If your hospital is being raked over the coals in the media for alleged fraudulent billing, it’s understandable to want to set the record straight. However, releasing patient information without consent is not the wisest approach.
California’s Shasta Regional Medical Center and its parent company Prime Healthcare Services have come under fire for aggressive Medicare billing practices, arising out of the unusual frequency of claims for a rare third-world malnutrition condition known as kwashiorkor, which they reported at a rate over 70 times the state average. The story was reported by the Center for Investigative Reporting’sCalifornia Watch, who quoted a patient and her daughter who came forward upon learning that she had been assigned this diagnosis during a hospital stay. The patient signed a waiver allowing California Watch to review her hospital records, which indicated she was treated for kidney failure, but her doctors made no mention of kwashiorkor or malnutrition. The kwashiorkor diagnosis resulted in an estimated $6,755 increase in the hospital’s Medicare DRG payment.
Faced with embarrassing publicity, a lawsuit and potential federal and/or state regulatory action, Prime Healthcare went into damage control mode. The Los Angeles Times reports that when the local newspaper, the Redding Record Searchlight, contacted Shasta Regional for comment prior to publishing California Watch’s allegations, the hospital’s CEO and Chief Medical Officer paid a visit to the paper’s editor with the patient’s chart, which they discussed with him in detail. They also divulged information about her treatment to the LA Times reporter, who reports that the patient and her daughter never authorized these disclosures.
The Times reports that the hospital CEO Randall Hempling defended his decision by stating: “As far as we’re concerned, the patient gave that permission when she gave her records to California Watch and was quoted on the record. . . . That waived her privacy.”
As the Times accurately noted, a patient who discloses PHI to a media representative or any other recipient does not waive his or her rights to additional disclosures. California Watch reports that the FBI is now looking into the unauthorized disclosure of the patient’s records along with the billing irregularities.
Moral for covered entities: Resist the temptation to reveal patient information without proper authorization, even to defend your reputation in the face of disputed allegations. HIPAA protection is not like the attorney-client privilege which can easily be waived by a single disclosure — patients still control their PHI and can choose to whom, and for what purpose, they disclose that information.