Journalists struggle to balance reporting on Ebola with HIPAA
Journalists covering the Ebola story are struggling to find a balance between patients' rights, the public's need to know what is going on and the uncomfortable feeling that innocent people caught up in this story will be "marked" for life.
A little more than a week ago, Nina Pham was a nurse who was helping to care for a Liberian man who was dying from Ebola in a Dallas hospital. This week, she showed up on a YouTube video, lying in a hospital bed recovering from the virus herself.
WFAA-TV News Director Carolyn Mungo, a frequent guest faculty member at Poynter, told me that she worries about the long-term effect being linked to the Ebola story will have on Pham and so many others.
"When health officials said that Thomas Duncan (the first Ebola patient to die in the United States) could have exposed several children who attend Dallas schools, the school system alerted parents at those schools. Parents wanted to know which classes the children attended," Mungo said. "The school system cited privacy concerns and would not identify the classrooms. But the parents pointed out that when there is a lice outbreak, the schools send home notes naming classrooms. They wanted to know why this potentially more serious alert provided less information."
That was just the beginning of the privacy concerns that would arise.
"The police released a name and a photo of a homeless man who Duncan might have come into contact with. They just wanted to talk with the man, but we had to decide how much we would spread the man's name and picture. Eventually we chose to show his picture and not name him, then when police found him and talked with him and found out he was not sick, we quit using the photo," she said, but Mungo agreed that the images probably do still exist online somewhere.
"Mr. Duncan's family is quarantined right now and will be for a few more days. We know where they are but we have chosen not to report that," Mungo said. "There has been a lot of pressure from the public for officials to say where the family was moved. Our concern is where can this family go to start over? They have been branded, they may be forever linked with this virus."
Then there was the tough call about whether to name the deputy who stopped by a medical clinic saying he was feeling sick and that he had been inside Duncan's apartment. The response was overwhelming.
"People showed up at the clinic in hazmat suits. One of our people noticed the license plates of the man's car and we traced the plates. We realized that a few days before, we had interviewed him as he complained that he had been sent into the apartment without protective gear." Mungo said, "Because he had talked with us on camera, complaining about not being protected, we made a decision to use his name and image. He chose to go public before and that became a big part of our decision."
Journalism v. HIPAA
A health story of national proportions like the Ebola story pits the role of journalism against HIPPA rules. HIPAA (American Health Insurance Portability and Accountability Act of 1996) restricts patient information to doctors, direct caregivers, insurance companies and others expressly named in the Act.
A top medical ethicist says the law allows some leeway when a national health crisis is involved, but those loopholes do not apply to journalists.
"There is a clause about 'contact tracing' that lets public officials not directly involved in the patient's care to get information," said Dr. Art Caplan, head of the Division of Bioethics at New York University Langone Medical Center. "Even when an otherwise private health matter becomes a national concern, the medical community has to use some common sense about HIPAA. The public may need to know where the infected person went, who else may have been exposed."
The Health and Human Services website gives similar advice, "the Rule permits covered entities to disclose protected health information without authorization for specified public health purposes." In fact, HHS says, there are several HIPAA exemptions.
The Privacy Rule permits covered entities to disclose protected health information, without authorization, to public health authorities who are legally authorized to receive such reports for the purpose of preventing or controlling disease, injury, or disability. This would include, for example, the reporting of a disease or injury; reporting vital events, such as births or deaths; and conducting public health surveillance, investigations, or interventions. See 45 CFR 164.512(b)(1)(i). Also, covered entities may, at the direction of a public health authority, disclose protected health information to a foreign government agency that is acting in collaboration with a public health authority. Covered entities who are also a public health authority may use, as well as disclose, protected health information for these public health purposes.
When Thomas Duncan died from Ebola in Texas, the hospital where he was being treated pointed out that patients can "opt in" or "opt out" of allowing their information to be released to journalists or others who call the hospital asking about the patient's condition. A patient can even restrict who knows if a person has been admitted at all. And even hospital employees who are not involved in a patient's care cannot go pawing through a patient's records. Two hospital employees in Nebraska were fired for looking through Dr. Rick Sacra's records when he was being treated for Ebola.
MedPage Today interviewed Michelle De Mooy, deputy director for consumer privacy at the Washington-based Center for Democracy and Technology, who helped sort out what is an is not private in times of a national health concern:
So "when the hospital workers in Nebraska looked at the records of the doctor with Ebola, they still violated HIPAA, but when the 'hospital' officially announced the negative test results of a deputy sheriff in Dallas who was tested for Ebola, they did not," she toldMedPage Today in an email. "My guess is their explanation for publicly announcing this would be to keep the community from panicking."
HIPAA privacy rules would allow hospitals to release general information about a patient without releasing the person's name, Caplan said.
"The public should know where the infected person traveled, who else could have been exposed, for example."
Mungo said even when people on the periphery of the Ebola story volunteer to be named and interviewed, she urges them to be thoughtful about the long-term effect of being on TV.
"We heard from a man who was on the Frontier airline flight from Ohio to Dallas," Mungo said. That was the flight that Ebola-infected nurse Amber Vinson flew on.
"Two schools in Royse City, Texas closed Friday because the man's kids went there," Mungo said.
There is no proof the man or the children were exposed at all, but the schools closed to clean classrooms they attended and sent a systemwide alert out. Other school systems sent out alerts saying they too had children of parents on that flight. Three other Texas schools closed on Thursday.
"Every day we face these kinds of decisions," Mungo said. "We want to report as much specific information as we can, but we worry a lot about what lasting damage will come to the people who get caught up in this story."