose the address. That permission would have been obtained at the hospital if that was where the birth occurred. It's the exact same kind of permission that would be needed to disclose directory information under HIPAA.

Wrong. A release signed by a parent for the Hawaii DOH to release an address in 1961would not be sufficient for the hospital to now release information. The hospital would have to have a signed release form that was HIPAA compliant to release it now.

Only when you ignore the parts about administrative requests, identifying suspects and suspected victims of crime (which would include suspected birth certificate fraud) ...

Read a little more carefully, especially the part early on that says “subject to specified conditions” and think about what you read. Hospitals are very wary about disclosing PHI. They usually want a subpoena or court order. The posse has one of those? Has it been presented to an administrative tribunal? Try telling a hospital in Hawaii that a Sheriff’s posse from Arizona can make an administrative request that they should honor. Further, identifying a suspect is not persuasive – if forgery is proved, everyone knows quite well who the suspect is, and doesn’t need PHI. The hospital will be well within its rights to demand a court order, and this has ultimately been thrown out every time it’s brought to court. Good try. No one can be fined for permissible disclosures, so despite your melodrama, let's focus on the facts once again. There is NO LEGAL REASON this information cannot be disclosed to the investigators.

Wrong again. You obviously are not familiar with HIPAA, and how concerned hospitals are with regard to violations. You declare it legal – I’m sure hospitals are rushing to listen based on your well-known expertise litigating HIPAA… what’s that, you have none? Not surprising you don’t understand the law.

Present Kapiolani with a court order or subpoena, and they should comply. Absent that, I doubt they will disclose PHI, and are undoubtedly concerned about violating HIPAA and the fines.

I should have remembered from our previous discussions that you read things to say what you want them to say, rather than what most people would see.

You should have remembered that this is what YOU do and NOTHING in what you are citing says ANYTHING about needing to be currently hospitalized. You're simply playing a dishonest game of connect-the-dots. You've shown absolutely nothing over which the time element would make a disclosure impermissible, especially when permission had been obtained at the time of admittance. A confirmation that a patient was admitted meets the minimum necessary standard. Again, there's nothing that says there's a time element that invalidates directory information. As for the self-disclosure, your links aren't bringing up anything to back up the quoted material.

Wrong. A release signed by a parent for the Hawaii DOH to release an address in 1961would not be sufficient for the hospital to now release information. The hospital would have to have a signed release form that was HIPAA compliant to release it now.

Where does it say this?? Let's see a link.

Read a little more carefully, especially the part early on that says “subject to specified conditions” and think about what you read. Hospitals are very wary about disclosing PHI. They usually want a subpoena or court order. The posse has one of those? Has it been presented to an administrative tribunal? Try telling a hospital in Hawaii that a Sheriff’s posse from Arizona can make an administrative request that they should honor.

It's what the law says: Read it:

"as required by law (including court orders, court-ordered warrants, subpoenas) and administrative requests ...

This is a very BROAD exclusion. It does NOT require a warrant or subpoena, but it INCLUDES those things. There's nothing here that limits where the administrative request has to come from.

Further, identifying a suspect is not persuasive – if forgery is proved, everyone knows quite well who the suspect is, and doesn’t need PHI.

According to whom?? The suspect might be a former hospital staff member who colluded on the forgery (such as the doctor who allegedly signed the long form). Providing a simple confirmation that SAD was what at the hospital could help clear that up. Sometimes law enforcement is trying to make sure a law wasn't broken. There's no compelling reason for the hospital not to cooperate.

And you need to read this. It completely destroys your claims:

HIPAA allows police access to patients, federal judge rules

If law enforcement comes knocking, physicians can disclose limited medical information related to an alleged incident, he said. But if they aren't sure what is required of them, doctors can seek legal counsel and ask to see a legal request.

link to full story

It's time you quit posting ignorance and misinformation about this subject.