Should a HIPAA-questionable good deed go unpunished?


On a Saturday morning, Michael, a physician, was making his way through the hospital atrium after his weekend rounds.  On his way out, he noticed a family he knew well.  They were talking quietly and appeared distraught.  He asked them if they were okay.  They said that the husband’s mother had been admitted overnight with a malignant pleural effusion, and since all beds on the oncology floor were full, she had been placed on the general medicine service.

The patient had a primary oncologist, but he was not on call.  The family wanted to take the patient home on hospice, but the team had not decided whether to tap the effusion or place a drain.  As a result, she would be remaining in the hospital over the weekend.

Michael offered to accompany the family to the patient’s room and see if he could help to sort matters out in a timelier fashion.  The family readily agreed, and they accompanied him up to the patient’s room.

After greeting the patient and explaining the situation, Michael made it clear to both patient and family that it would be impossible for him to access the patient’s medical record unless they gave their permission.   Eager to resolve the situation, the family readily consented.  In fact, the patient responded enthusiastically, saying, “Yes, by all means, please do so!”

Michael reviewed the patient’s medical record, determined that there was no medical reason to delay draining the pleural effusion, and reached out to the pulmonary team.  After discussing the case, the pulmonary team arranged to tap the pleural effusion, with plans to place a permanent drain the following week.

With his shortness of breath relieved, the patient could now go home.  Both the patient and the family expressed their gratitude to Michael, whose intervention had spared them two additional nights of hospitalization.

That weekend, however, a nurse, who had experienced some tension with the family over their desire to take the patient home, filed an incident report.  She stated that Michael had overstepped his bounds and requested that the case undergo review by the privacy office as a possible HIPAA violation.

An investigation ensued, which concluded that Michael had indeed violated the hospital’s privacy policy.  Furthermore, he was told that even if he had obtained written consent from the family, it would not allow him to open the medical record.  If the family wanted him to review the case, they could obtain hard copies from medical records and then give him those copies to review.

The office noted the violation in Michael’s record, along with a suggestion that any promotion or salary increase be deferred for six months.

Many physicians have little knowledge of HIPAA’s history, provisions, and purpose, in part because a full generation has now passed since the Health Insurance Portability and Accountability Act (HIPAA) was signed into law by President Bill Clinton in 1996.

HIPAA consists of five titles. Title II contains the Privacy Rule, which regulates the disclosure and use of protected health information (PHI).  By statute, PHI may be disclosed to law enforcement officials and health care organizations without written authorization, but otherwise written consent is required.

Adjudicating Michael ’s case is a complex matter.  On the one hand, he was not the patient’s treating physician, although he was on call for the weekend.  Moreover, he had received no formal consultation request from another health professional.  In fact, he would have never known about the situation, had information about the patient’s care been communicated only through official channels.  Finally, Michael failed to realize that families cannot give consent to enter their own electronic medical record.  In sum, had he confined his attention that morning to his job description, no problems would have arisen.

Yet Michael did not confine his attention to his job description, the medical staff bylaws, or the hospital’s policies and procedures manual.  He did not recognize only what had been presented to him through the electronic health record.

Instead, Michael saw with his eyes, heard with his ears, felt with his heart, and used his knowledge and experience to provide a better course of care for a patient.  He was responding not primarily as a functionary within the hospital system, but as a physician and friend.  He was recognizing people in distress, reaching out to them, and doing what he could to help them.

Michael may not have followed official protocols, but he certainly did a laudable thing that earned him the family’s undying gratitude.  They welcomed his help, and they were very grateful for the difference he made.  He did not take over the patient’s care, but instead simply connected two parts of the healthcare team that needed to speak with one another but had not yet made a connection.  The patient received the appropriate care in a timelier fashion, both freeing up resources for other patients in need and lowering the cost of care.

Neil Postman foresaw this type of problem in his book, Technopoly.  He warned that technocracy thrives when the ties between information and human purpose have been severed, too often transforming otherwise sage and compassionate human beings into mere tools of their tools.  He warned that professionals must take the initiative to counteract the development of a culture in which authorization, satisfaction, and orders are all taken from technology.  Medicine may be a high-tech field, but at its core, it is not about the technology.  It is a human art.

For medical care to thrive, we need to ensure that matters of lesser significance do not trump greater ones.  Otherwise, we end up practicing upside down, as appears to be the case here.  A niggling concern over privacy was allowed to trump good patient care.  Medical organizations in which we work need to make it easier – rather than more difficult – to be a good doctor.  Michael stood to gain nothing, but he acted compassionately and in the patient’s best interest.  Such displays of medical virtuosity should be praised, not punished.

Richard Gunderman is Chancellor’s Professor, Schools of Medicine, Liberal Arts, and Philanthropy, Indiana University, Indianapolis, IN. James Lynch is dean of admissions, University of Florida College of Medicine, Gainesville, FL.

Image credit:


View 19 Comments >

Most Popular

✓ Join 150,000+ subscribers
✓ Get KevinMD's most popular stories