The Kentucky Enquirer Filed A Written Request With The Covington Police Department For A Police Report Detailing A Fatal Garbage Truck Accident

news enquirer, Feb 25, 2005

FORT MITCHELL, Ky. - Designed to give people privacy in an electronic age, the Health Insurance Portability and Accountability Act of 1996, known as HIPAA, has lessened the public's access to public records across the nation.

Police departments have cited it as a reason to withhold information. Nursing homes have cited it as a reason not to inform residents about registered sex offenders living in their midst. And health departments have cited it for not reporting diseases.

As interpreted in 2003 by the U.S. Department of Health and Human Services, which that year developed privacy rules, it has prevented the release of public records across the nation, said Lucy Dalglish, executive director of the Reporters Committee for the Freedom of the Press.

"Health care agencies are uncertain of what the law actually is, so they err on the side of complete closure," Dalglish said, adding that the privacy rule has had an enormous impact on the public.

The goal of HIPAA was to protect the public by giving people more control over their health information and how it is used.

Anyone who has gone to the hospital or picked up a new prescription since 2003 is now asked to sign forms acknowledging they understand their rights under the federal privacy rules. Anyone who has called to check on a relative's condition in a hospital may have been denied the information.

According to the First Amendment Center, HIPAA applies only to businesses or agencies that bill or receive payment for health-care services or transmit information for payment in electronic form. Businesses or agencies covered by HIPAA generally cannot disclose, without the patient's consent, personally identifying information such as names, addresses or specific medical condition.

Health care providers face civil or criminal penalties for violating the federal law. Criminal penalties include fines from $100 to $250,000 and 10 years in prison. The Office of Civil Rights recently announced that "ignorance and confusion" about HIPAA are the basis of many of the more than 6,000 complaints it has received. To date, the federal government has not sought civil monetary penalties or other official sanctions for any cases it has investigated.

According to the First Amendment Center, in most cases, a hospital cannot give journalists a patient's name. However, the hospital should be able to confirm if a patient the journalist names is in the hospital and provide some additional details such as general medical condition, an age range and a general address that includes the person's state or region.

The Health and Human Services agency has acknowledged on its Web site that health privacy rules should not impede newsgathering by journalists from sources not covered by the privacy rules.

Such sources might include police officers who are giving information about victims in emergencies, according to Jon Fleischaker, Kentucky Press Association general counsel and an attorney with the Louisville law firm Dinsmore & Shohl.

News organizations have had difficulty obtaining basic information on accident victims or victims of violence.

"We have police who confirm there was an accident, ambulance workers who say they are taking a patient to a certain hospital, but then the hospital denies the patient is there or that they were even treated," said Ron Clark, city editor of The Paducah Sun. "We aren't asking for details about their injuries or personal information," Clark said. "What we want is whether they have been admitted, and whether their condition is serious, critical or satisfactory."

Clark said health departments even used HIPAA to deny the newspaper's efforts to get photographs at a flu shot clinic.

"When our photographer walked in, a worker stood in front of him and told him there would be no pictures," Clark said.

In August, the Kentucky Attorney General ruled in a case involving The Kentucky Enquirer that HIPAA privacy rules do not supersede the state's open records act.

In April 2004, The Kentucky Enquirer filed a written request with the Covington Police Department for a police report detailing a fatal garbage truck accident. The report was issued with redacted names, addresses and birth dates of the driver and three "involved persons," including the person who was killed.

When the paper appealed the redactions to the state attorney general's office, Covington responded that HIPAA prevented city police and fire personnel from releasing any information that would identify a person who had been treated by city emergency medical personnel.

On Aug. 24, Attorney General Gregory D. Stumbo ruled that HIPAA did not apply to police department records.

Paul Alley, an attorney with Graydon, Head & Ritchey of Cincinnati, who represented The Kentucky Enquirer in its case against Covington police, said the problem that often arises is that public agencies jump right to the conclusion that HIPAA applies, and they don't provide information that is, in fact, public.

"It's unfortunate that some government agencies occasionally withhold records based upon a flawed understanding of the scope and application of HIPAA" Alley said.