HIPAA Regulations and Homeless Memorial
Background
The Health Insurance Portability and Accountability Act (HIPAA) was signed by President Clinton in 1996, but the privacy provisions did not go into effect until 2003 in the United States and the enforcement rules were not in place until 2006. They govern most health care organizations including mental health providers from releasing information about patients or disclosing health information collected from health insurers, hospitals, clinics while working to upgrade all records to an electronic platform. The Coalition has been overseeing a homeless memorial day since 1987 in Cleveland with the reading of the names of those who died over the past year. We call every social service agency to gather names, and then read an alphabetical list of homeless or formerly homeless people who died over the past year. In the 1990s, we were reading 10-25 names. These last two years, we were reading 40 to 50 names. Our national sponsors for this event are the National Coalition for the Homeless and National Health Care for the Homeless Council who both help coordinate memorials all over the country.
We have had no problems collecting names because privacy does not survive death. All births and deaths in the community are public events that are announced in the paper. The coroner does not identify people as homeless, but they will release the names of unclaimed bodies every year or those who were previously buried in the "Potter's Field" at the cemetery off Warrensville Center Road. This year, only six days before the memorial, I was notified by Mental Health Services staff that they could not provide names with a link to a
2002 Q& A about whether HIPAA patient information survives death. No meeting, no discussion, and no assurances that the agency talked to other health care organizations in the United States who participate in the memorial. Just a two sentence e-mail was all we were given from MHS. We had received names from the agency in previous years, and we sent the first letter asking for help collecting names in mid-September. We heard nothing from the agency, which happens to be the largest homeless social service provider in Cleveland until December 15.
Another bit of background information, NEOCH is one of the most sensitive organizations in the community when it comes to privacy. We have filed numerous complaints regarding violations of privacy with social service providers. When we had to submit data to the County regarding our clients, we assumed that the client would want to remain anonymous in the system and so they had to affirmatively declare that they wanted to have their social security number used in the County management system. Most providers force the client to affirm that they want their social security numbers removed from the management information system, which is often uncomfortable when they are hoping for a bed that night. We oppose the use of the County Homeless Management Information System (HMIS) in the shelters because it is too easy for private client data to be viewed by other social service providers to construct a registry of "bad homeless people." Mental Health Services submits personal information to the County including social security numbers through the HMIS network, and we have even caught agency staff declaring that submission of social security number was a requirement for entry into a MHS facility (which is wrong). So, while we do a great deal to protect the privacy of homeless people, we understand that once a person dies they really cannot object to their name being remembered and honored at that point.
Why HIPAA Does Not Apply to Homeless Memorial
The Coalition is not releasing patient information as part of the memorial. We are not saying, "Joe Smith who was mentally ill and sleeping at Lakeside and was a patient of MHS died this year." We are not even saying that the person was homeless in 2011 and then passed away. The list is a strictly the names of people who passed away in 2011 and had previous experience with homelessness. It comes from many different sources and is not divided by agency. While homelessness certainly contributes to bad health outcomes, it is not a medical condition. We also have used street names on the list and sometimes we only have their first name. If the agency was in fact worried about the privacy of their clients there are ways around this concern. With a little more time and some discussion, we could have satisfied the issues brought up by the MHS attorney. Involving an attorney in this type of community service is why lawyers are held in such low regard and the reason we have warning labels on everything we consume, wear, or even use to clean with. "Warning: May Contain Traces of Nuts" on a Hershey's Almond Bar or "Do Not Take if Allergic to Aspirin" on the side of a Bayer Aspirin container are typical of the nonsense we have to put up with today because of well meaning but overly nervous attorneys.
We suggested calling the National Health Care for the Homeless Council who should understand HIPAA as a leading health care organizations and co-coordinator of National Homeless Memorial Day. I have no idea if they ever did this, since no one at MHS would talk about this decision. They just kept saying, "we want to help and we understand your position, but we cannot." We suggested calling the many health care for the homeless organizations in the United States who participate in and in many cases even organize a Homeless Memorial Day in their cities, but heard nothing except a couple of short e-mails. This is the kind of frustration that homeless people have to put up with everyday. The lights are out a 11 p.m. for no good reason even if the NBA playoffs go long or some agencies throw away all a client's valuables when they are transported to the hospital by ambulance, and then when they come back they are even barred from digging through the trash to retrieve their own original birth certificate or family pictures. If the shelters were more transparent and acted like members of the community who were always trying to provide a hand up, we would all be better off.
HIPAA Privacy Claims
The
Center for Democracy and Technology is lobbying to get an improvement in HIPAA regulations, and they have criticized the enforcement of HIPAA regulations.
Here are their comments to Congress from 2009.
"Unfortunately, the HIPAA rules have never been adequately enforced. As noted above, HHS
has not levied a single penalty against a HIPAA-covered entity since the rules were implemented (footnote 18). The Justice Department has levied some penalties under the criminal provisions of the statute – but a 2005 opinion from DOJ’s Office of Legal Counsel (OLC) expressly limits the application of the criminal provisions to covered entities, and prosecutors seeking to enforce criminal penalties against individuals have had to rely on other federal laws."
There have been thousands of complaints, but very few have resulted in any prosecution or even any follow-up from the Department of Health and Human Services. The handful that were prosecuted were obvious huge violations in which the release of information was to cover some criminal enterprise or obvious stupidity such as throwing away un-shredded patient information in an unlocked dumpster. The likelihood that the local agency could have any problem with HIPAA and homeless memorial day is nearly non-existent. We were willing to sign any agreement between the two agencies that we would not disclose any patient information from the agency, but never heard anything back. It is hard to guess why MHS took this position. Was it that as the largest provider, they have a stake in keeping the numbers down? Was it that they did not want to be bothered asking their staff? Did they not want to participate in anything associated with the Coalition? I have no idea what the real reason was because we never got the chance to sit down face to face and discuss the issue. We were never given the courtesy of discussing this important event in Cleveland. These names were lost to the community in 2011.
The training manual from the National office does not mention HIPAA problems. But in searching the public record, I could not find one place where this came up as an issue. As a board member of the National Coalition for the Homeless, one of the national coordinators, I have never heard any other city raise HIPAA as an issue. I could not find any controversy regarding any memorial in any part of the United States with a Google search. So, again the chance of any backlash against Mental Health Services is minimal. If anything, the Coalition is taking the risk not the social service providers in our community. If
Nightline can feature an entire show reading the names of US soldiers killed in Iraq, then we should be able to honor those who passed away in our cities. The US Military has huge health care costs and does respect HIPAA privacy concerns, but they release the names of those who are killed in action every week. Our fear is that by standing behind unreasonably cautious legal advice, we will forget these individuals. We will not recognize that homelessness can kill by keeping down the number of people on the memorial list.
As we say every year, these individuals are largely forgotten in life, it would be a crime to forget these individuals in death as well.
Brian Davis
Director of Community Organizing
Posts reflect the opinion of those who sign the entry.
