Letter to Carl Elliott from University of Minnesota attorney Lori Ketola regarding sharing of confidential patient information with AHC communications staff, April 28, 2015.
Original Title
Letter from University of Minnesota attorney Lori Ketola regarding release of confidential patient information
Letter to Carl Elliott from University of Minnesota attorney Lori Ketola regarding sharing of confidential patient information with AHC communications staff, April 28, 2015.
Letter to Carl Elliott from University of Minnesota attorney Lori Ketola regarding sharing of confidential patient information with AHC communications staff, April 28, 2015.
UNIVERSITY OF MINNESOTA
“Tein Cex Compara aaar SiE
orld Katto Mieapolis MN 38455
Chie Health Information Complance Officer and Iietolaamn ede
Director, Heath information Privacy & Conplance Ofce Phone 6120265844
‘pil 28, 2015,
Mr lot,
‘Thank you for your letter dateé April 10, 2015, expressing concern about a possible violation of health
Information privacy. | am aso In receipt of your letter dated April 16, 2015 to Fairview Research
‘Adminstration regarding the same possible violation. | have completed an investigation of this matter
In coordination wth Fairview Heath Services and wanted to share the results with you. Please note that
{his letter will seve as the response tothe letter you submited tomy attention as well asthe letter you
submitted to Fairview Research Adminstration
‘The incident you identified was related toa news report that ran on May 19, 2014, on KMSP News. In
that report, 2 patient identfied as “Robert” spoke with a news reporter, Jeff Ballon, about his
involvement in 2 drug study at the University of Minnesota. You ralsed a concern thatthe patient's
‘medical information had been inappropriately shared with Brian Lucas, Director of AKC
Communications, in connecton with that story, and that the sharing ofthat information resuited in
violations under the Health surance Portability and Accountabilty Act, the Minnesota Health Records
‘Act and University health privacy policy.
{sm sure you are aware, the laws you identified are intended to protect patient privacy. As such,
those same laws limit the arount of detail | can share with you inthis response, However, {belive
‘can address your cancers in manner that does not dicose any protected health information.
‘The patient in this instance signed an authorzation permiting the release of his recor to Jef Ballon at
KIMSP News and permiting the University to discuss those records with Mr. Ballon. After receiving the
signed release the Universit forwarded the patient's records to Mr. Balon. Me. Ballon prepared 2
series of questions based on the records and submited those questions to AHC Communications to
‘obtain responses. AHC Comunlations worked with the patient's provider to develop those responses.
“Thete are several relevant aipects of the Health Insurance Portablity and Aecountabilty Act and its
felated regulations (collectively refered to as HIPAA) applicable to thls particular situation. Fest, the
Feleese oF the pation’ revs Wo am hnlvidual wii ie ot subject to HIPAA, namely Me. alto,
_Eenerally means any action taken by Me. Ballon with respect to those records isnot subject to HIPAA.
When Mr. Ballon developed questions related to the patlent’s condltion, and ultimately shared the
patient's information in the media, that information was no longer protected by HIPAA. HIPAA
‘addresses this by requiring that where a release of records requires an authorization, the authorization
must include a statement providing that the release of records may result in the redislosure of the
records, and that the records may no longer be protected under HIPAA. The authorization signed by the
patent inthis instance included sucha statement.Second, the University s designated asa “hybrid entity” under HIPAA. This generally means that parts
of the University’s function: are subject to HIPAA, and other parts are not. The components of the
University that are subject tc HIPAA are generally the areas providing health care services, as wellas the
‘areas that support the areas providing health eare services and that may require access to heath
information and heath eco'ds to provide that support. Under HIPAA, health information and health
records may be shared with support areas within the hybrid entity so that they can perform these
support funetions
{ANC Communications s part ofthe University's hybrid entity. AHC Communications supports areas that
provide health care servis, cuch as in the development of storiez and communieations involving
Patients, and may require access to health Information and health records to pravde that support.
‘Consequently, the role played by AHC Communications inthis instance fs permissible under HIPAA.
Under the Minnesota Heath Records Act, a similar conclusion would be reached. Minnesota law
permits the release of health records upon patient authorization, which authorlzation was provided in
this instance. Further, the Minnesota Health Records Act does not prohibit the internal sharing of
Information between a provider and the entty’s support units as needed to provide that support
Consequently, the role played by AHC Communications in this instance is permissible under the
‘Minnesota Health Records Ac.
Given that the patient inthis instance signed an authorization to release his records to Mr. Ballon and
discuss those records with Mr. Ballon, and given that Mr. Lucas is permitted to access health
information and health recor in in connection with his role at AH Communications | ind no violation
Cf HIPAA or the Minnesota Health Records Act by Mr. Lucas. Ukewise I find no violation of University
health information privacy pelicy by. Lucas
You raised an addtional coscern about disclosure of the patient's health information “for use in a
television broadcast” by KMS? News “done in order to discredit” the patient. The statements a issue 95
referenced in you letter were made as part of the discussion between the Unversity and Mr. Ballon,
Which was authorized by the patients release. The decision about what information to aie publicly was
made by Mr. Ballon. However, viewed in the context ofthe entice dialogue between the University and
Mr. Ballon, It's clear that those statements were not intended by the University to be aired as part of
Mr. Baillon’s media report, but were rather intended to suggest to Mr, Ballon that i was not
appropriate to expose a patent nis cgcumstances tothe mela spotlight.
| appreciate your concern for heath information privacy and thank you for your report. Should you
have any further comments or questions regarding this matter, please feel re to contact me.
LF
£: Brooks Jackson, Dean, Medial School and Vie President for Heath Sciences
Brian Dahlin, Chet information Security Officer
os Dai, nformation Privacy Director, Fairview Health Services
Letter From Leigh Turner To Sen. Terri Bonoff and Other Legislators Regarding Psychiatric Clinical Trials and The Recruitment of Involuntarily Held Patients