Health Care Privacy? Apparently Not.

For more than a year Prime Healthcare Services, which owns 14 hospitals in California, has been the subject of state and federal investigation into potentially fraudulent billing with Medicare and Medi-Cal. Journalists at California Watch have filed numerous stories and even done their own analysis of 50 million Medicare records about Prime's billing practices.

But this post is not about Medicare fraud.

Instead, it's about unapproved release of one patient's medical records, as Mike Hiltzik of the Los Angeles Times explained in his column today:

Of all the personal information that you might want to keep private, your medical records are the most important. That's why federal and state laws carry stiff penalties, up to and including jail time, for healthcare providers who let such data loose into the wild.

So you should be aghast at how free and easy Prime Healthcare Services and two executives at Prime-owned Shasta Regional Medical Center have been with the medical chart of a patient named Darlene Courtois. They showed the entire chart to an editor of her hometown newspaper, and Prime's corporate office divulged some of her medical examination results to me (though I didn't ask for them). They didn't have her permission for those disclosures, her daughter says.

A little background--California Watch had told Courtois' story as evidence that Prime had fraudulently billed Medicare. Courtois had been treated at Shasta Medical Center after a fall in early 2010. The hospital had billed Medicare for a rare nutritional disorder, kwashiorkor. But Courtois later requested her medical records. In the 63 pages she received, there was no mention of kwashiorkor, California Watch reported.

But the 63 pages apparently were not the complete record. Prime argues that because Courtois had already shared her medical records publicly that she essentially waived her right to privacy. Privacy of medical records is guaranteed under the 1996 Health Insurance Portability and Accountability Act, known as HIPAA. Prime insists it had the right to share other internal documents about her treatment.

But Hiltzik didn't buy that argument, nor did many of the legal experts he talked to:

Under the law, there's no such thing as an implied authorization by a patient for disclosure of personal records, said Linda Ackerman, a San Francisco expert in privacy law.

The office of civil rights of the U.S. Department of Health and Human Services, which enforces HIPAA, put it this way: "There is no 'waiver' that would apply to the release of a chart or medical record to the media without an individual's written authorization."

Several experts told me it doesn't matter if the hospital was trying to contradict misinformation provided by a patient (even if that's what Courtois did, which is debatable). Under the law, patients themselves can divulge anything they wish about their medical conditions and their treatment by a hospital. But a hospital's obligation is to keep its mouth shut. A desire to deflect bad PR is not an excuse. Even if they think they're in the right, the law says healthcare providers have to suffer in silence, the experts say.

The whole of Hiltzik's column is a great read, and he ends with a call for prosecutors to step in:

The behavior of Prime and Shasta Regional should provide rich fodder for investigations by state and federal agencies and by U.S. prosecutors in Sacramento, who cover Shasta County. Dr. McCampbell holds a California medical license issued in 2005, and it would be worthwhile for the state medical board to look into her participation in this matter and determine whether it meets the standards of professional conduct required of a California licensee.

As for the rest of the bigwigs at Prime and Shasta, plainly they all need to be shipped to a reeducation camp in the rules of patient confidentiality. If, that is, they can stay out of jail.