The myth of when HIPAA gets waived

On the morning of the tragic mass shooting in Orlando, a tweet by CNN stated, “The White House waived HIPAA regulations so that hospitals could talk with family members of shooting victims, says Orlando Mayor Buddy Dyer.”

Many, including me, retweeted this thinking that it was probably unprecedented.

Later that day, several Twitter followers informed me that HIPAA had been waived during Hurricane Katrina. Despite rumors to the contrary about 9/11, Katrina was the only time a HIPAA waiver has ever been issued.

Regarding Orlando, the White House never issued a HIPAA waiver. An article in Slate on Monday explained that HIPAA has provisions stating patient information can be shared without consent in an emergency if a physician feels that there is a need.

Let’s hope the discussion about the supposed waiver is finally over.

The least understood provision of HIPAA concerns the sharing of information between providers. Obtaining information from another physician or a hospital is often hindered by an erroneous belief that a signed consent must be obtained from a patient before protected health information can be exchanged.

Here is what Health and Human Services has to say: “The Privacy Rule allows covered health care providers to share protected health information for treatment purposes without patient authorization, as long as they use reasonable safeguards when doing so. These treatment communications may occur orally or in writing, by phone, fax, e-mail, or otherwise.”

Another myth is that hospitals may not tell visitors or callers that a patient is in the hospital and what his condition is. This information may be disclosed “if doing so is in the individual’s best interest as determined in the professional judgment of the provider.” This applies to patients in the emergency room as well.

Here is more about why a waiver was not needed for the victims of the Orlando shootings.

In a severe disaster, which Orlando certainly was, “Health care providers can share patient information as necessary to identify, locate, and notify family members, guardians, or anyone else responsible for the individual’s care of the individual’s location, general condition, or death.” An incapacitated patient’s protected health information may also be shared with “family, friends, or others” if a provider feels that doing so is in the patient’s best interest.

Clarifications about HIPAA can be found in the frequently asked questions section of HHS.gov.

The most confusing thing about the Health Insurance Portability and Accountability Act apparently is its acronym. Contrary to what many believe, it’s not HIPPA.

Hippa is a genus of decapod crustaceans in the family Hippidae, one of which is the Pacific sand crab.