A quick update on what HIPAA does NOT cover...

Government agencies generally issue updates and guidance that expands the scope of their authority and takes an extraordinarily broad view of their powers (cough upcoming OSHA vaccine mandate cough). In a rather unusual move, HHS has issued guidance explaining what HIPAA does not cover. See HIPAA, COVID-19 Vaccination, and the Workplace. 

Let me start by assuring you that HIPAA is, in fact, spelled with two As and one P. The full guidance has more in-depth answers, but the high level overview:

1. Does the HIPAA Privacy Rule prohibit businesses or individuals from asking whether their customers or clients have received a COVID-19 vaccine? 

 

No. 

Not official use.

2. Does the HIPAA Privacy Rule prevent customers or clients of a business from disclosing whether they have received a COVID-19 vaccine? 

No. 

3. Does the HIPAA Privacy Rule prohibit an employer from requiring a workforce member to disclose whether they have received a COVID-19 vaccine to the employer, clients, or other parties? 

No. 

 4. Does the HIPAA Privacy Rule prohibit a covered entity or business associate from requiring its workforce members to disclose to their employers or other parties whether the workforce members have received a COVID-19 vaccine? 

No. 

So, what does it do? 

5. Does the HIPAA Privacy Rule prohibit a doctor’s office from disclosing an individual’s protected health information (PHI), including whether they have received a COVID-19 vaccine, to the individual’s employer or other parties? 

Generally, yes. The Privacy Rule prohibits covered entities25 and their business associates26 from using or disclosing an individual’s PHI27 (e.g., information about whether the individual has received a vaccine, such as a COVID-19 vaccine; the individual’s medical history or demographic information) except with the individual’s authorization or as otherwise expressly permitted or required by the Privacy Rule.

I have seen a ton of misinformation flying around about HIPAA protections. So, while it is unusual to issue this kind of guidance, I also need absolutely no explanation for why they published it. 

Filming Police Encounter . . . A HIPAA Violation? - COTW #125

The St. Paul Pioneer Press reports Little Canada man videotaped sheriff's deputies, and got charged for it (HT: Volokh Conspiracy). A man recorded an encounter between police and a bloody-faced man outside of his apartment building. The police officer confiscated the camera, allegedly stating that she was just taking it for "evidence." The filmer was later charged with obstruction of legal process and disorderly conduct.

What possible justification could the police have for such an action? Did you say HIPAA? Probably not, because that wouldn't make any sense . . . wait . . . oh dear:

The deputy wrote on the citation, "While handling a medical/check the welfare (call), (Henderson) was filming it. Data privacy HIPAA violation. Refused to identify self. Had to stop dealing with sit(uation) to deal w/Henderson."

Let's see what a Stanford law professor has to say about that:

The allegation that his recording of the incident violated HIPAA . . . is nonsense, said Jennifer Granick, a specialist on privacy issues at Stanford University Law School.

The rule deals with how health care providers handle consumers' health information.

"There's nothing in HIPAA that prevents someone who's not subject to HIPAA from taking photographs on the public streets," Granick said. "HIPAA has absolutely nothing to say about that."

That sounds about right to me.

Now, you may be thinking "Phil, what does this have to do with employment law? Wait, is this just another shameless ploy to promote your Medical Records Law seminar?" Absolutely Nope, it's a solid reminder about one of the first things you should do when accused of violating a law: Check to see if the law even applies to you! Or, in HIPAA parlance, are you a "covered entity?" Also, some of you may remember that I have a personal interest in the right to photograph and film public places!

Medical Records Law Seminar on September 23, 2010

On September 23, 2010, I will be speaking at a seminar on Medical Records Law in Altoona, PA. Specifically, I will be speaking on:

HIPAA

• What Is It?
• Prohibitions on Use and Disclosure
• Patient Rights
• Business Associates
• Preemption and Exceptions
• What's Not Covered Mental Health, HIV, Others?
• Everyday Application
• Amendment and Correction of Records
• Requests From Attorneys
• Requests From Workers' Compensation Carriers
• Requests From Employers
• Law Enforcement Requests
• Disclosures Without Authorization

My McQuaide Blasko colleague, and member of the Health Law and Litigation practice groups, Jon Stepanian, will also be speaking. Jon recently launched a health law and policy blog, Defense of Medicine, featuring contributions from some other McQuaide Blasko Health Law and Litigation folks.

I'll steal reuse some language from his announcement of this event:

This will be a great event to network with other professionals in the area and an opportunity to learn a few points related to developments in the law affecting medical records. You can learn more about the seminar here, including the other faculty members and agenda. CLE credit is available for attorneys and other credits are available through the American Health Information Management Association, the Institute of Certified Records Managers, the National Association of Long Term Care Administrator Boards, and other professional associations as noted on the seminar information page.

We hope to see you there!

Posted by Philip Miles, an employment lawyer with McQuaide Blasko in State College, Pennsylvania.

HIPAA, ADAAA and Other Random Letters

Tonight's post is my first dual HIPAA and ADAAA post... I'm pretty sure it will be my last as well. Contrary to the tongue-in-cheek title, the letters are not random, in fact they are acronyms for acts of Congress. They are: the Health Insurance Portability and Accountability Act (HIPAA); and the Americans with Disabilities Act Amendments Act (ADAAA). They both have big (albeit unrelated) news, hence this post.

HIPAA

Part of the Stimulus plan (American Recovery and Reinvestment Act of 2009, ARRA if you're feelin' the government acronyms thing) required HHS to pass new regulations. The regulations will require covered entities to "provide notification in the case of breaches of unsecured protected health information."

The new HHS regs are here and they take effect tomorrow (today for my email subscribers)! The final rule takes effect September 23, 2009. Fortunately, the kind folks at DLA Piper have written a nice little summary.

ADAAA

The ADA Amendments Act took effect at the start of this year. Congress delegated some regulatory tasks to the EEOC. An EEOC press release indicates that the proposed new regs will be published in the federal register sometime this week. But hey, why wait? Through some magic, the folks at HR Hero tracked down and shared a copy today. I haven't read all 93 pages yet but I will provide additional coverage soon. One final note, the EEOC also published some Q and A on the proposed rules.