Guest Column by Ted Bridis

News organizations regularly encounter government agencies and other organizations that profess they are unable to provide important information in the public’s interest because of restrictions placed on them under the U.S. Health Insurance Portability and Accountability Act.

HIPAA is the 1996 law that provides federal protections for individually identifiable health information held by covered entities and their business associates. But as many reporters and others know, the law is routinely misapplied and misconstrued to withhold health-related information even when it can be released.

Yet even when HIPAA is applicable, its privacy protections aren’t absolute. In a highly unusual case early in 2014 involving the Associated Press, the Veterans Affairs Department laudably concluded that its obligations to turn over government records under U.S. Freedom of Information Act outweighed its obligations to protect a patient’s privacy: FOIA overpowered HIPAA.

The case arose when the AP was investigating the shootings of 12 people killed in last year’s rampage at Washington’s Navy Yard by a former Navy reservist. As part of its investigation, just a few weeks after the shootings, AP reporter Kevin Freking sought the gunman’s confidential medical records from the VA under the Freedom of Information Act.

The AP’s Washington bureau is a hotbed of FOIA activity. Its Pulitzer-winning investigative team files scores of FOIA requests every year, works closely on access and First Amendment issues with AP’s new general counsel, Karen Kaiser, trains others on the law and routinely collaborates on FOIA and open-records requests with colleagues in the bureau and outside Washington.

The team built AP’s in-house FOIA tracking system. Three AP reporters are featured on the FBI’s list of serial FOIA filers. And last year, the team won the court fight to force the release of 911 tapes from the tragic school shootings in Newtown, Conn., under that state’s open records law.

AP knew it would be a long shot to obtain the gunman’s VA government medical files, and its request set up a highly unusual showdown between two powerful federal laws with opposite goals. FOIA requires the government to turn over records to the public; HIPAA requires the government and others to keep them private.

Under federal rules, HIPAA doesn’t automatically preclude “covered agents,” such as hospitals, doctors and others from disclosing a patient’s records without his consent, but it sets a very high bar before they’re allowed to do this. By practice, most government health records would be covered under FOIA’s Exemption 6, which is intended to protect personnel and medical files and similar files when their disclosure would constitute a clearly unwarranted invasion of personal privacy.

In the AP’s case, at least two factors contributed to the VA’s decision to turn over the medical files: The patient had died in a gun battle with police, and serious questions had been raised about whether he had received proper mental health treatment in the weeks before he shot and killed 12 people.

The gunman’s death required a different analysis of his privacy rights under FOIA than if he had survived because, as a general rule, under the U.S. Privacy Act, privacy rights are extinguished at death. Also, important questions about the adequacy of his care in the VA’s health system meant there was a significant public interest in the disclosure of his medical records that, the AP argued, outweighed his privacy interests.

Just as importantly, the medical records supported the VA’s contention that its doctors had inquired adequately whether the patient appeared to be suffering any symptoms of mental illness. Under fire, the VA considered giving up the files to be in its best self interest.

Notably, the fact that the gunman had been a Navy reservist who sought treatment from U.S. government doctors was important in the AP’s ability to obtain his medical files. If he had sought treatment instead from a private hospital, his private doctors and their records would not have been subject to the Freedom of Information Act (although presumably these would have been turned over as part of the criminal investigation to police, who might have been compelled after their investigation to release them under FOIA or a related state open records law).

 

Ted Bridis is an investigative news editor for the Associated Press.