The official summary of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) “does not address every detail of each provision,” yet that summary is almost 11,000 words long. It could have been adequately stated in thirteen words—“A person’s health information cannot be given to others without the person’s permission.” No doubt the authors believed that the multiplication of words would make their bill cover every contingency that might arise.
Alas, despite their sterling efforts toward that end, they failed to anticipate the Pandemic known as COVID19. Let me illustrate:
I live in a four-building condominium in Florida. There are in total 213 condos and 315 residents, all of them over 55 years of age, many over seventy, and more than a few over 80. On July 10, 2020, the condo management office announced that one resident had contracted Covid19 and had been taken to the hospital. (This was the first case in this facility since the virus came to the U.S.) Residents wondered, who was that person? Did I have contact with him/her? Did I have contact with someone else who had contact with him/her? Should I be tested for the virus? Should I quarantine myself?
As the residents sought answers to these questions, they ran headlong into . . . you guessed it . . . HIPAA! The condo management company’s response was, in essence, “HIPAA forbids revealing the name of the person or identifying his/her building.” The most they could offer was “The person is not (or is) t a resident of your building.”
Stunned at this response, condo residents argued as follows: “We understand the importance of privacy in the great majority of situations. But surely the Covid health crisis merits an exception. Health authorities remind us almost daily that we must not only wash our hands and wear masks but also report any possible exposure to our doctors so that we can be tested. But how can we report what we don’t know? It may seem unlikely that people in one building have close contact with those in buildings a hundred or so feet away. But such contact is not unlikely in a neighborly condominium community in which people regular visit friends in other buildings or bring food to infirm neighbors. And when they do so, they often encounter other people in elevators and halls.”
“We understand,” the management replied, “but the HIPAA law prevents us from making exceptions. If the infected person wishes, he/she can give permission to release his/her name and building number or provide the names of those with whom he/she has had recent contact.”
The people then asked, “How can people who are elderly and may be too weakened by the virus be expected to grasp the importance of releasing their health information? And isn’t it ridiculous to assume that someone in that condition will be able to give an accurate list of people he/she has been in close or casual contact with?”
Not surprisingly, the management company’s final answer was little different from its first: “We understand your position, but HIPAA forbids us revealing the information.”
Predictably, rumors began spreading. “It’s a man”; “No, it’s a woman” were the first. Within a few days a fuller and more credible rumor took shape: a) that the infected person was a woman, b) that she lived in building xx, c) that health officials had notified residents who lived on her floor and any individuals with whom she was known to have had contact. “Known,” of course, is a slippery term. It no doubt means “the one the infected person remembered having contact with.” As noted above, it is ridiculous to rely on an elderly, ill person’s memory.
If the HIPAA law contained an emergency waiver for special situations such as a Pandemic, the ridiculousness would have been avoided. But evidently no such waiver existed because no one ever imagined a Pandemic would occur.
This story about Covid19 and the HIPAA offers an important reminder about governmental responses to unintended consequences. The reminder is as follows:
Unintended consequences can occur despite the most careful efforts to avoid them. And when they occur, the best that can be hoped for is flexibility and effectiveness in responding to them. The larger an organization and the more numerous and complex its procedures, regulations, and reporting relationships, the less flexible and responsive it is likely to be. In the case of government organizations, federal agencies generally perform more poorly than state agencies, and state agencies more poorly than local agencies.
This reminder is especially timely in this election year. If voters want their government to serve them wisely and well in the future, especially in moments of crisis, they should select candidates who are inclined to reduce the size of government and the number of regulations rather than expand them. Most important, in making this determination they should ignore the candidates’ campaign promises, which are typically crafted to say only what voters want to hear, and focus instead on the candidates’ actions in the past. To have preached reduction and practiced expansion should disqualify a candidate from voters’ consideration..
Copyright © 2020 by Vincent Ryan Ruggiero. All rights reserved.
