HIPAA has exceptions for emergency situations
Following the horrific June 12, 2016, shooting at the Pulse night club in Orlando, Florida, news outlets across the country rushed to report on the events of that night and the aftermath of the tragic situation. While covering breaking news is inherently an imperfect science, multiple news agencies threw caution to the wind and erroneously reported that the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) regulations were waived following the massacre to allow family members easier access to their loved ones’ health information. Although we know that HIPAA regulations were not waived following the shooting, it is now appropriate to take the first steps in analyzing why this confusion swept through the media and why the HIPAA regulations did not need to be waived in this situation.

The catalyst for the confusion surrounding HIPAA and the Orlando shooting was a statement made by Orlando Mayor, Buddy Dyer. After the shooting, Mayor Dyer stated that he sought a waiver of the HIPAA privacy rules to allow health care professionals to release injured or deceased patients’ personal health information (“PHI”) to family members. However, as Roxane Beharry, spokeswoman for the federal Office for Civil Rights at the Department of Health and Human Services, noted in an e-mail, “HIPAA allows health care professionals the flexibility to disclose limited health information to the public or media in appropriate circumstances,” thus negating any requirement for a HIPAA waiver. Specifically, 45 CFR 164.510(a)(3)(i)(B), provides that if an individual is incapacitated or if an emergency treatment circumstance is unfolding, a health care provider may disclose PHI if such disclosure is “in the individual’s best interest as determined by the covered health care provider, in the exercise of professional judgment.” Under normal circumstances, HIPAA restricts health care professionals from releasing and disclosing PHI with individuals other than the patient absent express permission, however, as noted above, HIPAA already has exceptions carved out for emergency situations, such as the Orlando shooting, making the need for a waiver obsolete.

While it is unclear at this time whether health care professionals exercised their professional discretion appropriately following this tragedy, it has been noted that historically physicians have only released PHI to spouses or next of kin. As Ariana Eunjung Cha, Staff Writer for the Washington Post, correctly pointed out, many of the victims in the Orlando shooting may not have had legal spouses because many of the victims were LGBT, and gay marriage has only been legal nationwide since June 26, 2015. This situation may have left health care professionals in the precarious situation of having to provide emergency care while simultaneously making a professional determination as to who may be entitled to know the victims’ PHI. In light of this conundrum, it is understandable how some individuals believed a waiver to the HIPAA privacy rules would have eased the burden on health care professionals to make judgment calls during these chaotic times. Although, ultimately a waiver to the HIPAA regulations was unnecessary in light of the statutory exception.