HIPAA doesn't apply to rich hospital donors

I’ve written a lot lately about caring for our patients, and about caring for our spouses, and those things make me very happy. But now and then, things rub me the wrong way.

I was recently working at TMH, or Tiny Memorial Hospital, my vague name for small facilities since I work at several and wish to preserve their anonymity. While there a patient checked into the ED for a fairly unremarkable complaint, for which she was evaluated and treated in a reasonable time.

But before she left, we received a phone call from the “mother ship.” TMH is part of a large system of hospitals. The phone call was from the “foundation.” Turns out our patient was a donor well known to said foundation.

Mind you, we never called them, texted them, emailed or faxed them. No consultants were contacted, no transfers arranged. We were just doing our simple doctor and nurse thing. But the Mother Ship was inquiring how she was. Which means that someone was notified about her visit to the ED.

Now mind you, it may be that she agreed to this in the process of supporting the institution. Maybe it was a perk. I didn’t ask.

But what bothers me is that if any one of the nurses on staff had so much as looked up their own lab work, they would have been terminated for a violation of HIPAA, the privacy statute.

This is a common policy, but let me repeat it: According to most hospitals’ interpretation of federal privacy statutes, looking up one’s own results on the hospital computer is a firing offense. Not only so, but spyware is installed so that the staff’s home addresses are cross-linked to those of their neighbors just in case they look up someone else’s information: a friend who asks for information, for instance.

Furthermore, I cannot even hand a patient his or her lab work to take to his or her physician the next day. Why? It’s a violation of privacy. I don’t understand, but I doubt if I’m supposed to understand. (Almost all things federal dwell in a kind of fog impenetrable by logic and reason.)

But donate enough and someone will know when and where you went to the ER. And that’s just good customer service, right? Right.

Privacy, HIPAA, is for little people.

And yet: Quis custodiet ipsos custodes?

“Who will guard the guards themselves,” or as it is commonly rendered, “who watches the watchers?”

I don’t know, but I guess we all need to watch ourselves lest we end up fired.