HIPAA action
HIPAA dvisory
 HIPAAdvisory > HIPAAction > HIPAA/LAW: Legal Q/A Phoenix Health Systems
news
regs
action
tech
wares
alert
live
latest
online HIPAA training
HIPAAstore
HIPAA help desk
search
contact us
site map

HIPAA/LAW:
December 2003


"HIPAA, Ethics & The New York Times"

by Steve Fox & Rachel Wilson, Esqs., Pepper Hamilton LLP

In the November 16th installment of "The Ethicist," a column appearing weekly in the New York Times Magazine, the Grey Lady addressed an issue near and dear to our hearts: the use and disclosure of protected health information (PHI). Ah, how we love the smell of HIPAA wafting gently by our noses on a Sunday morning along with the aroma of freshly brewed gourmet coffee and scones. Okay, perhaps we are overstating it just a bit, but hey, we got your attention, didn't we?

The column was a response to an ethical question posed by an emergency room (ER) physician. A school-bus driver was admitted to the ER three times over the course of six months. Each time, the driver was agitated, paranoid, threatening, and tested positive for recent cocaine use. The physician counseled the driver, advising him that cocaine use could endanger his young passengers. But to the physician's dismay, the driver shrugged off the information, stating that his drug use was recreational and limited to off-hours. The physician wanted to report the driver to the school-bus company, but the hospital's lawyers directed him not to, citing patient confidentiality. The physician, torn between his desire to protect the children and other drivers on the one hand, and maintaining patient confidentiality on the other, asked The Ethicist (a noted HIPAA expert) for advice. Noting that although it may put the physician "in legal peril," The Ethicist advised the physician to breach patient confidentiality because the driver presented a serious, imminent threat to himself and others. Who was right? The Ethicist or the hospital lawyers?

The Ethicist got it right. At least as far as HIPAA is concerned. Under the HIPAA Privacy Rule, covered entities are not required to obtain patient authorization prior to using or disclosing PHI for the purpose of averting a serious threat to health or safety. However, the disclosure can only be made if the covered entity has a good faith belief that:

  • the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public; and
  • the use or disclosure is directed at a person or persons reasonably able to prevent or lessen the threat.

Because the physician was concerned about the safety of the children using the bus and could not reasonably trust the driver's declarations that his drug use was limited to off-hours, the disclosure would be permissible under HIPAA. Moreover, the disclosure would be made to the driver's employer, a person (or entity) with the power to prevent or lessen the threat posed by the driver's drug use.

We hope that you enjoy a safe and happy holiday season.

Read past HIPAA Legal Q/A articles.


Steve Fox, Esq., is a partner at the Washington, DC office of Pepper Hamilton LLP, www.pepperlaw.com . This article was co-authored by Rachel H. Wilson, Esq., an associate of Pepper Hamilton LLP. They may be reached at foxsj@pepperlaw.com. Disclaimer: This information is general in nature and should not be relied upon as legal advice.

Go to TOP