Update, June 13, 2016: On Sunday, Buddy Dyer, the mayor of Orlando, stated on CNN that he had asked for the White House to waive certain HIPAA regulations in order to encourage faster sharing of information with victims’ family members and indicated that the White House had complied. In fact, the White House did not waive any portion of HIPAA regulations on Sunday. The Department of Health and Human Services stated Monday that the necessary information sharing was already allowed under the HIPAA law as it is written, as the law states that medical professionals are allowed to share information without consent in an emergency circumstance as long as they exercise “professional judgment.” This post, which was written based on Dyer’s characterization that the White House had waived HIPAA laws, explains how that would have happened under Section 1135 of the HIPAA law, and argues for why it would have been the appropriate response given the circumstances unfolding in Orlando on Sunday.
Over the past two decades, the term HIPAA has effectively become synonymous with medical privacy. But guarding medical privacy was not, and is not, the only goal of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). On the contrary, HIPAA was initially enacted to facilitate the necessary flow of health information while simultaneously taking care not to compromise individuals’ rights to retain control over privileged information. Under normal circumstances, each patient retains the right to control exactly who is permitted to know his or her health information—this prevails over almost any other concern or interest. When a patient is unable to state his or her wishes, the list is limited to the patient’s spouse or next of kin. This default has long created a harsh reality in which even the long-term significant other of a patient in critical condition would receive no information—a point which became a pivotal and effective rallying cry in the struggle for and eventual triumph of marriage equality in the U.S.
So it is perhaps especially poignant that, in the aftermath of the deadliest shooting to date on American soil, at a gay nightclub in Orlando, Florida, the White House applied a unique waiver to HIPAA. In declaring the situation in Orlando a national emergency, President Barack Obama and Secretary of Health and Human Services Sylvia Mathews Burwell made it easier for family and friends to gain quicker access to information—the right move in such a circumstance.
That’s because the individual patient is not the only stakeholder when it comes to health information. In fact, HIPAA was specifically written to ensure public well-being—something that becomes very relevant in cases of emergency, when panicked people are waiting in a hospital for critical news. While the original law does allow physicians to share information with a patient’s family, friends, or other health care providers if a “reasonable inference” could be made based on the circumstances, this is generally approached with great caution and most doctors err on the side of maintaining silence. Which is why it’s so critical that Obama was able to invoke a revision of the Social Security Act (Section 1135), which was enacted after the Sept. 11 attacks, and explicitly authorizes health care providers broad exemptions from the normal privacy safeguards relating to sharing a patient’s protected health information—especially with friends and loved ones in the event of an emergency.
Section 1135 waivers are both narrow and brief in their application. The waivers apply only to an “emergency area” and only during an “emergency period,” which in most circumstances should last no longer than 72 hours. In order for a waiver to be granted, two conditions must be met: the president must declare a “National Emergency” and the secretary of the Department of Health and Human Services must declare a public health emergency. Only when these conditions co-exist may a waiver legally be authorized.
The waiver does not suspend HIPAA entirely. Far from it: In fact, Section 1135 waivers limit a very finite number of exceptions to the HIPAA law. Specifically, the waivers protect health care providers from the usual sanctions and penalties that might be levied against them as a result of noncompliance with HIPAA privacy regulations. The most relevant carve-outs certainly pertain to the situation in Orlando, where there are reports of numerous families asking for providers at the receiving hospital to release health information about their loved ones. Such information would normally be HIPAA–protected, but verifying a patient’s consent to speak with family members or friends about that patient’s condition is often impossible, or impractical, after a mass shooting. And it would be cruel to deny families such information.
It is remarkable that, to my knowledge, a Section 1135 waiver has only been granted once before, during the rescue operations after Hurricane Katrina. Frankly, that’s likely due to the fact that the law is simply not that old. Sadly, though, it appears its use has become more relevant and, until we move to keep assault rifles out of the wrong hands, is likely to be invoked again in the future.
Disclaimer: The opinions expressed in this article are solely those of the author and do not reflect the views and opinions of Brigham and Women’s Hospital.
