HIPAA

Subject: Wubbles HIPAA Question

1.  Wubbles HIPAA Question

Posted 13 days ago
​​

The incident where Nurse Wubbles was handcuffed, dragged from her hospital and placed in a police car for refusing to allow an officer to draw blood from an unconscious patient was a tragic experience for the nurse involved. I am, however, encouraged by the support given her by the hospital administration. They came out publicly in a press conference and praised her for having the courage to uphold the policies of the organization despite the ordeal she was being put through.

 

My question to the group is whether or not this is a HIPAA issue. It is obviously an issue with hospital policy and of a citizen's right to an expectation of privacy, but is it a HIPAA issue? Is a blood sample PHI?

 

Sherrie



------------------------------
Sherrie King
Compliance Auditor
Appalachian Regional Healthcare System
Boone,NC
------------------------------


2.  RE: Wubbles HIPAA Question

Posted 13 days ago

I apologize if this posting may be reflective of another thread however I would appreciate your feedback.

 

Sherrie

 

Sherrie A. King

Compliance Auditor

Appalachian Regional Healthcare System

828-263-1207

saking@apprhs.org

Compliance Hotline: 1-800-656-7743

CorporateCompliance@apprhs.org

 

Them has left the building, it's just Us.

 

"Our deepest fear is not that we are inadequate. Our deepest fear is that we are powerful beyond measure. It is our light, not our darkness, that most frightens us."

Marianne Williamson

 



This document may contain information covered under the Privacy Act, 5 USC 552(a), and/or the Health Insurance Portability and Accountability Act (PL 104-191) and its various implementing regulations and must be protected in accordance with those provisions. Healthcare information is personal and sensitive and must be treated accordingly. If this correspondence contains healthcare information it is being provided to you after appropriate authorization. You, the recipient, are obligated to maintain it in a safe, secure and confidential manner. Redisclosure without additional patient consent or without legal basis is prohibited. Unauthorized redisclosure or failure to maintain confidentiality subjects you to application of appropriate sanctions. If you have received this correspondence in error, please notify the sender at once and destroy any copies you have made.

  ­­  





3.  RE: Wubbles HIPAA Question

Posted 12 days ago
45 CFR @ 160.103
Health information means any information...whether oral or recorded in any form or medium, that:
2. Relates to the...health or condition of an individual;

Seems to me that a blood draw relates to the individual's health or condition. Tie this with the identity of the individual and you have PHI.

------------------------------
Carl Russell
Compliance Analyst
Delta Dental of Idaho
Boise,ID

Anything I say is my sole opinion and not of my company.
------------------------------



4.  RE: Wubbles HIPAA Question

Posted 12 days ago
Interesting thread. Does the blood draw equate to "recording," or is it only the subsequent report? Thoughts?



Sent from my Verizon, Samsung Galaxy smartphone





5.  RE: Wubbles HIPAA Question

Posted 12 days ago
I guess if no one spoke about the blood draw, it was never ever written about, no report ever made, one could argue it hasn't been "recorded in any form or medium." But then it would serve no purpose to the police as they could never use it without that reference being oral or written. But in reality isn't everything recorded?

And whose to say that the actual blood itself isn't a "recording in some form or medium" as defined in the regulations. Blood certainly contains DNA and genetic information which is explicitely called out in the HIPAA definition of health information.

------------------------------
Carl Russell
Compliance Analyst
Delta Dental of Idaho
Boise,ID

Anything I say is my sole opinion and not of my company.
------------------------------



6.  RE: Wubbles HIPAA Question

Posted 12 days ago
Edited by Jose Tabuena 12 days ago
I believe Sherrie raises an excellent point. I've read a lot of commentary that throws out that a "HIPAA violation" could have occurred, but without being clear and specific as to what Privacy Rule is being broken.

It's clear that one issue is the drawing of blood (versus the ordering of a test). The recent US Supreme Court case: Birchfield v. North Dakota, 136 S.Ct. 2160, 195 LEd.2d. 560 (2016), held that while the 4th Amendment allows for warrantless breath tests incident to drunk driving, a warrant is required for blood draws. So, it is also clear that the Nurse Wubbles incident is one involving the violation of the individual's constitutional rights if the blood draw was allowed.

Even if this person's blood is PHI, what is the HIPAA violation? Except with respect to uses or disclosures that require an authorization under @ 164.508(a)(2) through (4) or that are prohibited under @ 164.502(a)(5)(i), a covered entity may use or disclose protected health information for treatment, payment, or health care operations. A blood draw doesn't appear to fall under uses that require an authorization or is prohibited. If the blood draw was allowed what is the HIPAA issue?

It seems that HIPAA would apply to allow the use and disclosure of PHI if there was a purpose required under the regulation. For example, a covered entity may use and disclose PHI without prior authorization for purposes required by law; but here, there is no requirement -- actually it would be a violation of constitutional law to allow the blood draw.

I would appreciate further thoughts by this eGroup to help clarify the application of HIPAA since on first blush patient privacy rights seem involved that raises the banner of HIPAA.




------------------------------
Jose Tabuena CFE, JD
Privacy Officer
UT Southwestern Medical Center
Coppell,TX
------------------------------



7.  RE: Wubbles HIPAA Question

Posted 11 days ago
In 45 CFR @ 164.402 a breach is defined.
Breach means the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E of this part which compromises the security or privacy of the protected health information.

In other words if a disclosure isn't permitted, then it's a violation. Not the other way around. The regulations are written to list a finite set of prohibitions (though there is some of this) and then everything else is allowed. The overriding theme (again with some exceptions) is to list what is allowed and then everything else is not.

The blood draw itself is not a violation. Giving the blood to the police is. Since the situation with the law did not qualify for one of the exceptions (a court order for example) then the disclosure to the police would be a HIPAA violation.

That's my take on it. Let's how others compare and contrast.

------------------------------
Carl Russell
Compliance Analyst
Delta Dental of Idaho
Boise,ID

Anything I say is my sole opinion and not of my company.
------------------------------



8.  RE: Wubbles HIPAA Question

Posted 11 days ago

Carl,

 

I concur with your assessment of the situation. That's the way it would apply under HIPAA and Washington state privacy law.

 

LaDon Linde

Compliance Officer/Medical Staff Services Director

Sunnyside Community Hospital and Clinics

PH: 509-837-1364

FX: 509-837-1796

Ladon.linde@sunnysidehospital.org

 






9.  RE: Wubbles HIPAA Question

Posted 11 days ago
What if the staff handed the officer the tube of blood without a name on it- is it PHI? The officer knows whose blood it is, but the staff didn't disclose the name.

------------------------------
David Garrison CHC,CHPC
Compliance/Privacy Officer
SEARHC
Juneau,AK
------------------------------



10.  RE: Wubbles HIPAA Question

Posted 11 days ago
Then I would think you have other issues, outside of HIPAA, such as chain of custody.



Sent from my Verizon, Samsung Galaxy smartphone





11.  RE: Wubbles HIPAA Question

Posted 11 days ago
This is kind of fun for a Thursday afternoon.

Without the hospital confirming that the blood came from the individual (by putting their name on the sample) it probably couldn't be used in court. The evidence has to be properly handled so I doubt this would happen. But let's pretend that happened.


45 CFR @ 160.103
Health information means any information, including genetic information...

Blood has genetic information (DNA) so it is health information.


45 CFR @ 164.514(b)(2)(i)(R)
Any other unique identifying number, characteristic, or code...

DNA from the blood has a genetic code that can uniquely identify the individual so the information is not de-identified.


45 CFR @ 160.103
Individually identifiable health information...
(2)(ii) With respect to which there is a reasonable basis to believe the information can be used to identify the individual

You might have something here David. It's not a slam dunk. You have to compare the DNA to that on record somewhere that has the person identified. But there is a chance. One thing for sure, you can't say there is no chance the blood could identify an individual.

------------------------------
Carl Russell
Compliance Analyst
Delta Dental of Idaho
Boise,ID

Anything I say is my sole opinion and not of my company.
------------------------------



12.  RE: Wubbles HIPAA Question

Posted 5 days ago

I want to apologize for starting a thread and then not checking back on it. I was out of the office a few days.

 

I also want to thank everyone who compared and contrasted their thoughts about this incident.

 

Remember the police officer was trained to draw blood and was not asking the nurse to draw the act but to allow him to, which may be where he thought he could arrest her for preventing him from exercising his duty, however the patient was not under arrest nor charged with any crime at the time. Personally I do not believe this to be a HIPAA issue, but as Jose pointed out a violation of the patient's rights under the constitution to an expectation of privacy regarding his person.

 

Thanks again for responding.

 

Sherrie

 

Sherrie A. King

Compliance Auditor

Appalachian Regional Healthcare System

828-263-1207

saking@apprhs.org

Compliance Hotline: 1-800-656-7743

CorporateCompliance@apprhs.org

 

Them has left the building, it's just Us.

 

"Our deepest fear is not that we are inadequate. Our deepest fear is that we are powerful beyond measure. It is our light, not our darkness, that most frightens us."

Marianne Williamson

 



This document may contain information covered under the Privacy Act, 5 USC 552(a), and/or the Health Insurance Portability and Accountability Act (PL 104-191) and its various implementing regulations and must be protected in accordance with those provisions. Healthcare information is personal and sensitive and must be treated accordingly. If this correspondence contains healthcare information it is being provided to you after appropriate authorization. You, the recipient, are obligated to maintain it in a safe, secure and confidential manner. Redisclosure without additional patient consent or without legal basis is prohibited. Unauthorized redisclosure or failure to maintain confidentiality subjects you to application of appropriate sanctions. If you have received this correspondence in error, please notify the sender at once and destroy any copies you have made.

  ­­  





13.  RE: Wubbles HIPAA Question

Posted 5 days ago

Sherrie,

I realize I am late to the party here. I hadn't looked at this case very closely so your post just clued me into the fact that the police officer was not asking her to do the draw but to allow him to do it.

 

The nurse was more interested in protecting the rights of the individual than the police officer. She could have simply walked away and not been involved. Kudos to her.

 


Michael Scudillo 
Chief Compliance Officer/Privacy Officer

15 Microlab Road
Suite 101 • Livingston, New Jersey 07039

P: 1-973-992-8181 X26 • F: 1-973-992-9797 • C: 1-973-699-4964
www.uirehab.com

This email and any attachments may contain information that is confidential, proprietary and/or privileged. It is intended only for the use of the person(s) and entity(ies) to whom it is addressed. If you are the intended recipient, further disclosures are prohibited without proper authorization. If you are not the intended recipient, any disclosure, copying, printing or use of this information is strictly prohibited and possibly a violation of the health insurance portability and accountability act (HIPAA) and other federal and state laws and regulations. If you have received this information in error please contact Universal Institute at 973-992-8181 ext. 26 or via email at michael.scudillo@uirehab.commichael.scudillo@uirehab.com> and delete the material from all computers. michael.scudillo@uirehab.com>