Shooting from the HIPAA: Sources and privacy

July 30, 2015 01:30

By Al Sunshine, RTDNA Contributor

Investigative reporting and exposing what businesses, governments or individuals don't want to be made public can be risky.

I’ve recieved whistle-blower calls from inside the local U-S Attorneys’ office, police, drug dealers and even nuclear power plant guards complaining about rifles that wouldn't shoot if they were ever needed. Reporting on tips and confirming them through second sources can be difficult, especially on deadline and in the face of competitors who might have the same information.

Sometimes these kinds of stories have far-reaching effects on taxpayers, public officials and the daily lives of citizens. Other times, they're more about the audience's appetite for information about celebrities. Regardless of the subject matter, when the reporting relies on confidential information, news organizations must think about journalistic, legal and ethical considerations.

Earlier this month, New York Giants defensive end Jason Pierre-Paul suffered a serious hand injury while celebrating Independence Day. He was taken to a hospital in Miami, was treated and reportedly required surgery.

ESPN's Adam Schefter learned that Pierre-Paul's injured finger had to be amputated, and tweeted a picture of what he said was the football player's medical chart, which included what appeared to be confidendial medical information. That set off a firestorm of debate over the implications:

Where did the picture of the chart come from? Did Schefter confirm thorugh other sources that the finger required amputation and that the chart was legitimate? What was the motivation of the person who leaked the chart? Was that person paid? Was that person promised confidentiality in exchange for the information? Did Schefter tweet the picture with permission from his editors?

These are all legitimate questions that need to be asked by news managers before stories based on confidential sources are published or broadcast, even if the answers are only known internally. In the heat of the moment, it's easier than ever for reporter to get a scoop and send it out globally in an instant using a mobile phone. So far, ESPN hasn't said much about these questions, or to what degree they might have been considered.

Were privacy laws broken? As a journalist, could Schefter face charges? What about the person who leaked the chart? How does the Health Insurance Portability and Accountability Act (HIPAA) come into play?

The biggest legal question was answered not long after the story broke. As the Washington Post's Eric Wemple outlined, journalists aren't subject to HIPAA; medical employees and institutions are. So long as a reporter passively recieves the material, only the person who leaked it without the patient's consent could potentially face charges.

According to the Department of Health and Human Services, for “covered entities,” like hospitals, staff and contracted medical record providers, violating federal privacy laws can come at a high price:
A person who knowingly obtains or discloses individually identifiable health information in violation of the Privacy Rule may face a criminal penalty of up to $50,000 and up to one-year imprisonment.  The criminal penalties increase to $100,000 and up to five years imprisonment if the wrongful conduct involves false pretenses, and to $250,000 and up to 10 years imprisonment if the wrongful conduct involves the intent to sell, transfer, or use identifiable health information for commercial advantage, personal gain or malicious harm.  The Department of Justice is responsible for criminal prosecutions under the Privacy Rule.

For news organizations and journalists, protections have been well-established, including the Supreme Court's Bartnicki v. Vopper ruling cited by Wemple, and a 2004 case in Denver that more specifically addressed the HIPAA issue. The Reporters Committee for Freedom of the Press says:
In 2004, a federal judge in Denver held that a private party cannot sue under HIPAA. The University of Colorado Hospital sued the publisher of the Rocky Mountain (Denver) News to prevent the newspaper from printing an internal report, arguing that publishing the information would be a violation of HIPAA. The court neither granted the injunction nor allowed the hospital to continue its case against the newspaper. U.S. District Judge Walker Miller wrote there was no evidence Congress intended for a private party to be able to enforce HIPAA, particularly through the privacy rule. Though the federal judge's ruling is not binding elsewhere, the judge's decision has been cited by other courts throughout the country.

Just because Schefter was allowed to see the chart, should he have tweeted it? Was the story really so major that it warranted publicizing private medical records? Wouldn't the results of the surgery be obvious in due time?

As for the ethical questions, Schefter's response was unequivocal. He told Sports Illustrated: “This was a public figure and franchise player involved in a widely-speculated accident with potential criminal behavior in which there was a cone of secrecy that surrounded him for five days that not even his own team could crack. This wasn’t as if some player were admitted to the hospital with a secret illness or disease — we’ve seen those cases over the years, as recently as this past year even. This one was different and unique for a variety of reasons. The extent of his injuries were going to come to light, maybe that day or later that week, but soon. They’re horrific injuries, incredibly unfortunate for the player. But in a day and age in which pictures and videos tell stories and confirm facts, in which sources and their motives are routinely questioned, and in which reporters strive to be as accurate as possible, this was the ultimate supporting proof."

Even in the heat of a breaking and competititive story, it's important to consider the risks and rewards of publishing leaked information.

So what's the catch?
Published reports indicate Pierre-Pauls’ Miami hospital is conducting an investigation into who may have leaked his medical records. It’s not known if the hospital will go to court to compel ESPN or Shefter to disclose the identity of its’ source. If they do, Schefter could face a contempt citation.

Case law can often result in conflicting decisions and not be binding from one court to the next, so earlier decisions may not come into play. News organizations which obtain information from confidential sources must consider the journalistic, legal and ethical implications. Some newsrooms, especially smaller stations and web operations, may not have the financial ability to have legal experts on call. So where can they get the information they need before possibly putting themselves at risk? Here's a good place to start: RTDNA's confidential source guidelines. They recommend making sure your situation meets specific criteria, then poses a series of questions to consider.

The Reporters Committee for Freedom of the Press also offers a legal hotline to help news leaders weigh their decisions.

Has your newsroom been faced with situations like these? How did you weigh the use of confidential information against the public's need (or want) for information? Let us know in the comments below.

Al Sunshine is a 40-year veteran journalist who recently retired as an investigative reporter at WFOR-TV in Miami, FL.