U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

82–190 2013

DOES HIPAA HELP OR HINDER PATIENT CARE 

AND PUBLIC SAFETY? 

HEARING 

BEFORE THE

SUBCOMMITTEE ON OVERSIGHT AND 

INVESTIGATIONS 

OF THE

COMMITTEE ON ENERGY AND 

COMMERCE 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED THIRTEENTH CONGRESS 

FIRST SESSION 

APRIL 26, 2013 

Serial No. 113–37 

( 

Printed for the use of the Committee on Energy and Commerce 

energycommerce.house.gov 

(II) 

COMMITTEE ON ENERGY AND COMMERCE 

FRED UPTON, Michigan 

Chairman 

RALPH M. HALL, Texas 

JOE BARTON, Texas 

Chairman Emeritus 

ED WHITFIELD, Kentucky 

JOHN SHIMKUS, Illinois 

JOSEPH R. PITTS, Pennsylvania 

GREG WALDEN, Oregon 

LEE TERRY, Nebraska 

MIKE ROGERS, Michigan 

TIM MURPHY, Pennsylvania 

MICHAEL C. BURGESS, Texas 

MARSHA BLACKBURN, Tennessee 

Vice Chairman 

PHIL GINGREY, Georgia 

STEVE SCALISE, Louisiana 

ROBERT E. LATTA, Ohio 

CATHY MCMORRIS RODGERS, Washington 

GREGG HARPER, Mississippi 

LEONARD LANCE, New Jersey 

BILL CASSIDY, Louisiana 

BRETT GUTHRIE, Kentucky 

PETE OLSON, Texas 

DAVID B. MCKINLEY, West Virginia 

CORY GARDNER, Colorado 

MIKE POMPEO, Kansas 

ADAM KINZINGER, Illinois 

H. MORGAN GRIFFITH, Virginia 

GUS M. BILIRAKIS, Florida 

BILL JOHNSON, Missouri 

BILLY LONG, Missouri 

RENEE L. ELLMERS, North Carolina 

HENRY A. WAXMAN, California 

Ranking Member 

JOHN D. DINGELL, Michigan 

Chairman Emeritus 

EDWARD J. MARKEY, Massachusetts 

FRANK PALLONE, JR., New Jersey 

BOBBY L. RUSH, Illinois 

ANNA G. ESHOO, California 

ELIOT L. ENGEL, New York 

GENE GREEN, Texas 

DIANA DEGETTE, Colorado 

LOIS CAPPS, California 

MICHAEL F. DOYLE, Pennsylvania 

JANICE D. SCHAKOWSKY, Illinois 

JIM MATHESON, Utah 

G.K. BUTTERFIELD, North Carolina 

JOHN BARROW, Georgia 

DORIS O. MATSUI, California 

DONNA M. CHRISTENSEN, Virgin Islands 

KATHY CASTOR, Florida 

JOHN P. SARBANES, Maryland 

JERRY MCNERNEY, California 

BRUCE L. BRALEY, Iowa 

PETER WELCH, Vermont 

BEN RAY LUJAN, New Mexico 

PAUL TONKO, New York 

(III) 

SUBCOMMITTEE ON OVERSIGHT AND INVESTIGATIONS

TIM MURPHY, Pennsylvania 

Chairman 

MICHAEL C. BURGESS, Texas 

Vice Chairman 

MARSHA BLACKBURN, Tennessee 

PHIL GINGREY, Georgia 

STEVE SCALISE, Louisiana 

GREGG HARPER, Mississippi 

PETE OLSON, Texas 

CORY GARDNER, Colorado 

H. MORGAN GRIFFITH, Virginia 

BILL JOHNSON, Ohio 

BILLY LONG, Missouri 

RENEE L. ELLMERS, North Carolina 

JOE BARTON, Texas 

FRED UPTON, Michigan (ex officio) 

DIANA DEGETTE, Colorado 

Ranking Member 

BRUCE L. BRALEY, Iowa 

BEN RAY LUJAN, New Mexico 

EDWARD J. MARKEY, Massachusetts 

JANICE D. SCHAKOWSKY, Illinois 

G.K. BUTTERFIELD, North Carolina 

KATHY CASTOR, Florida 

PETER WELCH, Vermont 

PAUL TONKO, New York 

GENE GREEN, Texas 

JOHN D. DINGELL, Michigan 

HENRY A. WAXMAN, California (ex officio) 

(V) 

C O N T E N T S 

Page 

Hon. Tim Murphy, a Representative in Congress from the Commonwealth 

of Pennsylvania, opening statement ................................................................... 1 

Prepared statement .......................................................................................... 115 

Hon. Steve Scalise, a Representative in Congress from the State of Louisiana, 

prepared statement .............................................................................................. 117 

WITNESSES

Leon Rodriguez, Director, Office for Civil Rights, Department of Health and 

Human Services ................................................................................................... 3 

Prepared statement .......................................................................................... 5 

Answers to submitted questions ...................................................................... 118 

Mark A. Rothstein, Herbert F. Boehl Chair of Law and Medicine, Director, 

Institute for Bioethics, Health Policy, and Law, University of Louisville 

School of Medicine ................................................................................................ 13 

Prepared statement .......................................................................................... 15 

Answers to submitted questions ...................................................................... 131 

Richard Martini, M.D., Professor of Pediatrics and Psychiatry, University 

of Utah School of Medicine, Chair, Department of Psychiatry and Behavioral Health, Primary Children’s Medical Center ............................................. 37 

Prepared statement .......................................................................................... 39 

Answers to submitted questions ...................................................................... 140 

Carol Levine, Director, Families and Health Care Project, United Hospital 

Fund ...................................................................................................................... 43 

Prepared statement .......................................................................................... 45 

Gregg Wolfe, Father of a son with mental illness and substance abuse ............ 58 

Prepared statement .......................................................................................... 62 

Edward Kelley, Father of a son with mental illness ............................................ 70 

Prepared statement .......................................................................................... 73 

Jan Thomas, Family impacted by HIPAA ............................................................. 84 

Prepared statement .......................................................................................... 86 

Deven McGraw, Director of the Health Privacy Project, Center for Democracy 

and Technology ..................................................................................................... 88 

Prepared statement .......................................................................................... 90 

Answers to submitted questions ...................................................................... 143 

(1) 

DOES HIPAA HELP OR HINDER PATIENT 

CARE AND PUBLIC SAFETY? 

FRIDAY, APRIL 26, 2013 

HOUSE OF REPRESENTATIVES, SUBCOMMITTEE ON OVERSIGHT AND INVESTIGATIONS, COMMITTEE ON ENERGY AND COMMERCE, Washington, DC. 

The subcommittee met, pursuant to call, at 9:02 a.m., in room 

2123 of the Rayburn House Office Building, Hon. Tim Murphy 

(chairman of the subcommittee) presiding. 

Members present: Representatives Murphy, Gingrey, Scalise, 

Harper, Olson, Gardner, Griffith, Johnson, Long, Ellmers, Cassidy, 

DeGette, Braley, Schakowsky, Butterfield, Tonko, and Green. 

Staff present: Carl Anderson, Counsel, Oversight; Mike 

Bloomquist, General Counsel; Sean Bonyun, Communications Director; Matt Bravo, Professional Staff Member; Karen Christian, 

Chief Counsel, Oversight; Andy Duberstein, Deputy Press Secretary; Brad Grantz, Policy Coordinator, Oversight and Investigation; Debbee Hancock, Press Secretary; Brittany Havens, Legislative Clerk; Robert Horne, Professional Staff Member, Health; Peter 

Kielty, Deputy General Counsel; Andrew Powaleny, Deputy Press 

Secretary; Alan Slobodin, Deputy Chief Counsel, Oversight; Sam 

Spector, Counsel, Oversight; Tom Wilbur, Digital Media Advisor; 

Jean Woodrow, Director, Information Technology; Phil Barnett, 

Democratic Staff Director; Stacia Cardille, Democratic Deputy 

Chief Counsel; Brian Cohen, Democratic Staff Director, Oversight 

and Investigations, Senior Policy Advisor; Elizabeth Letter, Democratic Assistant Press Secretary; Stephen Salsbury, Democratic 

Special Assistant; Roger Sherman, Democratic Chief Counsel; and 

Matt Siegler, Democratic Counsel. 

OPENING STATEMENT OF HON. TIM MURPHY, A REPRESENTATIVE IN CONGRESS FROM THE COMMONWEALTH OF PENNSYLVANIA 

Mr. MURPHY. Good morning. We are here today, the Oversight 

and Investigation Subcommittee of the Committee on Energy and 

Commerce, for a hearing entitled, ‘‘Does HIPAA Help or Hinder Patient Care and Public Safety?’’ 

As there is a classified briefing as well as votes this morning, we 

are going to waive opening statements in order to get right to the 

witness testimony. We will allow members to submit their opening 

statements for the record. 

A hearing last month addressed issues raised after the Newtown 

tragedy. Some of the witnesses told the subcommittee how HIPAA 

2 

had hindered their ability to care and treat for loved ones. We are 

going to hear from a number of folks, government representatives, 

professionals, parents, experts, family members. It is an important 

issue. 

Members, the reason we are here is members of Congress themselves are experts and knowledgeable on many of these issues, so 

we appreciate your attention to this. We are here to ask questions 

and learn the facts about HIPAA from those who are knowledgeable of them and remind everyone that we need to maintain decorum in the committee room. Disruptions will not be tolerated and 

people doing so will be discharged if needed. 

We also are asking members to stick closely to the time limit as 

we go through. 

Ms. DEGETTE. Will the Chairman yield just briefly? 

Mr. MURPHY. Yes. I yield briefly. 

Ms. DEGETTE. The Chairman and I have agreed to put all of the 

opening statements in the record, and I think that is appropriate 

given this classified briefing which was just scheduled yesterday 

out of respect to the witnesses, many whom have come from around 

the country. The Chairman and I decided we really wanted to hear 

from the witnesses. 

I will say, Mr. Chairman, though, that this is really an important 

topic, the HIPAA issues, particularly as they relate to gun violence, 

but it is also important if we are being asked to get the U.S. militarily or otherwise involved in Syria and this classified briefing is 

with the Secretary of State, so on behalf of everybody I want to 

apologize to the witnesses. Some of us may be coming in and out, 

but we will read the testimony, and we will make sure we know 

what is going on. 

So thank you very much, Mr. Chairman. 

Mr. MURPHY. I appreciate it. I want to also let members know 

I communicated with Majority Leader Eric Cantor last evening, 

and he is having his staff working on providing a special briefing 

for any members who remain through this committee. 

You are aware that the committee is holding an investigative 

hearing. I say this to the witnesses, Mr. Rodriguez and Mr. 

Rothstein, and when doing so, we have the practice of taking testimony under oath. Do you have any objections to testifying under 

oath? 

Thank you. 

The Chair then advises you that under the rules of the House 

and the rules of the committee you are entitled to be advised by 

counsel. Do you desire to be advised by counsel during your testimony today? 

Thank you. 

In that case will you please rise and raise your right hand? I will 

swear you in. 

[Witnesses sworn.] 

Mr. MURPHY. Let the record show the witnesses have answered 

in the affirmative. You are now under oath and subject to the penalties set forth in Title XVIII, Section 1001 of the United States 

Code. You may each now give a 5-minute opening statement, but 

let me introduce the witnesses for today’s hearing. 

3 

On the first panel we have Mr. Leon Rodriguez. Mr. Rodriquez 

is the Director of the Office for Civil Rights at the Department of 

Health and Human Services. He oversees the administrative operations of the civil rights division. 

We also have Professor Mark Rothstein. He has a joint appointment at the University of Louisville, School of Law, and the School 

of Medicine. He also holds a Herbert F. Boehl Chair of Law and 

Medicine and is the founding director of the Institute for Bioethics, 

Health Policy, and Law at the University of Louisville School of 

Medicine. 

Gentlemen, you may begin. Make sure your microphone is on 

and pulled close to your mouth. Thank you. You may begin. 

TESTIMONY OF LEON RODRIGUEZ, DIRECTOR, OFFICE FOR 

CIVIL RIGHTS, DEPARTMENT OF HEALTH AND HUMAN SERVICES; AND PROFESSOR MARK A. ROTHSTEIN, HERBERT F. 

BOEHL CHAIR OF LAW AND MEDICINE, DIRECTOR, INSTITUTE FOR BIOETHICS, HEALTH POLICY, AND LAW, UNIVERSITY OF LOUISVILLE SCHOOL OF MEDICINE 

TESTIMONY OF LEON RODRIGUEZ 

Mr. RODRIGUEZ. Good morning, Mr. Chairman, Ranking Member 

DeGette, and members of the subcommittee. It is an honor for me 

to be here today in my capacity as Director of the Office for Civil 

Rights at the U.S. Department of Health and Human Services, and 

I thank you for calling a hearing on this very important topic. 

As HHS’s enforcement agency for civil rights and health privacy 

rights, OCR handles enforcement, policy development, and education for compliance with laws in those areas. Our office plays an 

important role in ensuring that an individual’s sensitive health information remains private and secure and that individuals are able 

to exercise important rights with respect to their health information. 

One of the underpinnings of HIPAA is that optimal healthcare 

depends for many patients on their trust that their health information remains confidential. HIPAA also ensures that health information can flow for important and necessary purposes such as patient 

treatment, obtaining payment for health services and protecting 

the country’s public health and safety. I have often said that 

HIPAA is meant to be a valve and not a blockage, and that it is 

above all meant to maximize the welfare and interests of 

thepatients. 

As such, I look forward to discussing the existing flexibilities 

within HIPAA. HIPAA recognizes the vital role that family members play in supporting patients with significant illness, both physical and mental. I have read the family testimonies that were 

placed in the record and am heartbroken by them, and so, therefore, take seriously this committee’s desire to get to the right answer on these issues. 

To directly address the concerns that underlie this hearing I will 

discuss the paths that HIPAA offers for providers to disclose information received during treatment to protect the health and safety 

of their patients. 

4 

For example, HIPAA permits personal health information to be 

used or disclosed without an individual’s authorization for health 

treatment and payment and for the business operations of covered 

entities. HIPAA also permits other uses and disclosures for certain 

public health activities, for law enforcement purposes, and to avert 

serious and imminent threats to health or safety. 

I would like to talk about disclosures to family members and 

friends of patients. This is an important area. Ordinarily if a patient does not object to information being either shared in front of 

family members or friends or with family members or friends, 

HIPAA provides a clear avenue for disclosure in those cases. 

Additionally, if a patient is incapacitated—and when I say incapacitated, we mean for that word to be given its full ordinary 

meaning—healthcare providers may still communicate with family 

and friends of the patient if the provider determines, based on professional judgment, that doing so is in the best interest of the individual. And this is, I think, an important point to underscore. 

HIPAA is meant to revolve around the professional judgment of the 

provider as to what is in the best interest of the patient. It is not 

meant to supplant that judgment. 

And so, for example, a nurse can discuss a patient’s medical condition in front of the patient’s sister, who accompanies her to an 

appointment. If a patient is unconscious or otherwise incapacitated, 

the doctor, again, can make that judgment to share information 

with family members. 

Similarly, HIPAA recognizes that professional codes, state laws, 

and professional standards of care recognize a duty and authority 

to warn of situations where a patient may pose a danger to themselves or others or may have disclosed information indicating a 

threat by another to either themselves or a third person. 

In those cases where there is a serious and imminent risk of 

harm to health or safety, HIPAA has a clearly-recognized exception 

for disclosure. And when I say an imminent risk to health or safety, it is not simply the scenario of an individual going out to commit a violent crime, but, in fact, it covers a number of possible scenarios that a healthcare provider, particularly a mental healthcare 

provider, may encounter. 

We take our obligations to educate providers and patients on 

these flexibilities seriously, and it is for this reason that we in the 

Administration took the initiative in January after the tragic 

events in Newtown to issue a letter to the Nation’s healthcare providers clarifying these important points. 

Finally, I want to talk for just a moment about the nature in 

which we utilize our enforcement authorities. We focus primarily 

on longstanding broad-based security threats. We have never taken 

enforcement action because a provider has decided in the best interests of a patient to disclose information to a related party. 

Thank you, Mr. Chairman, thank you, Ranking Member, thank 

you, members of the committee. 

[The prepared statement of Mr. Rodriquez follows:] 

5 


82190.001

-i}~:"~SUV1C$S'lj,¥ Testimony 

"'~ Before the Energy & Commerce Committee 

3 f- Subcommittee on Oversight and Investigations 

'=0 ~ United States House of Representatives '1. 

"It 

<11""0 

Statement of 

Leon Rodriguez 

Director 

Office for Civil Rights 

U. S. Department of Health and Human Services 

For Release on Delivery 

Expected at 10:00 a.m. 

Friday, April 26, 2013 
6 


82190.002

Introduction 

Mr. Chainnan and members ofthe Subcommittee, it is an honor for me to be here today in my 

capacity as the Director of the Office for Civil Rights (OCR) at the U.s. Department of Health 

and Human Services (HHS). As HHS's enforcement agency for civil rights and health privacy 

rights, OCR investigates complaints, conducts compliance reviews, develops policy, promulgates 

regulations, and provides technical assistance and public education to ensure understanding of 

and compliance with non-discrimination and health infonnation privacy laws. 

OCR implements the health infonnation privacy, security, and breach notification rules, under 

the Health Insurance Portability and Accountability Act of 1996, otherwise known as HIPAA, 

and the 2009 Health Infonnation Technology for Economic and Clinical Health Act (HITECH). 

In doing so, our office plays an important role in ensuring that individuals' sensitive health 

infonnation remains private and secure, and that individuals are able to exercise important rights 

with respect to their health infonnation. We also ensure that health infonnation can flow for 

important and necessary purposes, such as patient treatment, obtaining payment for health care 

services, and protecting the public's health and safety. 

I thank you for the opportunity to testifY today about how the HIP AA privacy requirements 

apply to health care professionals and their interactions with patients and patients' family 

members and friends. I will provide a brief overview ofHIPAA, describe how it applies to 

communications between health care providers and a patient's family and loved ones, and report 

on OCR's efforts to ensure that health care providers are fully aware of their ability under 

HIPAA to share infonnation with those closest to the patient. 

Background 

HIP AA was designed to improve the efficiency and effectiveness of the health care system by 

promoting the electronic exchange of health infonnation for administrative and financial health 

care transactions, such as submitting claims for treatment provided, or detennining insurance 

eligibility. At the same time, Congress recognized that, without proper oversight, advances in 

electronic technology could erode the privacy and security of that health infonnation. To 

address this, HIPAA requires certain health care providers, health plans, and health care 
7 


82190.003

clearinghouses to adopt Federal privacy and security protections. The HIPAA Privacy Rule 

requires that these persons and organizations, known as covered entities, have safeguards in 

place to ensure the privacy of individuals' identifiable health information. The rule also sets 

forth the circumstances under which covered entities may use or disclose an individual's health 

information, and gives individuals rights with respect to their information, including rights to 

examine and obtain a copy of their health records and to request corrections. 

HITECH, in addition to accelerating the adoption of health information technology, also 

strengthened and expanded HIPAA's privacy and security requirements. For example, HITECH 

significantly bolstered HIPAA enforcement by extending liability for compliance with certain 

aspects ofHIPAA to business associates of covered entities. HITECH also called for higher civil 

monetary penalties for HIPAA violations, and it augmented the Secretary's ability to act on 

HIP AA violations, particularly where there has been willful neglect. On January 25, 2013, HHS 

issued a Final Rule implementing these HITECH enhancements to the HIPAA Rules. 

OCR investigates complaints from the public about potential violations of the Rules, as well as 

breach reports that HITECH requires covered entities to submit to the Secretary. OCR also may 

investigate privacy and security incidents that are reported by the media, government agencies, 

or other sources. OCR also provides technical assistance to covered entities to foster compliance 

with the HIP AA Rules, and education and outreach to make the public aware of its rights under 

HIPAA. OCR is committed to expanding and improving its technical assistance and public 

education materials and finding new and innovative ways to communicate with all who have a 

role in keeping health information private and secure. 

Public Priorities 

The HIPAA Privacy Rule carefully balances individual privacy interests with important public 

priorities with standards for when an individual's authorization is required to use or disclose 

personal health information. To achieve this balance, HIPAA includes a series of regulatory 

permissions allowing covered entities and business associates to use or disclose personal health 

information for specified purposes, without the individual's authorization. For example, HIPAA 

permits personal health information to be used or disclosed, without an individual's 

2 
8 


82190.004

authorization, for health care treatment and payment, and for the business operations of covered 

entities. HIP AA also permits uses and disclosures of individuals' health information that are 

required by other law, as well as for certain public health activities, for law enforcement 

purposes, and to avert serious and imminent threats to health or safety. Aside from these 

permitted disclosures, HIPAA requires disclosures in only limited circumstances - to HHS to 

ensure compliance with the Rule and to individuals to ensure they are able to access their own 

information. 

I will discuss the ways in which HIP AA allows providers to share relevant information about a 

patient's health care with the patient's family members, friends, or others the patient wants 

involved in his or her care. I will also point out the instances in which a mental health or other 

health care provider may alert appropriate persons when a patient presents a serious and 

imminent threat to himself or others. Finally, I will outline OCR's efforts to ensure providers 

understand these important provisions. 

Disclosures to Family Members and Friends 

Recognizing the integral role that family and friends play in an individual's health care, the 

HIP AA Privacy Rule allows routine - and often critical- communications between health care 

providers and these persons. Unless the patient objects, health care providers may communicate 

with an individual's family members, friends, or other persons the individual has involved in his 

or her health care. If the patient is not present or is incapacitated, health care providers still may 

communicate with family and friends of the patient, if the provider determines, based on 

professional judgment, that doing so is in the best interest of the individual. I will share a few 

real-world examples to illustrate: 

• A nurse can discuss a patient's medical condition in front of the patient's sister who 

accompanies the patient to an appointment; 

• A pharmacist can give an individual's prescription to a friend whom the individual sends 

to pick up the prescription; and 

• If a patient is unconscious or otherwise is incapacitated, the doctor can share information 

with family members or friends if the doctor determines, based on professional judgment, 

that doing so would be in the patient's best interest. 

3 
9 


82190.005

HIPAA also recognizes various individuals who serve as the patient's personal representative 

and have the right to access the patient's health care information, subject to certain limitations. 

Personal representatives generally include a parent or legal guardian of a minor child, or a legal 

guardian of an adult, who has authority to make health care decisions for the individual. 

With respect to conversations between health care providers and patients' family members and 

friends, the HIPAA Privacy Rule respects an individual's wishes, to the extent practical and 

appropriate. This means that a health care provider is not permitted to share personal health 

information with the family members or friends of an adult individual who tells the provider not 

to do so. Protecting this core individual right under HIPAA is central to achieving HHS's goal of 

improving the Nation's health by fostering the public's trust in the health care system's ability 

and commitment to safeguard personal health information. The ability to assure individuals that 

their personal health information will remain private is particularly critical in the area of mental 

health care, where concerns about the negative attitudes associated with mental illnesses may 

affect individuals' willingness to seek needed treatment. 

OCR has developed a number of resources over the years to educate health care providers and 

members of the public about these provisions, including dedicated pages on our website, as well 

as downloadable guides for both providers and patients, on this issue. 

These resources are available on our website at 

http://www.hhs.gov/ocr/privacY/hipaalunderstanding!index.html. 

"Duty to Warn" 

As the President and my colleagues at HHS have emphasized in other venues, we know that 

most people who are violent do not have a mental disorder, and most people with a mental 

disorder are not violent. HHS' s goals are to improve the identification of mental health disorders 

and the delivery of needed mental health services. With these goals in mind, HIPAA was 

designed to provide privacy and security protections to enable those who seek health care to do 

so in confidence, consistent with professional ethical standards in the medical community. 

4 
10 


82190.006

In those uncommon instances in which an individual poses a serious and imminent threat to 

himself or herself, or to another person, the HIP AA Privacy Rule allows a health care provider to 

alert appropriate persons of this threat, consistent with applicable law and their ethical "duty to 

warn." In particular, HIP AA permits a covered health care provider to share relevant 

information about a patient to a person or persons who are reasonably able to prevent or lessen 

the serious and imminent threat, consistent with applicable law and standards of ethical conduct. 

Depending on the circumstances, the alert could be directed to a law enforcement official, a 

family member of the individual, the target ofthe threat, and/or other persons. 

This past January, as part ofHHS's response to the tragic shooting in Newtown, Connecticut, 

and other recent events, OCR published a letter to the Nation's health care providers 

(http://www.hhs.gov/ocr/office/lettertonationhcp.pdf) to ensure that they are aware of their 

ability under HIPAA to disclose information, consistent with applicable law and their ethical 

"duty to warn," when they believe that a patient poses a serious and imminent threat to himself 

or others. 

NICSANPRM 

On January 16,2013, the President issued a series of Executive Actions to reduce gun violence 

across the Nation. Those actions included a commitment to address any unnecessary legal 

barriers, particularly relating to HIP AA, that may prevent states from reporting certain 

information to the national background check system for firearm purchases. The Brady Handgun 

Violence Prevention Act of 1993, and its implementing regulations, which established the 

background check system, prohibit several categories of individuals from possessing or 

purchasing firearms. One such category, the "mental health prohibitor," includes individuals who 

have been: (I) involuntarily committed to a mental institution; (2) found incompetent to stand 

trial or not guilty by reason of insanity; or (3) otherwise formally adjudicated as having a serious 

mental condition that results in the individual's presenting a danger to themselves or others or 

being unable to manage their own affairs. In response to the President's Executive Actions, 

OCR published (http://www.hhs.gov/news/press/2013pres/04/20130419a.html) an advance 

notice of proposed rulemaking (ANPRM) on April 23, 2013, to gather information about 

potential barriers HIPAA may pose to states reporting the identities of those individuals to the 

5 
11 


82190.007

background check system, and to solicit the public's feedback on the best way to address any 

barriers. In particular, we are considering creating an express permission in the HIP AA rules to 

permit certain covered entities to report the relevant information to the NICS. We encourage 

interested parties to submit comments during the comment period, which continues until June 7, 

2013. 

HIPAA Enforcement 

Historically, providers often have been reluctant to share information with patients' friends and 

family members. Although HIPAA provides the avenues I described for disclosures to family 

members and friends, there may be other professional ethical obligations, State confidentiality 

laws, or internal policies of a health care organization, that affect whether health care providers 

are willing or able to share patients' personal health information with their families, friends, or 

others. In addition, while there are penalties under HIPAA for impermissibly disclosing 

individuals' health information or for failing to disclose when required, providers are not subject 

to penalties for declining to make disclosures that HIPAA merely permits. Still, the disclosure 

permissions are in the Rule for a reason, and, through guidance, we continue to encourage 

providers to use them. 

With respect to OCR's enforcement of the HIPAA Rules, HITECH significantly strengthened 

HHS's ability to take enforcement actions against entities for HIPAA violations by revising and 

increasing the civil monetary penalty amounts that may be imposed for violations, reserving the 

highest penalties for those entities that demonstrate willful neglect of their obligations under the 

HIPAA Rules. Prior to HITECH, HHS could impose on a covered entity a civil monetary 

penalty of up to only $100 for each violation, with a calendar year limit of$25,000 for all 

identical violations. HITECH provided a stronger and more flexible penalty scheme by creating 

four categories of violations that reflect increasing levels of culpability and thus, higher 

minimum penalties - from circumstances where the entity did not know ofthe violation to 

instances involving willful neglect. Now, the penalties range from $100 to $50,000 or more per 

violation, with a calendar year limit of $1.5 million for identical violations. 

6 
12 


82190.008

Under this new structure, OCR largely concentrates its enforcement efforts on large, systemic 

failures to comply with the HIPAA Rules. In particular, as adoption of electronic health records 

becomes more widespread, we are working to ensure that health care entities implement 

reasonable and appropriate measures to safeguard individuals' health information in electronic 

form, as required by the HIPAA Security Rule. HITECH provided us with important tools in this 

effort, including the new civil monetary penalty structure I just described, which strengthens 

incentives for health care entities and their business associates to secure the information they 

maintain; and the breach notification requirements, which ensure that individuals and HHS learn 

about breaches of unsecured protected health information. We have found that many of the major 

breaches reported to us result from systemic shortcomings in entities' Security Rule compliance 

programs, and we are focusing our enforcement energy in this direction. 

In contrast, be assured that OCR's enforcement efforts are not directed toward imposing 

penalties on health care providers who make good faith efforts to comply with the Privacy Rule 

with regard to communications with patients' family members and friends. 

Closing 

As you can see from my testimony, OCR is committed to ensuring both that the American public 

enjoys the full protections and rights afforded to them by the HIPAA Rules, and that information 

can be shared with the appropriate persons or authorities when it is consistent with individuals' 

wishes or necessary to protect their safety or the safety of the broader public. 

7 
13 

Mr. MURPHY. Thank you, Mr. Rodriguez. 

Mr. Rothstein, you are recognized for 5 minutes. 

TESTIMONY OF MARK A. ROTHSTEIN 

Mr. ROTHSTEIN. Mr. Chairman. 

Mr. MURPHY. Pull the microphone close to you, if you would. 

Mr. ROTHSTEIN. Mr. Chairman. 

Mr. MURPHY. Still not on. Is it on? Pull it real close. 

Mr. ROTHSTEIN. OK. How about there? 

Mr. MURPHY. There we go. 

Mr. ROTHSTEIN. Thank you. 

Mr. MURPHY. These are government mikes so during the sequester they are down 20 percent. 

Mr. ROTHSTEIN. As is my voice, I am afraid. 

Mr. Chairman and members of the subcommittee, my name is 

Mark Rothstein. I am on faculty of the University of Louisville, but 

I am testifying today in my individual capacity, and again, let me 

apologize for my laryngitis. It is seasonal I am afraid. 

In my testimony this morning I want to make the following three 

points. First, the HIPAA privacy rule is essential to patient care 

and public health and safety, second, exceptions to the privacy rule 

permit disclosure of health information for important public purposes, and third, additional measures could enhance the effectiveness of the privacy rule. 

First, ever since the Hippocratic Oath, medical codes of ethics 

have established the duty of physicians to maintain the confidentiality of patient health information. Without assurances of confidentiality, patients will be reluctant to divulge sensitive information about their physical and mental health, their behavior, and 

lifestyle that could be vital to the individual’s treatment. The privacy rule codifies this crucial requirement of confidentiality which 

is necessary for ethical and effective individual healthcare. 

Health privacy laws also are essential to the protection of public 

health and safety. To illustrate, this afternoon I will be returning 

home to Louisville. At lunch, I do want my cook or server to be 

someone who was reluctant to get treatment for hepatitis A because of privacy concerns. I do not want as my taxi driver someone 

with chronic tuberculosis who was afraid to get ongoing health 

treatment. I do not want my flight safety placed at risk by an air 

traffic controller with a mental health problem or a pilot with substance abuse who was deterred from obtaining behavioral health 

care. Confidentiality protections, therefore, serve to advance both 

the patient’s and the public’s interest. 

Although we were all deeply saddened by the recent horrific loss 

of life caused by some violent, mentally-unstable individuals, we 

should appreciate the potential consequences if new, excessive 

mental health reporting requirements were enacted. Each year in 

the United States there are over 38,000 suicides and over 700,000 

emergency room visits caused by self-inflicted harms. An estimated 

26.2 percent of the people in the U.S. have a diagnosed mental disorder in any given year. Any steps to lessen confidentiality protections or mandate the unnecessary disclosure of mental health information could lead vast numbers of individuals to forego mental 

14 

health treatment and potentially result in significantly more suicides, self-inflicted harms, and untreated mental illness. 

Second, the privacy rule specifically permits a covered entity to 

disclose 12 types of health information of importance to the public, 

and therefore, the privacy rule does not hinder public safety. 

Among these 12 categories are disclosures for public health activities, about victims of abuse, neglect, or domestic violence, for law 

enforcement, and to avert a serious threat to health or safety. 

The 12 public purpose exceptions are permissive. The privacy 

rule does not require any disclosures. The disclosure obligations 

arise from other sources such as state public health reporting laws. 

The effect of the public purpose exceptions is to permit otherwiserequired disclosures without violating the privacy rule. 

Third, for the last 10 years, inadequate health professional and 

patient outreach and education programs have led to a lack of understanding of the privacy rule by many affected individuals and 

covered entities. A common problem is that some uses and disclosures permitted by the privacy rule are not allowed by some covered entities, perhaps out of ignorance or an over-abundance of 

caution. 

The 2013 promulgation of the omnibus amendments to the privacy rule make it an appropriate time for HHS to start a new program of public and healthcare provider education and outreach. 

In conclusion, the privacy rule, I believe, is essential to individual healthcare and public health and safety. Additional efforts 

to increase understanding of the privacy rule by the public and covered entities, as well as revising some of the public purpose exceptions, will enhance the effectiveness of the privacy rule. 

I thank you for the opportunity to testify this morning. 

[The prepared statement of Mr. Rothstein follows:] 

15 


82190.009

TESTIMONY OF MARK A. ROTHSTEIN 

UNIVERSITY OF LOUISVILLE SCHOOL OF MEDICINE 

Before the 

SUBCOMMITTEE ON INVESTIGATIONS AND OVERSIGHT, 

HOUSE COMMITTEE ON ENERGY AND COMMERCE 

Does HIP AA Help or Hinder Patient Care and Public Safety? 

April 26, 2013 
16 


82190.010

MR. CHAIRMAN and members of the Subcommittee. My name is Mark Rothstein. I am the 

Herbert F. Boehl Chair of Law and Medicine and Director of the Institute for Bioethics, Health 

Policy and Law at the University of Louisville School of Medicine. From 1999-2008, I served as 

Chair of the Subcommittee on Privacy and Confidentiality of the National Committee on Vital 

and Health Statistics, the statutory public advisory committee to the Secretary of Health and 

Human Services (HHS) on health information policy. I am testifying today in my individual 

capacity. 

In my testimony this morning I want to make the following three points. First, the HIPAA 

Privacy Rule is essential to patient care and public health and safety. Second, exceptions to the 

HIPAA Privacy Rule permit disclosure of health information for important public purposes. 

Third, additional measures could enhance the effectiveness of the HIPAA Privacy Rule. 

1. The HIPAA Privacy Rule Is Essential to Patient Care and Public Health and Safety 

Some people think that the only benefit of health privacy laws is to prevent anxiety, 

embarrassment, and similar intangible harms to individuals; and that occasionally stigmatization 

or discrimination can be caused by the disclosure of sensitive health information. Although it is 

important to protect against these types of harms, it is critical to recognize that the lack of health 

privacy can interfere with individual health care and endanger public health and safety. 

Ever since the Hippocratic Oath, medical codes of ethics have established the duty of physicians 

-- and later other health care providers -- to maintain the confidentiality of patient health 

information. Without assurances of confidentiality, patients will be reluctant to divulge sensitive 

information about their physical and mental health, behavior, and lifestyle that could be vital to 
17 


82190.011

the individual's treatment. The Privacy Rule codifies this crucial requirement for ethical and 

effective health care. Surveys of patients indicate that many of them, fearful of disclosure of their 

sensitive health information, currently engage in "defensive practices" by withholding certain 

information ITom their health care providers. 1 Any weakening of privacy protections would 

undoubtedly increase the use of defensive practices. 

Health privacy laws also are essential to the protection of public health and safety. To illustrate, 

this afternoon I will be going back to Louisville. At lunch, I do not want my cook or server to be 

someone who was reluctant to get treatment for hepatitis A because of privacy concerns; I do not 

want as my taxi driver someone with chronic tuberculosis who was afraid to get ongoing health 

treatment; I do not want my flight safety placed at risk by an air traffic controller with a mental 

health problem or a pilot with a substance abuse disorder who was deterred from obtaining 

behavioral health care. Confidentiality protections serve to advance both the patient's and the 

public's interest. 

Congress recognized the importance of protecting sensitive health information as early as 1970s, 

when it enacted the Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment, and 

Rehabilitation Act and the Drug Abuse Prevention, Treatment, and Rehabilitation Act. As 

implemented by 42 C.F.R. Part 2, the law protects the confidentiality of alcohol and substance 

abuse treatment information about any person in a federally assisted program. Congress 

understood that the public interest in getting individuals into treatment would be thwarted if 

individuals with substance abuse problems feared they would be subject to, among other things, 

criminal prosecution for violating state and federal drug laws. 

1 California Healthcare Foundation, Consumers and Health Information Technology: A National Survey 25 

(2010). 

2 
18 


82190.012

A similar recognition of the public health consequences of widespread disclosure of sensitive 

mental health information should guide the nation's mental health information policy. Although 

we were all deeply saddened by the recent, horrific loss oflife caused by some violent, mentally 

unstable individuals, we should appreciate the potential consequences of new, excessive, mental 

health reporting requirements. Each year in the U.S. there are over 38,000 suicides and over 

700,000 emergency room visits caused by self-inflicted harms. 2 An estimated 26.2 percent of 

people in the U.S. have a diagnosed mental disorder in any given year.3 Any steps to lessen 

confidentiality protections or mandate the unnecessary disclosure of mental health information 

could lead vast numbers of individuals to forego mental health treatment and potentially result in 

significantly more suicides, self-inflicted harms, and untreated mental illness. 

2. Exceptions to the HIPAA Privacy Rule Permit Disclosures for Important Public Purposes 

The Privacy Rule specifically permits a covered entity to disclose 12 types of health information 

of importance to the public without the need for a patient's authorization or consent, so long as 

the disclosures are described in the covered entity's Notice of Privacy Practices. These 12 

categories are disclosures: (I) required by law; (2) for public health activities; (3) about victims 

of abuse, neglect, or domestic violence; (4) for health oversight activities; (5) for judicial and 

administrative proceedings; (6) for law enforcement; (7) about decedents to coroners, medical 

examiners, and funeral directors; (8) for cadaveric organ, eye, or tissue donation; (9) for research 

purposes pursuant to a waiver of authorization, for reviews preparatory to research, and for 

2 Centers for Disease Control and Prevention, Suicide and Self-Inflicted Injury, 

v.ww.cdc.gov/nchs/fastats/suicide.htm. 

3 National Institute of Mental Health, The Numbers Count: Mental Disorders in America, 

www.nimh.nih.gov/health/public3tions/the-numbers-count-mental-disordcrs-in-ameriealindex.shtml. 

3 
19 


82190.013

research on a decedent's information; (10) to avert a serious threat to health or safety [the subject 

of the OCR's January 15,2013 letter to health care providers]; (11) for military and veterans' 

affairs, national security, and intelligence; and (12) for workers' compensation.4 These public 

purpose exceptions are broadly worded and include various measures to protect public health and 

safety through the disclosure of protected health information to appropriate federal, state, and 

local government officials. 

Significantly, the public purpose exceptions are permissive. The Privacy Rule does not require 

any disclosures; the disclosure obligations arise from other sources, such as state public health 

reporting laws. The effect of the public purpose exceptions is to permit otherwise-required 

disclosures without violating the Privacy Rule. 

3. Additional Measures Could Enhance the Effectiveness of the HIPAA Privacy Rule 

Before the Privacy Rule went into effect in April 2003, as well as for the last 10 years, 

inadequate health professional and patient outreach and education programs have led to a lack of 

understanding of the Privacy Rule by many affected individuals and covered entities. A common 

problem is that some uses and disclosures permitted by the Privacy Rule are not allowed by some 

covered entities, perhaps out of ignorance or an over-abundance of caution. 

To take one example, in the early days ofthe Privacy Rule, many covered entities stopped 

reporting infectious diseases and other health information to state public health agencies even 

445 C.F.R. § 164.512. 

4 
20 


82190.014

though such disclosures are expressly permitted by the Privacy Rule.s Although this problem has 

been largely corrected, there are anecdotal reports of other types of nondisclosure. 

A recurring complaint by some patients and their caregivers is that some covered entities invoke 

the Privacy Rule as an excuse for not making lawful disclosures of health information whenever 

disclosure is considered inconvenient or burdensome. 

The Privacy Rule should be viewed by the public as more than arcane and indecipherable legal 

provisions sometimes invoked to their detriment. Similarly, the Privacy Rule should be viewed 

by covered entities as more than a burdensome paperwork regulation whose provisions are only 

vaguely understood. 

The 2013 promulgation of the omnibus amendments to the Privacy Rule make it an appropriate 

time for HHS to start a new program of public and health care provider education and outreach. 

Such efforts have been long advocated by the National Committee on Vital and Health 

Statistics.' 

Another way in which health privacy and public health and safety could be advanced would be 

redrafting some of the public purpose exceptions to make them more explicit. For example, the 

public purpose exception to avert a serious threat to public health or safety includes disclosures 

required by state laws as a result of the influential Tarasoff decision. 7 In this case, the California 

Supreme Court held that a psychotherapist who learns of a patient's threat of serious harm or 

5 National Committee on Vital and Health Statistics, Letter to HHS Secretary Tommy G. Thompson, 

March 5, 2004, www.ncvhs.hhs.gov/04030512.htm;45 C.F.R. § 164.512(b). 

6 National Committee on Vital and Health Statistics, Letter to HHS Secretary Tommy G. Thompson, 

September 27, 2002, w\\w.ncvhs.hhs.govL0209271t.btm. 

7 Tarasoffv. Regents of the University of Cali fomi a, 551 P.2d 334 (CaL 1976). 

5 
21 


82190.015

death to an identifiable victim has a duty to take appropriate steps to reduce the threat, which 

could include notifying law enforcement and warning the threatened individual. 

Unfortunately, in implicitly deferring to state law on a health care provider's duty to avert a 

serious threat to public health or safety, the Privacy Rule fails to clarify the complicated and 

inconsistent array of state statutory and case law. An unequivocal, national, unitary standard for 

such disclosures would clear up a great deal of confusion. 

In conclusion, the Privacy Rule is essential to individual health care and public health and safety. 

Additional efforts to increase understanding of the Privacy Rule by the public and covered 

entities, as well as revising some of the public purpose exceptions, will enhance the effectiveness 

of the Privacy Rule. 

Thank you for the opportunity to testify. 

6 
22 

Mr. MURPHY. I thank both the gentlemen. Let me just ask some 

questions. I recognize myself for 5 minutes. 

During this subcommittee’s March 5 forum on severe mental illness, Pat Milam, father of a son with a serious mental illness, 

pointed to HIPAA as a significant obstacle to getting his son the 

help he needed. Mr. Milam explained that one of his son’s doctors 

judged him to be, ‘‘of extremely high risk for suicide or other bad 

outcome,’’ more than once and yet failed to share this information 

with Pat or his wife. Matthew Milam tragically took his own life 

only months later while living with his parents, and it was only 

after Matthew’s death that the Milams were able to obtain their 

son’s medical records. 

Is this an example where HIPAA worked as intended, Mr. 

Rothstein? 

Mr. ROTHSTEIN. No, but if HIPAA were followed to the letter, 

that would have permitted the disclosure under—— 

Mr. MURPHY. Mr. Rodriguez, you agree with that, too? Does 

HIPAA bar a physician or a licensed provider from revealing health 

information to the parents of a young adult who is living with their 

parents? Yes or no, Mr. Rodriguez? 

Mr. ROTHSTEIN. No. 

Mr. RODRIGUEZ. Under some circumstances it might. In most circumstances there would be paths for disclosures to those parents. 

Mr. MURPHY. Paths for disclosure. Does it allow physicians to 

provide information to parents if the young adult is receiving care 

through the parent’s healthcare plan up to age 26 as envisioned by 

the Affordable Care Act? So if they are still dependents, or is it an 

age? Can you tell me where that cutoff is? 

Mr. RODRIGUEZ. Yes. The cutoff in terms of the patient’s ordinary 

ability to object to the provider’s disclosure is the age of majority, 

whatever it happens to be in a particular State. 

Mr. MURPHY. So in Pennsylvania it is age 14. A 14-year-old could 

decide whether or not that information is to be disclosed. In other 

States it may be 18. 

Mr. RODRIGUEZ. Yes. I would assume ordinarily it would be 18. 

Mr. MURPHY. Are either of you familiar with the term, 

anosognosia, what that term means? 

Mr. RODRIGUEZ. I am aware of it, Chairman, because I actually 

read the majority memorandum for this hearing. Certainly going 

back to the discussion of serious incapacity and the discussion of 

serious and imminent risk of harm, certainly situations where that 

condition either renders the patient to be in a condition of incapacity or where the consequences of that condition being 

unaddressed are a serious risk of imminent harm to health or safety—again, it doesn’t mean going out and committing a gun crime. 

It can mean a variety of different things that could be extremely 

harmful to that patient. 

Then, yes, in those cases a provider could disclose without consent. 

Mr. MURPHY. Mr. Rothstein, would you agree? 

Mr. ROTHSTEIN. I agree. Yes. 

Mr. MURPHY. It sounds like from what I read from your testimony and what you have said here that we may find that a lot of 

providers are misinterpreting or over-interpreting the laws on 

23 

HIPAA which prevent them from disclosing things to patients. Is 

that what you are suggesting is happening here? 

Mr. RODRIGUEZ. Chairman, we have observed in a variety of our 

areas of enforcement that there is anxiety about our rules in all the 

wrong places. If you look at where we have taken enforcement action, it has been focused on institutions that have had longstanding 

failures to protect the security of all of their patients’ information. 

HIPAA was designed to respect the provider’s judgment as to 

their patients’ best interests. I think that is often, unfortunately, 

misunderstood, and that is one of the reasons we provided that 

clarification. 

Mr. MURPHY. Let me ask this because it gets to the crux of the 

matter of why we are here today, and we are going to hear some 

testimony from some professionals, some experts, and some parents. 

What if the provider decides not to share the memo or the information, whatever, for those reasons? What if the patient doesn’t 

sign a release? A patient themselves does not even recognize they 

have a problem, and the parents even go to court and say, we 

would like to have these records reviewed. In some cases the hospital staff says, I can’t release these records if a judge says we can, 

and the judge asks the patient, the patient says, no, and yet a condition may still exist that the patient is at risk for suicide or harm 

to themselves for not following their treatment. 

What then? 

Mr. RODRIGUEZ. One thing to also keep in mind in answering 

this question is HIPAA’s not the only relevant body of law. So we 

are also talking about professional ethical standards, both the 

American Psychiatric Association and the American Psychological 

Association impose clear duties of confidentiality and create exceptions as we do, and, in fact, our rules are built around both those 

ethical duties and State law duties such as, for example, that in 

the Tarasoff v. California Board of Regents case. Clearly in the 

kinds of scenarios where you describe where a provider is aware of, 

for example, the risk of suicide, a very clear situation where we are 

talking about serious risk of imminent harm, HIPAA does not 

stand as a barrier, even in the absence of the patient’s consent to 

disclosure. 

Mr. MURPHY. I am going to cut myself—— 

Mr. RODRIGUEZ. Anybody who can help the patient. That is a 

critical element here. To that person who can lessen or remove the 

threat to the patient. If that is the parents, then that is where the 

disclosure can go. 

Mr. MURPHY. Thank you. I am out of time. I am going to go now 

to Ms. DeGette for 5 minutes. 

Ms. DEGETTE. Thank you, Mr. Chairman. 

I think we can all agree that HIPAA provides many important 

protections for people’s medical privacy, and we have a history of 

bipartisan agreement that people need to be able to keep their sensitive health information private, and so I think we would agree 

with our witnesses on the importance of HIPAA but also we need 

to recognize that in many of these mass shootings that we have 

seen and in many mental illness situations where someone is a risk 

to themselves and to their families, there are clearly some probVerDate Nov 24 2008 14:42 Nov 07, 2013 Jkt 037690 PO 00000 Frm 00029 Fmt 6633 Sfmt 6633 F:\MY DOCS\HEARINGS 113\113-37 CHRIS
24 

lems with how providers and institutions are interpreting HIPAA 

obligations. Because it seems to me if someone is a danger to themselves or to others, that would be up to the provider’s decision to 

advise the parents or other responsible adults. 

Is that correct, Mr. Rodriguez? 

Mr. RODRIGUEZ. Yes. It would—— 

Ms. DEGETTE. And Mr. Rothstein, is that correct? 

Mr. ROTHSTEIN. Yes. I agree with that. 

Ms. DEGETTE. So I just want to say I am not going to blindly defend HIPAA, but I think we should be very, very careful when we 

contemplate changes to that statute. We heard in March about providers’ interpretations of HIPAA and how they can be barriers to 

treating not just the mentally but also the physically ill. 

I myself, as a parent, I have a diabetic child, and even before she 

was 18 years old sometimes we had a hard time getting providers 

to give us information. That is not because of HIPAA. It is because 

the providers misinterpreted HIPAA, and so when we hear these 

tragic stories today, and I am hoping I will get back for that, I 

think that we need to really take that seriously, but we need to 

look at ways to educate providers. 

In the aftermath of the murder of 32 people at Virginia Tech we 

learned that HIPAA interpretations prevented mental health professionals from appropriately sharing information. Misinterpretations of HIPAA and other private laws were also identified by the 

GAO and by President Obama’s Gun Violence Task Force as an obstacle to reporting individuals who should be barred from gun ownership to the next background check system. 

And so, Mr. Rodriguez, I think you would say HHS has tried to 

be responsive to these concerns that interpretations of HIPAA and 

other privacy rules have created obstacles. Is that correct? 

Mr. RODRIGUEZ. That is correct. That is why we—— 

Ms. DEGETTE. And, in fact, you sent a letter out on January 15 

of this year to health providers around the country, trying to delineate exactly what HIPAA says. Correct? 

Mr. RODRIGUEZ. Yes, we did. 

Ms. DEGETTE. Now, tell us why you sent this letter. 

Mr. RODRIGUEZ. We thought that because of all the concerns 

about the interaction between situations where a provider is aware 

of information indicating danger to either the patient or others, 

and some of the events that we have been hearing about in recent 

years, that it was important to remind providers of the—of both 

the duty, the permissions under HIPAA, but also to remind them 

to consult with their applicable ethical standards and their applicable State laws that clearly do give them a pathway to report in 

these kinds of situations. 

Ms. DEGETTE. Thank you, and HHS recently issued an advanced 

notice of proposed rulemaking to solicit public comments on HIPAA 

and its perceived barriers to the reporting of individuals to NICS 

due to mental health concerns. Is that correct? 

Mr. RODRIGUEZ. That is correct. 

Ms. DEGETTE. And can you explain very briefly why this advanced notice of rulemaking is necessary and what information you 

are trying to collect? 

25 

Mr. RODRIGUEZ. Sure. In most States reporting as to disqualifying information for NICS actually comes from the judicial system, 

which is not covered under HIPAA. We are aware at least generally about some examples—New York State until recently was 

one very clear example of a State where reporting occurred from 

entities that are, in fact, covered by HIPAA, and reporting would 

ordinarily have been prohibited by HIPAA. We want to understand 

where and to what extent HIPAA is a barrier in those cases and 

take any appropriate steps to—— 

Ms. DEGETTE. Thank you. 

Mr. RODRIGUEZ [continuing]. Remove those barriers. 

Ms. DEGETTE. OK. Just one last question. 

Now, the Affordable Care Act, it extended insurance to dependents up to the age of 26. Correct? Yes or no? 

Mr. RODRIGUEZ. That is correct. 

Ms. DEGETTE. Yes, but it didn’t say that individuals up to the 

age of 26—maybe that this a good question for you, Mr. Rothstein. 

It didn’t say individuals up to an age of 26 were still considered 

legally dependents of their parents because they are getting health 

insurance. Is that correct? 

Mr. ROTHSTEIN. Yes. 

Ms. DEGETTE. And, in fact, the provision of the Affordable Care 

Act didn’t even talk about HIPAA, did it? 

Mr. ROTHSTEIN. Correct. 

Ms. DEGETTE. That is correct. OK. Thank you. 

Mr. Chairman, I would ask unanimous consent to put this January 15, 2013, letter from the Director to providers into the record. 

Mr. MURPHY. Without objection we will—— 

Ms. DEGETTE. Thank you very much. 

[The information appears at the conclusion of the hearing.] 

Mr. MURPHY. Thank you. The gentlewoman’s time has expired. 

I now recognize Dr. Gingrey from Georgia for 5 minutes. 

Mr. GINGREY. Mr. Chairman, thank you, and thank you very 

much for calling this very important hearing. You know, I am sitting here thinking as a physician member of the subcommittee that 

it is kind of ironic, isn’t it, that this law passed in 1996, HIPAA. 

It almost sounds like the Hippocratic Oath, which, of course, in the 

first place, do no harm. It really in a way has nothing to do with 

the Hippocratic Oath, which is hundreds, if not thousands, of years 

old, but in a way it does touch on that in the first place, do no 

harm, in regard to how you treat a patient but also this information sharing because if it is not done correctly, great harm, there 

is potential for great harm, not only for the patient but to the general public. So I just think that I find that sort of ironic. 

Mr. Rodriguez, when was the last time that the Office of Civil 

Rights under HHS updated the Healthcare Provider’s Guide to the 

HIPAA Privacy Rule posted to the OCR Web site? And how about 

the Patients’ Guide? Same thing. 

Mr. RODRIGUEZ. Congressman, Doctor, we are updating guidance 

on a routine basis as different issues comes up. As you know, we 

issued a major rule that profoundly affects both consumers and 

providers in January of this year, and so we have been busy posting updates relevant to that rule. 

Mr. GINGREY. That was that January 25 rule? 

26 

Mr. RODRIGUEZ. That is correct. Similarly, when we identified 

the concerns about gun violence after the Newtown shooting, we 

took immediate and decisive steps to put up this reminder about 

the manner in which HIPAA interacts with the duties to warn. We 

are updating our information on a very—— 

Mr. GINGREY. Well, these guides answer common questions about 

HIPAA. Correct? 

Mr. RODRIGUEZ. That is correct. 

Mr. GINGREY. And do you ever receive input from either the general public or the healthcare providers about the effectiveness of 

these updates? 

Mr. RODRIGUEZ. We do. We speak routinely to both consumer 

groups and provider groups. My door is always open. In fact, I took 

the initiative this morning to connect with several of the family 

members here today because I want to hear from them. I want to 

know these concerns and make sure that we are getting—— 

Mr. GINGREY. I am going to come right back to you, but Mr. 

Rothstein, are you familiar with these guides? Do you have any 

sense of how effective they are? 

Mr. ROTHSTEIN. Well, I am not sure how effective they are, but 

I can comment generally about the Outreach in Education Program 

and with all due respect to OCR and HHS, I think we have a major 

problem in this area. If you read the regulations, there are ample 

places where these kinds of issues, the problem of notifying parents, the problem of notifying individuals who are at risk, is spelled 

out. But HIPAA is a very misunderstood regulation. It is misunderstood by the public, it is misunderstood by healthcare providers 

and—— 

Mr. GINGREY. Well, let me interrupt you to say that I fully agree 

with you, and as a practicing physician for a long time before I 

came here 10 years ago, I knew that, and I think, in fact, I wonder 

if some physicians don’t hide behind if I just move onto the patient, 

not want to be bothered with an aunt or an uncle or a cousin, in 

regard to questions about their loved one. I hope that doesn’t exist 

too much, but, I mean, it is something that we need to think about. 

Let me go back to the Director of the Office of Civil Rights, Mr. 

Rodriguez. How does OCR measure? Now, I think when I was talking to you just a second ago, it sounded like it was more anecdotal 

from your perspective, but how does OCR measure whether the 

clarifications that you referenced January 25 of this year, indeed, 

how do you measure how they are working? For example, have the 

number of privacy rule complaints filed under the various complaint categories been trended downwards with every further clarification, hopefully this most recent one from OCR? Does OCR keep 

track of this? Do you think this will be a helpful metric to track 

in judging the performance, your performance of your outreach and 

education efforts concerning the privacy rule? 

Mr. RODRIGUEZ. So answering the first part of your question, 

Congressman, the truth is our caseload has remained steady, and 

in fact, has grown slightly over the years since we commenced enforcement. We’ve received something in the order of, I think, approximately 80,000 complaints since we first began receiving complaints, and the amount has been fairly steady over the years. 

27 

Part of what is going on here is HIPAA’s still new, you referenced 1996, but our rules really didn’t become final until 2003 

and 2005. And so there has been a learning curve over the years 

both for consumers and providers to understand what HIPAA requires and what it authorizes, and we often emphasize that 

HIPAA’s flexible and scalable, meaning that it is really meant to 

be designed for a very wide variety of healthcare scenarios. 

I agree generally that our caseload is certainly an indicator. I 

don’t think it is the only indicator of how well folks are understanding the requirements. I certainly agree with that proposition. 

I think there have been surveys. I am not able to speak to them 

specifically right now in terms of where patient concerns are, 

where provider concerns are, but we certainly do hear a lot of anecdotal information as you described. 

Mr. GINGREY. Mr. Chairman, thank you for allowing the witnesses to answer, and I yield back. 

Mr. MURPHY. Thank you. 

Mr. GINGREY. Thank you both. 

Mr. MURPHY. I now recognize the gentleman from Iowa, Mr. 

Braley, for 5 minutes. 

Mr. BRALEY. Thank you, Mr. Chairman, for holding this very important hearing which deals with the ongoing struggle between patient privacy and protecting the public safety, and these are not 

easy issues to deal with, but I think part of the challenges we faced 

and part of the concerns of family members who have been dramatically impacted by our inability to solve this problem is that 

these particular provisions you have been talking about, Mr. 

Rodriguez, are commonly known as the Duty to Warn Provisions, 

and yet to most of us who understand duty to warn, a duty is a 

mandatory obligation, not a permissive requirement. And even 

though I understand completely your explanation of how this permissive disclosure is then subject to State laws dealing with mandatory disclosure, I think many healthcare professionals, particularly mental healthcare professionals, look at the HIPAA language, 

see that it is permissive, and that is the end of the story for them. 

And I would like to hear from both of you how are we educating 

the public and more specifically mental healthcare providers about 

this bridge between supposedly mandatory Duty to Warn Provisions that are actually permissive and State law requirements that 

might be mandatory? 

Mr. RODRIGUEZ. So that is one of the issues that I think the 

drafters of our rule in this area were attempting to tackle, because 

we are talking about, I think you are correct, we are talking about 

both duties and authorities to warn. In other words, when we are 

talking about the Tarasoff example, there we are talking about an 

actual duty to warn or to protect. 

Mr. BRALEY. But based on State law. Not based upon the language of HIPAA. 

Mr. RODRIGUEZ. Correct. HIPAA is really meant to get out of the 

way of those duties and authorities and to clear a wide enough lane 

for those duties and authorities to be utilized and implemented by 

providers and for professional judgment to really be the hallmark 

of when disclosure occurs. 

28 

Mr. BRALEY. Well, one of the first forums we had on this subject 

one of our witnesses was Pete Early, who wrote this book about his 

son’s journey through the mental health system and criminal justice system, and he noted appropriately in here that in 1963, President Kennedy signed a National Mental Health Law that authorized Congress to spend up to $3 billion in the coming decades to 

construct a national network of community mental health centers, 

and then notes on the next page that Congress never got around 

to funding or financing community mental health centers. 

So the process of deinstitutionalization moving from State mental 

health institutions to community-based mental healthcare that was 

supposed to happen instead became a process where more and 

more people wound up in the criminal justice system, and we now 

have law enforcement officers who often are providing frontline 

mental healthcare. And I think for the families of some of the victims who have experienced firsthand the loss of a loved one because of our inability to bridge this gap, especially when a patient 

is accompanied to a treatment facility by law enforcement officials 

who have a duty to protect the public safety and they aren’t provided information about the release of that patient, even though 

there may be a prior history of threats, how do we get to the point 

where we are protecting the patient’s privacy and at the same time 

making sure that we aren’t blocking the disclosure of information 

that can protect the public? 

Mr. RODRIGUEZ. I certainly think we need to continue our educational efforts, and, again, that is why that initiative—which, incidentally, was widely covered in professional media—of the reminder we sent in January was something that was really embraced by the mental health profession as a reminder to them that 

at least HIPAA, I can’t account for all the professional codes and 

State laws that also apply here, but at least HIPAA in those kinds 

of situations where a danger is posed does not stand as an obstacle 

to providers acting in the interest of the patient and of public safety. 

I think it is also worth noting, you know, that there is a countervailing concern that patients who fear that their information will 

not be confidential won’t get treated, and I think that is why, Congressman, when you talked about that delicate and difficult balance, that is the balance that both our regulations and healthcare 

providers I believe are trying to strike. 

Mr. BRALEY. Mr. Rothstein, one of the other concerns that Mr. 

Early raises is that if we have a child in a divorce proceeding or 

a custody proceeding, the number one role of the court system is 

to decide what is in the best interest of the child. That is their 

principle focus. And yet when we have adult patients who are getting mental health treatment who may or may not be able to make 

decisions about their own treatment needs, oftentimes the legal criteria are not what is in the best instance of the patient but protecting the patient’s wishes from a legal standpoint and that often 

the advocates focus on that rather than getting the best treatment 

option that would benefit them in society. 

What are the obstacles we need to face to deal with that problem? 

29 

Mr. ROTHSTEIN. It is a very difficult question. The immediate 

test would be whether the individual is competent, and if the individual is competent, healthcare providers tend to overlook all the 

other tests. If the individual is competent and a threat to self or 

others, then that overrules the competency issue. If the individual 

is incompetent, unable to make reasoned decisions about his or her 

mental health, then the confidentiality protections would not apply. 

Mr. BRALEY. Thank you. 

Mr. MURPHY. The gentleman’s time has expired. 

I now recognize the gentlewoman from North Carolina, Ms. 

Ellmers, for 5 minutes. 

Mrs. ELLMERS. Thank you, Mr. Chairman, and thank you for 

holding this very, very important mental health hearing, especially 

in lieu of the forum that we had a couple of weeks ago with the 

family members. You know, that was a very important, emotional, 

and revealing discussion that we had, which brings me to some of 

the questions that I have because I have practiced in healthcare. 

I am a nurse. My husband is a general surgeon, and you know, 

HIPAA can sometimes get in the way, and as healthcare professionals I would say that you would typically err on the side of protecting the patient’s confidentiality and yourself—as a healthcare 

professional. 

Mr. Rodriguez, I would like to ask you since the implementation 

in 2003, according to my information HHS has received over 79,920 

HIPAA complaints. What is the procedure when a complaint comes 

in? 

Mr. RODRIGUEZ. Sure. The first thing we do is assess whether, 

in fact, it is a HIPAA complaint at all or whether the complaint 

is about some other issue outside of our jurisdiction. If we determine that we do have jurisdiction, we then conduct an inquiry. 

Mrs. ELLMERS. OK. 

Mr. RODRIGUEZ. Conduct an investigation into the allegations. If 

we determine that there were violations of relevant HIPAA requirements, we then ordinarily work with the entity—I am going 

to talk about the exception in terms of our Monetary Enforcement 

Program—work with the entity to correct whatever the deficiencies 

are in their practices in order for them to go forward and be compliant—— 

Mrs. ELLMERS. OK. 

Mr. RODRIGUEZ [continuing]. In those areas. Now, through 

HITECH as you know, we received enhanced monetary enforcement authorities, particularly directed at concerns about the security of electronic health information. 

Mrs. ELLMERS. OK. 

Mr. RODRIGUEZ. And so, since HITECH was passed, our enforcement has specifically focused on security rather than the use and 

disclosure issues that we have been talking about here, and has, 

in fact, grown, and in fact, it has been a priority of mine to grow 

our enforcement to protect the confidentiality of electronically—— 

Mrs. ELLMERS. OK. 

Mr. RODRIGUEZ [continuing]. Maintained information. 

Mrs. ELLMERS. Yes. Very important. Mr. Rothstein, can you tell 

me, since implementation of HIPAA have there been significant 

law suits filed? Is that something that you would have information 

30 

about with alleged HIPAA violations? And when I say lawsuits, I 

mean against healthcare professionals. 

Mr. ROTHSTEIN. Right. Well, HIPAA does not provide for a private cause of action. 

Mrs. ELLMERS. OK. 

Mr. ROTHSTEIN. There have been a few lawsuits alleging invasion 

of privacy or some other—— 

Mrs. ELLMERS. OK. So it would have to be—— 

Mr. ROTHSTEIN. But they refer to HIPAA violations, but HIPAA 

doesn’t provide for those. 

Mrs. ELLMERS. OK, and there again, I get back to the issue of 

healthcare providers who would err on the side of less information 

is probably better—just, always looking out for the patient and, unfortunately, always having to cover your own self. And that is one 

of my areas of concern with HIPAA, because I do believe it is a 

gray area and is left up to too much interpretation. 

So, Mr. Rodriguez, my final question here, I have a little over a 

minute, do you have a sense of how often hospitals and staff actually go over the HIPAA regulations and make sure that they are 

up to date? Is that done on an annual basis? 

Mr. RODRIGUEZ. It is, Congresswoman, variable. We actually did 

an audit program last year, which is another program required 

under HITECH, and this was a pilot, and we found a wide range. 

We found some institutions that take those obligations seriously, do 

them on a regular, annual basis, ensure that new employees are 

trained, but there are also many providers where that is not the 

case. The compliance is all over the board. 

Mrs. ELLMERS. OK. There again, unfortunately, so many things 

fall on this information. I think this is definitely one of those areas. 

So thank you very much, and I yield back the remainder of my 

time. 

Mr. MURPHY. I now recognize Mr. Butterfield for 5 minutes. 

Mr. BUTTERFIELD. Thank you, Mr. Chairman. Let me begin by 

thanking both of you for your testimony today. I thank you very 

much. It is obvious that you all are both well prepared. 

I will address this question to Mr. Rodriguez. Mr. Rodriguez, following the Newtown tragedy President Obama took appropriate action by clarifying to healthcare providers in writing their duty to 

warn law enforcement authorities of threats of violence. 

First of all, is that true? 

Mr. RODRIGUEZ. That is true. I signed the letter, but it was at 

the President’s direction. 

Mr. BUTTERFIELD. OK. That was going to lead me to my question 

was it a letter or an executive order, or what was it? It was a letter 

from your office. 

Mr. RODRIGUEZ. The letter was really a reminder of existing duties under the law and also of the Administration’s emphasis that 

these authorities to warn and these duties to warn should be fully 

exercised to protect the public safety. 

Mr. BUTTERFIELD. And has that action had any impact as far as 

you can determine? 

Mr. RODRIGUEZ. It has had impact in the sense that there has 

been renewed discussion about these issues. There was extensive 

industry media coverage of the letter, and so, therefore, we believe, 

31 

based on that, that the reminder reached the folks it needed to 

reach, which are particularly those mental health providers. 

Mr. BUTTERFIELD. And about how many letters actually went out 

from your office? 

Mr. RODRIGUEZ. They were posted on our Web site and then disseminated by both press release and through various listers that 

HHS has. 

Mr. BUTTERFIELD. Can you describe, Mr. Rodriguez, additional 

ways the Health Information Technology, HIT, for Economic and 

Clinical Health Act, which we passed in the Recovery Act, has improved privacy and security requirements for patient records? 

Mr. RODRIGUEZ. Sure. I appreciate that question. First of all, it 

has done so by bringing business associates within the ambit of the 

privacy and security worlds. That is those contractors who serve 

healthcare providers, and in fact, often come into possession of 

large quantities of protected health information. We now directly 

regulate them as we directly regulated healthcare providers before 

that. It increases the penalties for violation of HIPAA, which we 

have used extensively for security violations, and it also establishes 

requirements that breaches of health information need to be reported to our office, to the affected patients, and in cases of larger 

breaches, also be reported to prominent media that will be seen by 

the affected patients. 

Mr. BUTTERFIELD. All right. My third question follows. Can you 

describe the training that medical professionals receive to ensure 

they adhere to HIPAA? 

Mr. RODRIGUEZ. Sure. To my knowledge, and I wouldn’t consider 

this a comprehensive answer, but certainly training on HIPAA is 

offered at many professional conferences. In fact, we actually have 

prepared a series of videos that have been posted, and several more 

that will be posted on Medscape, including some that are, by the 

way, relevant to the topic we are discussing here, that discuss various aspects of the privacy and security rules. 

We are particularly concerned about smaller providers who don’t 

necessarily have the resources of larger institutions. So we are 

looking for opportunities to reach them. 

I also understand that there are medical school curricula that 

touch on these issues as well. 

Mr. BUTTERFIELD. It is my understanding that healthcare providers covered by HIPAA must notify patients if the privacy of 

their health information is breached. What methods are used to notify those individuals? 

Mr. RODRIGUEZ. They should ordinarily be notified in writing, 

and, again, we also in certain cases provide for notification through 

the media. 

Mr. BUTTERFIELD. All right. Finally, Mr. Rothstein, Dr. 

Rothstein, even with HIPAA protections we have heard that privacy concerns can cause individuals to actually avoid treatment. I 

am not sure I knew that. 

Could increasing information sharing through HIPAA cause 

fewer individuals to seek treatment? 

Mr. ROTHSTEIN. That certainly is a concern, especially individuals who have sensitive information that they are worried will be 

disclosed. Yes. 

32 

Mr. BUTTERFIELD. All right. Mr. Chairman, I yield back. 

Mr. MURPHY. I thank the gentleman. 

Dr. Cassidy is not a member of the Oversight and Investigations 

Subcommittee but has asked for an opportunity to join us and 

without objection we will allow him 5 minutes to ask questions. Dr. 

Cassidy. 

Mr. CASSIDY. Thank you, Chairman Murphy. 

Gentlemen, I am a practicing physician, will see patients this 

Tuesday morning, and I have a sense that you two are incredibly 

bright and well-versed in this law and is totally divorced from the 

reality of an ER physician seeing 20 patients in a shift, and at 3:00 

a.m. there is a person who comes in with these issues. 

I will just tell you, and I will also tell you that physicians fear 

the Federal Government. They understand that if the Federal Government comes after them and grabs them in their long legal arm, 

the physician may ultimately win, but she is destroyed in the process. 

Now, I listened to what you say how this would allow certain 

forms of communication, but I will also say when I read that the 

maximum penalty is 1.5 million, when the physician is having 

their in-service on HIPAA, that is what they remember, and when 

they understand that it is permissible not to give information, but 

you may get in trouble if you do, I can tell you that guy, that gal 

seeing the patient at 3:00 a.m. with 20 patients doesn’t have your 

expertise, but what they do have are examples of physicians who 

had been grabbed by the law and not let loose until every one of 

their personal resources had been exhausted. 

Now, that is just a comment borne out of incredible frustration 

with this sense that the Federal Government is this benign entity 

that the American people have no reason to fear. Indeed, it has 

great reason to fear, and so people act cautiously. 

Now, that said, after my rant, I apologize, let me ask a couple 

things. We say that the doc may communicate with the family if 

there is imminent danger, but what if the patient is non-compliant? 

Can the family say to the mother of the adult child who lives with 

her, your son is not taking his medicines, and therefore, we need 

to do something about that? Can the physician do that? 

Mr. RODRIGUEZ. So, again, we go back to the idea of serious risk 

to health or safety. So we are not talking about imminent danger 

in the sense of somebody violent going out, and it certainly includes 

that scenario, but it is much broader than that. So if the patient’s 

health would be seriously, adversely affected and the provider’s 

communication of that information to the parent would provide a 

way of eliminating or at least reducing that threat, then HIPAA 

provides them clear authority. 

Mr. CASSIDY. So the specific example, the patient is bipolar, and 

I am a little rusty on my psyche so this medicine may no longer 

be used, but assume that they are on Lithium, and their Lithium 

level shows that it is low, the patient is not taking their drug. We 

have documented fact. Can the doc say to the mom, your son is not 

taking his Lithium? 

Mr. RODRIGUEZ. You also might have heard the beginning of my 

testimony. We were also talking of cases of incapacity. 

Mr. CASSIDY. Of what? I am sorry. 

33 

Mr. RODRIGUEZ. Of incapacity. 

Mr. CASSIDY. No. I am not saying they are incapacitated because 

when that level falls, they don’t immediately become incapacitated. 

They are just on the potential verge of being but they can still 

seem sane. 

Mr. RODRIGUEZ. Well, then I think the pathway is—if the result 

of that would be serious and imminent threats to that individual’s 

health, then HIPAA provides a path for those communications. 

Mr. CASSIDY. There seems to be a little bit of wiggle room there. 

The guy could get back on his dose and bring it back up to snuff. 

I am not sure the physician would find a safe harbor in that kind 

of answer. 

Mr. RODRIGUEZ. Well, I think the greater safe harbor, Congressman, would be this: We have received 80,000 complaints since we 

began enforcing. Only 12 of them have resulted in monetary penalties. 

Mr. CASSIDY. I accept that, but what you are talking about is a 

fellow seeing patients 20 in a shift at 3:00 a.m. in the morning who 

doesn’t have your expertise. That is the reality, and I can tell you 

that what you hear in that in-service is that if you violate HIPAA, 

they are going to turn you every which way but loose. I can tell 

you that is what the in-service is because I have been there. 

Mr. RODRIGUEZ. I would love to see those in-services because 

they are not consistent with our enforcement history. 

Mr. CASSIDY. Secondly, it says here that the patient healthcare 

provider is not permitted to share personal information with the 

family or friends of an adult who tells the provider not to do so. 

What if that patient is incompetent? What if they actually at this 

point in time are not lucid? They think that there is black helicopters circulating and that their mom is the pilot of one of them. 

Mr. RODRIGUEZ. And that is why I mentioned that, certainly in 

cases of incapacity, and certainly incapacity can include a situation 

where a patient is far from lucid, then in those cases there is also 

a basis for—— 

Mr. CASSIDY. Now, sometimes lack of lucidity is in the eye of the 

beholder. I will tell you that there is a Wall Street Journal article 

about William Brice or Bruce, I forget which, in which the young 

man was released and went out and killed his mother with a 

hatchet. And so clearly he was considered lucid enough to be released. 

I am sorry. I am out of time. I apologize. I will have to forego. 

I yield back. I am sorry. 

Mr. MURPHY. The Chair is going to ask that everybody be permitted 1 minute of additional questions, and then we will get onto 

our next panel, recognizing we have votes coming up soon. So we 

will do 1 minute. 

Mr. Rodriguez, as you are aware, States have said, confusion 

over HIPAA has prohibited them from sharing 1.5 million records 

with the National Instant Background Check System of persons 

who have been involuntary committed to mental health treatment 

or deemed mentally incompetent by a court of law and are, therefore, prohibited from owning a firearm. Our committee sent a letter 

to HHS on February 13 asking about HIPAA interfering with this 

34 

NICS list. I note that HHS has now announced it would be soliciting feedback on HIPAA reform. 

Why do you believe States are not uploading those records? 

Mr. RODRIGUEZ. I certainly have heard of HIPAA as one of several different reasons, so I don’t understand HIPAA to be the only 

reason. I know certainly in the case of New York State their reporting was coming out of, or their reporting would have had to have 

come out of, what was a HIPAA-covered entity and therefore, reporting would have been prohibited, and we are now looking to 

eliminate that kind of barrier. Beyond New York I don’t know if 

there are others. 

Mr. MURPHY. Can you get us a written response to the subcommittee on this issue clarifying it? 

Mr. RODRIGUEZ. Sure. 

Mr. MURPHY. Thank you. Mr. Braley, 1 minute. 

Mr. BRALEY. Mr. Rothstein, we were talking earlier about some 

of the challenges faced with the incredible burdens placed on law 

enforcement officials, our penal systems to provide front-line mental healthcare. This has been a dramatic shift in what has happened since Congress passed legislation trying to promote community-based mental health. 

So we now have this long learning experience, and people who 

care about the rights of the mentally ill, like I do, people who care 

about protecting public safety, like I do, want to know what we 

have learned from these experiences as we move forward and try 

to create a balanced system that is protecting the public and the 

rights of patients to get the best possible treatment when obviously 

we have been failing them. What can we do about that? 

Mr. ROTHSTEIN. Well, Mr. Braley, that is a difficult question. On 

the one hand we need to increase the funding and wherewithal of 

community mental health services. That is for sure. What we can 

address at this hearing today is the importance of getting out the 

message of what HIPAA does and does not require. 

One of the problems overall is that HIPAA was intended to be 

a floor above which medical ethics and State law would take place, 

but in many areas, including mental health areas, it is the floor, 

and there is nothing else above it. 

Mr. MURPHY. If you can offer a written response, too, we would 

appreciate that, because we are going to need more detail. 

Dr. Gingrey, you are recognized for 1 minute. 

Mr. GINGREY. Mr. Chairman, thank you. I don’t know if I can do 

this in a minute but quickly. 

Mr. Rodriguez, on January 25, 2013, HHS published a final rule 

that makes, and I quote, ‘‘significant modifications to marketing by 

third parties to patients for purposes of identifying potential beneficial health opportunities for patients.’’ For instance, many drug 

companies use third parties to help identify patients in need of care 

for purposes of inclusion in clinical trials. Some of these patients, 

including those from my own district, have chronic illnesses for 

which no other treatment option exists. 

Would this service still be allowed if such a company, third-party 

company, did not first get the patient’s consent? 

Mr. RODRIGUEZ. It is a long answer, so I will take advantage of 

the opportunity to offer it in writing. 

35 

Mr. GINGREY. All right. Thank you, and I yield back. 

Mr. MURPHY. Dr. Cassidy, 1 minute. 

Mr. CASSIDY. Mr. Rothstein, I am little concerned. You mentioned the point there is 26 percent of the people who have a diagnosed mental disorder in 1 year, but really if you talk about serious 

mental illness it is really a much smaller percentage. 

Mr. ROTHSTEIN. Of course. 

Mr. CASSIDY. And those are the folks who are incompetent that, 

I mean, believe me, I speak from personal experience of family 

members and of friends who have been in this situation. Don’t you 

think it is a little disingenuous to say, OK, here is a group that 

truly are out of it as opposed to this 26 percent that have situational depression or such like this. 

Wouldn’t it be more honest to kind of focus upon that SMI group 

for their sake, their family’s sake as a unique group? 

Mr. ROTHSTEIN. Oh, absolutely, but the point I was trying to 

make was, if legislation were enacted that made all mental health 

records more discloseable—— 

Mr. CASSIDY. So you would accept maybe SMI under very guarded circumstances—— 

Mr. ROTHSTEIN. Of course. 

Dr. CASSIDY [continuing]. As opposed to the broader 26 percent 

of the population? 

Mr. ROTHSTEIN. That is correct, but I am worried about the discouragement of the 26 percent. 

Mr. CASSIDY. I would just say, someone who has got bipolar or 

schizoaffective oftentimes does not have that insight, and I think 

we have to be kind of honest about that. They have an acute break, 

and they have no insight whatsoever. As a guy who has worked 

with such patients and who has had close people associated. 

I yield back. Thank you. 

Mr. MURPHY. Thank you. Mr. Rodriguez, Mr. Rothstein, thank 

you so much for being with us today, and we appreciate your availability in the future to respond to questions. 

As they are stepping up, we ask the folks to get ready for the 

second panel. I would like to make an announcement. 

As we continue on with our previous hearing after Newtown and 

also this one on HIPAA, this committee is exploring issues of a 

wide range that deal with mental illness and proper treatment, et 

cetera, because of our concerns. 

I want to make it very clear, all members are aware of this, but 

certainly members of the audience and people who may be watching this also, at no time does this committee at any time communicate that those with mental illness are those who are responsible 

for violence. We recognize that victims, that they are actually 11 

times more likely to be victims of violent crime than the non-mentally ill, and the vast majority of people with mental illness are not 

violent. It is very important we understand that. 

Could the next panel please take their seats, and we will move 

forward then? 

As you sit down I will be introducing you. On the second panel 

we have Dr. Richard Martini. He is a Professor of Pediatrics and 

Psychiatry at the University of Utah School of Medicine and the 

Chair of the Department of Psychiatry and Behavioral Health at 

36 

the Primary Children’s Medical Center in Utah. For full disclosure 

I want to say that when I was on the staff at Children’s Hospital 

in Pittsburgh he was one of my students. How time flies. 

We also have Ms. Carol Levine. She directs the United Hospital 

Fund Families and Health Care Project, which focuses on developing partnerships between healthcare professionals and family 

caregivers, especially during transition in healthcare settings. 

Next we have Mr. Gregg Wolfe. Mr. Wolfe is the father of a son 

who suffered from mental illness and substance addiction. 

Then we have Mr. Edward Kelley. Mr. Kelley is also a father of 

a son with mental illness. 

And Mr. Braley, would you like to also recognize your guest 

today? 

Mr. BRALEY. Yes. Thank you, Mr. Chairman. I am thrilled to 

have one of my constituents testify today, Jan Thomas, from Parkersburg, Iowa. She has a story to tell about this gentleman who 

was featured in Sports Illustrated after he was gunned down by a 

former student. He was the NFL national high school coach of the 

year with four of his former players playing in the National Football League, and Jan has an important story to share with us 

about these issues. 

Mr. MURPHY. Thank you and finally we have Ms. Deven 

McGraw. Ms. McGraw is the Director of the Health Privacy Project 

at the Center for Democracy and Technology. 

As you all are aware, the committee is holding an investigative 

hearing, and when doing so, has a practice of taking testimony 

under oath. Do any of you have any objections to testifying under 

oath? 

The Chair then advises that under the rules of the House and 

the rules of the committee you are entitled to be advised by counsel. Do you desire to be advised by counsel during your testimony 

today? 

All answer negatively. In that case would you all please rise and 

raise your right hand, and I will swear you in. 

[Witnesses sworn] 

Mr. MURPHY. The Chair recognizes all of the participants answered in the affirmative. You are now under oath and subject to 

the penalties set forth in Title XVIII, Section 1001 of the United 

States Code. You may each now give a 5-minute summary of your 

written testimony. 

We now recognize Dr. Martini for 5 minutes. Make sure your 

microphone is on and pulled close. Thank you. 

37 

TESTIMONY OF RICHARD MARTINI, M.D., PROFESSOR OF PEDIATRICS AND PSYCHIATRY, UNIVERSITY OF UTAH SCHOOL 

OF MEDICINE, CHAIR, DEPARTMENT OF PSYCHIATRY AND 

BEHAVIORAL HEALTH, PRIMARY CHILDREN’S MEDICAL 

CENTER; CAROL LEVINE, DIRECTOR, FAMILIES AND HEALTH 

CARE PROJECT, UNITED HOSPITAL FUND; GREGG WOLFE, 

FATHER OF A SON WITH MENTAL ILLNESS AND SUBSTANCE 

ABUSE; EDWARD KELLEY, FATHER OF A SON WITH MENTAL 

ILLNESS; JAN THOMAS, FAMILY IMPACTED BY HIPAA; AND 

DEVEN MCGRAW, DIRECTOR OF THE HEALTH PRIVACY 

PROJECT, CENTER FOR DEMOCRACY AND TECHNOLOGY 

TESTIMONY OF RICHARD MARTINI, M.D. 

Dr. MARTINI. Good morning, Chairman Murphy, members of the 

subcommittee. I also want to say I am also an immediate past 

Board Member of the American Academy of Child and Adolescent 

Psychiatry, who paid for my travel here today. Thank you for inviting me to come and to speak with you about HIPAA and its implications of clinical practice and to participate in this discussion. 

Throughout my testimony I will be reviewing patient summaries 

that are based upon my clinical experience but that do not include 

easily-identifiable information. 

Decisions about the release of psychiatric information are certainly more straightforward when the patient is a minor and not 

emancipated. Parents or primary caregivers are involved in the 

process, are available not only to support the patient, but also to 

guide them into psychiatric care. Young patients do not typically 

recognize the nature or extent of their behavioral and emotional 

problems, and this is one reason why child and adolescent psychiatrists, as well as other pediatric mental health professionals, are 

trained to involve families in diagnosis and treatment. We also 

know that this improves outcome. 

All pediatric specialties struggle with the transition of patients 

from adolescence into young adulthood, from a period of dependence to a period of almost complete autonomy. Many are not prepared for the responsibility, particularly those patients that experience chronic medical illnesses, developmental delays, and psychiatric disorders. Families have provided a framework for their 

care and for many aspects of their life. 

One of my patients, a former patient with a mild form of autism, 

developmental delay, and an anxiety disorder was determined to 

move out of the home once he was employed. The parents knew, 

however, that he could not manage his money, that he was emotionally reactive when faced with new experiences, and he really 

could not track his medications. Nevertheless, he did not want his 

parents involved in routine care. It forced the parents to go to 

court, state that their son was not able to care for himself, and 

must be dependent. Unfortunately, the subsequent ruling in their 

favor was counter to our goals in psychiatric treatment, and it derailed his progress in therapy. 

Psychiatrists spend a lot of time negotiating communications between parents and their children, and we don’t want to discourage 

anyone from accessing care, specifically those who will not seek 

treatment if they believe that someone will contact or involve their 

38 

parents. However, the application of HIPAA regulations should be 

a negotiation with several options available to both the clinician 

and the patient. A patient of mine in his early 20s suffered from 

a long history of congenital kidney disease. He was in and out of 

the hospital, usually in the company of his mother. He came into 

treatment because he was angry and depressed over the circumstances of his disease and his subsequent organ transplantation. I wanted to involve the mother in therapy as a support, but 

he refused because he was concerned about how disappointed she 

would be given everything that they had gone through together. He 

was in treatment for about a year, and he was on antidepressant 

medications but dropped out of treatment because it was too difficult. Two years later, I ran into his physician who told me that 

he discontinued his kidney medications, went into renal failure, 

and died. 

Psychiatrists should be able to both respect the individuality of 

the adolescent or young adult under the legal protection of HIPAA 

and use the strengths of the family when necessary to support 

treatment. I recognize that allowing more communication and less 

privacy for an adult patient at risk for a serious mental illness is 

a significant change in the intent of the law, but must we wait for 

a patient to be considered at risk for imminent harm to self or others before seeking help from parents or family? 

Rules about confidentiality certainly affect situations that are 

relatively more common among adolescence and young adults, like 

going to college. Parents are told that even though they are going 

be paying the bills, they will not have access to any medical or psychiatric information without the student’s permission. One such patient with a history of congenital heart disease and ongoing depression wanted to go away to college. Her parents wanted her to stay 

close to home. She prevailed, but within 3 months of going to 

school, she began to deteriorate both medically and psychiatrically. 

The Student Health Center knew that she was ill but without her 

permission could not contact the parents. If this patient had a really serious disorder with immediate consequences, the family may 

not find out about it until they receive a bill some 30 days after 

the event. If there is a bias in these situations, should it be toward 

parental involvement more than away from it? 

Mental health professionals strive to do what is in the best interest of the patient, while preserving his or her right to privacy and 

protection under the law. The basis for civil commitment and family communication regardless of the patient’s wishes has been risk 

of harm to self or others. I suggest that this standard be reexamined with the goal of involving families whenever possible. 

Thank you, Mr. Chairman. 

[The prepared statement of Dr. Martini follows:] 

39 


82190.016

Congressional Testimony 

Energy and Commerce Committee 

April 26, 2013 

D. Richard Martini, M.D. 

Good morning, Chairman Murphy, ranking member DeGette and members of the subcommittee. 

My name is Dr. Richard Martini, and I am currently Professor of Pediatrics and Psychiatry at the 

University of Utah School of Medicine and Chair of the Department of Psychiatry and 

Behavioral Health at Primary Children's Medical Center in Salt Lake City. I have been a 

practicing child and adolescent psychiatrist for over 25 years, and am an immediate past board 

member of the American Academy of Child and Adolescent Psychiatry, who paid for my travel 

here today. 

Thank you for inviting me to come and speak to you about HIPPA and its implications in clinical 

practice, and to participation in this discussion. Throughout my testimony I will be reviewing 

patient summaries that are based on my clinical experience. but that do not include easily 

identifiable information. 

Privacy and confidentiality between a physician and hislher patient is paramount. When asked 

for patient information, physicians should make reasonable efforts to disclose only what is 

necessary for the purpose requested. However, physicians are required to release medical 

information. even without the patient's written consent, when they have concerns that he or she 

may be at risk for immediate harm to themselves or others, and when ordered by a court. 

Decisions around the release of psychiatric information are more straightforward when the child 

or adolescent is a minor and not emancipated. Parents and/or primary caregivers are involved in 

the process and are available not only to support the patient, but also to guide them into 

psychiatric care. Young patients do not typically recognize the nature or the extent of the 

behavioral and emotional problems that affect them, and this is one reason why child and 

adolescent psychiatrists as well as other pediatric mental health professionals, are trained to 

involve families in diagnosis and treatment. We also know that this improves outcome. All 

1 
40 


82190.017

pediatric specialties struggle with the transition of their patients from adolescence to young 

adulthood, from a position of dependence to one of complete autonomy. Many are not prepared 

for the responsibility, particularly those with chronic physical illnesses, developmental delays, 

and psychiatric disorders. Families have provided a framework for their care and for many 

aspects of their life. When that framework is removed, some patients believe that this is an 

opportunity for them to manage their own lives, and to assert themselves apart from parents and 

family members. A former patient with a mild form of autism, developmental delay, and an 

anxiety disorder was determined to move out of the home and into his own apartment once he 

was able to get a janitorial job at a local airport. His parents knew that he could not manage 

money, reacted emotionally when faced with anything outside of his experience, and was unable 

to keep track his medications. Nevertheless, he did not want his parents involved in his care, and 

because ofHIPPA regulations, the only way that the parents could address their concerns was by 

going to court and stating that their son could not care for himself and must remain dependent. 

Unfortunately, the subsequent ruling in their favor was counter to our goals of psychiatric 

treatment and derailed his progress in therapy. 

Health professions train with an emphasis on HIPPA and its attached liability penalties, and may 

not practice with the appropriate clinical sensitivity that balances patient and family engagement. 

Psychiatrists spend a lot oftime negotiating communications between parents and their children 

and we don't want to discourage anyone from accessing care, specifically those who will not 

seek treatment if they believe that someone will contact or involve their parents. However, 

application ofHIPPA regulations should be a negotiation with several options available to both 

the patient and the clinician. A patient of mine in his early 20's suffered from a congenital 

kidney disease and spent his life in and out of hospitals, with his mother by his side, until her 

received a transplant in his late teens. I saw him in therapy because he could not accept the 

changes his illness and the transplantation made in his life, particularly when he compared 

himself to same age peers. He created stories to explain his scars and was angry and depressed 

over his situation. I wanted to involve his mother in therapy both as a support and as a source of 

information to better understand his experience as a renal patient. He refused because he 

believed that his mother would be disappointed in his behavior given all that they shared 

together. After a year in therapy with a trial of antidepressants, he dropped out of treatment, 

finding it too difficult. Two years later I learned from his physician that he discontinued his 

2 
41 


82190.018

kidney medications, went into renal failure, and died. Psychiatrists should be able to both 

respect the individuality of the adolescent or young adult under the legal protection ofHIPPA, 

and use the strengths of the family when necessary to support treatment. I recognize that 

allowing for more communication and less privacy for an adult patient at risk for serious mental 

illness is a significant change in the intent of the law. Must we wait for a patient to be 

considered at risk for imminent harm to self or others before seeking help from parents or 

family? The State of Tennessee, for example, created a treatment review team of physicians that 

can override HIPPA regulations when it is believed to be in the best interests of the patient's 

health. The challenge is in where and when to draw that line. 

Rules about confidentiality affect situations that are relatively common in adolescence and young 

adulthood, including enrollment in college. When a young adult begins her college education, 

parents are told that although they will be paying the bills, they will not be given any medical, or 

psychiatric information about their child without the student's permission. Family members as 

well as medical and mental health professionals must negotiate with a young adult whose 

priorities may be very different than their own. One such patient with a history of congenital 

heart disease, multiple cardiothoracic surgeries, and depression wanted to go away for her 

college education. Mother preferred that she stay in town, in close proximity to the children's 

hospital where she received her care. The patient prevailed and enrolled in a small rural college 

approximately 200 miles from home. Within three months, she began to struggle, not with 

academics but with her energy level and her depression. She colluded with her older brother 

who drove to her dorm the day before her parents would arrive and cleaned her room, did her 

laundry, and organized her schoolwork. The patient knew that ifher parents discovered the 

extent of her troubles, she would be forced to transfer back home. The Student Health Center 

knew that she was struggling, but could not talk to the parents without her permission. Now 

imagine that this patient had a history of a serious mood disorder, a substance abuse disorder, or 

an eating disorder, all with serious consequences. The only indication for the parents that there 

is a problem may be a bill from the Student Health Center that arrives 30 days after an event. If 

there is a bias in these situations, should it be toward parental involvement rather than away from 

it. 

3 
42 


82190.019

Through the Affordable Care Act parents are now allowed to keep their young adult children on 

their health insurance until age 26. I support this and believe that it will ensure the provision of 

needed medical and mental health services. However, it is unclear who owns the record and 

what rights the parents have to their young adults health information. It creates a new grey area 

in terms of respecting the adult patient who is receiving benefits as a dependent of a parent. 

Mental health professionals strive to do what is in the best interests of the patient, while 

preserving her right to privacy and protection under the law. The basis for civil commitment and 

family communication regardless of the patient's wishes has been risk of harm to self or others. 

I suggest that this standard be reexamined with the goal of involving families whenever possible. 

4 
43 

Mr. MURPHY. Thank you, and Ms. Levine, you are recognized for 

5 minutes. 

TESTIMONY OF CAROL LEVINE 

Ms. LEVINE. Chairman Murphy, members of the committee, 

thank you very much for inviting me here today. I am at the other 

end of the age spectrum. I work with family caregivers of older 

adults who are with multiple chronic illnesses, and I think the importance of my experience for your deliberations is that the misinterpretations of HIPAA which we have heard about from Mr. 

Rodriguez and Mr. Rothstein are far more pervasive than the specific questions of mental illness. 

There are about 42 million Americans who are taking care of 

their chronically-ill older parents or other relatives, and I can’t tell 

you how many times I hear from family caregivers who have a parent in the hospital, and the family member is expected to do a 

wound care, multiple medications, monitor machines, make all the 

care coordination in the community, and when you ask about what 

do I need to know to do this, they say, well, I can’t tell you because 

of HIPAA. And that is just simply wrong and why does it happen? 

Because of the two features that have already been mentioned. 

There is this training that emphasizes the scary aspects of 

HIPAA. It is often done in a way that if you say anything, you are 

going to be in big trouble. That—and if the training doesn’t say 

that, then the informal communication among healthcare providers, particularly from the mid-level staff, it is not necessarily 

physicians but nurses, social workers, others, terrified that they 

are going to get sued, they are going to lose their job. Meanwhile, 

laptops lie all over the place. They are not paying attention to the 

actual security of this information. 

The second reason, and I think this is very pervasive, also alluded to, HIPAA has become a very convenient excuse to avoid difficult conversations with families. It takes time, it is sometimes uncomfortable, it has really nothing to do with privacy of the patient’s 

information. It has to do with I don’t—why am I—why do I have 

to talk to this daughter? Why can’t I just tell the patient? Well, 

fine, if the patient is totally able to understand, but an 85-year-old 

woman with congestive heart failure, moderate dementia, 55 other 

medications and so forth, just cannot absorb that information. 

So I think that what we really need is far more education on a 

balanced level. I think it is instructive that our next, United Hospital Fund’s Next Step in Care Web site, guides for family care, the 

most downloaded guide is the one to HIPAA. So people are confused, and they are looking for information. And I think that hospitals, the covered entities, wherever they are, need to be encouraged to provide understandable information to their patients, to the 

families, to everyone they deal with. You go to a hospital now, you 

get a piece of paper to sign or several pieces of paper, you can barely understand. I think only Mr. Rothstein and Mr. Rodriguez and 

several members of the committee here would actually be able to 

understand it, and mostly it is about what we could do with your 

information. It is not about protecting the patient’s interests at all. 

I think my ultimate question is always whose interests are being 

protected? Is it the patient’s interests? Is it the staff members’ inVerDate Nov 24 2008 14:42 Nov 07, 2013 Jkt 037690 PO 00000 Frm 00049 Fmt 6633 Sfmt 6633 F:\MY DOCS\HEARINGS 113\113-37 CHRIS
44 

terests in not getting into trouble? I appreciate that. Or is it the 

institution’s interests in not making any kind of—not being, also 

not being in trouble, and those are valid, but they should never 

override the good clinical care, the importance of good communication that older people, younger people, everyone needs to get the 

best possible clinical care. So it is a very pervasive problem. It goes 

beyond what you are specifically asking about, but I think in all 

it is a kind of waterfall. Once it starts, it keeps going, and we continue to hope for more clarification. 

Thank you. 

[The prepared statement of Ms. Levine follows:] 

45 


82190.020

Testimony Before the 

u.s. House of Representatives 

Subcommittee on Oversight and Investigation 

Committee on Energy & Commerce 

April 26, 2013 

by 

Carol Levine, M.A. 

Director, Families and Health Care Project 

United Hospital Fund 

New York City 
46 


82190.021

SUMMARY OF KEY POINTS 

• Family caregivers - defined broadly as persons who have a continuing role in providing, 

managing, or paying for patient care - are responsible for demanding technical and 

emotionally stressful tasks following a hospital or nursing home discharge. They need 

information and training to do this job. 

• HIPAA specifically permits disclosure of relevant information to people who meet this 

description. 

• Yet when family caregivers ask questions about the patient's care, they are routinely told 

"I can't tell you because ofHIPAA." This is not only contrary to the law, it is not good 

clinical care and jeopardizes the patient's well-being. 

2 

• HIPAA has been misapplied for two main reasons, both related to protecting the interests 

of professionals or organizations, not patients' privacy or other interests: 

o Fear oflegal or financial liability reinforced by "HIPAA scare" training. 

o HIP AA provides a convenient excuse for not talking to families, which is 

something many health care professionals prefer to avoid anyway. 

• OCR should strongly reinforce the provision in HIPAA that permits disclosure to 

involved persons and should urge staff retraining on the law. 

• CMS should urge hospitals and other covered entities to review their policies and 

practices to merge privacy considerations with good clinical care. They should also 

develop simple statements for patients and families about the protections in place for the 

security of data and how their data will be shared with other organizations. 
47 


82190.022

Chairman Murphy, Ranking Member DeGette, and Subcommittee members, I am honored to be 

with you today to talk about the experiences of family caregivers with HIPAA, the federal 

privacy law. 

My approach to this subject starts with a few basic assumptions. 

• First, good clinical care depends on good communication. 

• Second, HIPAA was not intended to override good clinical care. 

• Third, the interests of the patient, not health care professionals or organizations, should 

be uppermost in considerations about privacy. 

3 

• Fourth, most patients, particularly those with chronic or serious illnesses, are not isolated 

individuals living in a world of abstract principles or hypothetical situations. They, like 

all of us, exist in a network of relationships that give meaning to their lives and support 

them through their illnesses. Family - defined broadly to include people the patient 

identifies and trusts whether they are related by blood or marriage are at the center of 

this network. 

• Fifth, the health care and long-term care systems in the community could not exist 

without the unpaid contributions offamily members. 

Although it was not the intent of the law, HIPAA has been interpreted and misapplied as a 

barrier to communication with the very people who have a deep and often lifelong relationship 

with the patient and who will be responsible for managing or providing care in the community. 

When a family member asks almost any question relating to a family member's care and 

treatment, this is what they too often are likely to hear: "I can't tell you because ofHIPAA." 

End of conversation. 
48 


82190.023

4 

This is a misinterpretation ofHIPAA. Here is what the Health and Human Services' Office of 

Civil Rights, responsible for monitoring HIPAA, says: "The HIPAA Privacy Rule at 45 CFR 

164.51 O(b) specifically permits covered entities to share information that is directly relevant to 

the involvement ofa spouse, family members, friends, or other persons identified by a patient, in 

the patient's care or payment for health care." The only exception is if the patient objects. I will 

say more about that later. 

Family Caregivers and Why They Need Patient Information 

Before I suggest some reasons why this discrepancy between the law and its implementation 

exists, let me say a few words about family caregivers. There are an estimated 40-50 million 

family caregivers in the U.S. The unpaid labor of these relatives, partners, and friends is 

estimated to be worth $475 billion a year.! They provide 80-90% of the long-term care in the 

community for an aging popUlation with multiple chronic conditions, including Alzheimer's 

disease and other dementias. Without this essential family support, these individuals would 

require nursing home care, which is not what they or their families want, and certainly would add 

enormous cost to an already strained system. 

Health care currently focuses on encouraging patients and families to become more "engaged," 

"activated," and "self-reliant" in care. These efforts, as well as HIPAA itself, assume a 

competent adult patient, able to absorb complicated information and act on it. But many of the 

patients most at risk for poor outcomes and hospital readmissions-Qlder adults with multiple 

chronic conditions, including cognitive deficits-are not able to become actively engaged. 
49 


82190.024

Several studies have demonstrated that hospital patients do not remember or do not understand 

the medications they are supposed to take at home. In one study patients younger than 65 were 

unable to name 60% of their medications, and people over 65 could not remember 88% ofthese 

medications." Recently discharged patients rely on a family member or friend to help them at 

home and to manage or provide follow-up care. 

5 

Recently doctors have described a "post-hospital syndro~e," 3 a condition family carergivers 

know well. Even in ordinarily healthy and competent people, the experience of hospitalization 

itself, particularly a stay in an ICU, can create temporary lapses in cognitive function and 

independence. For elderly people who are already frail or confused, the problem is even worse. 

Dr. Peter Provonost of Johns Hopkins University says, "Patients in this state of mind are in no 

condition to understand discharge instructions such as how to keep wounds clean or when to take 

medications. It's easy to see how the patient can quickly decline." 4 Yet hospital staff continue 

to say to a family caregiver, "I explained everything to your mother. Just ask her what to do." 

For 17 years I was one of this army ofinvisible family caregivers. I took care of my late 

husband, who had a traumatic brain injury and was quadriplegic, at home. And for the past 15 

years I have directed the Families and Health Care Project at the United Hospital Fund, a 

nonprofit health services research and philanthropic organization. We work to raise awareness 

among policy makers, health care professionals, and regulators about the importance of training 

and supporting family caregivers who take on this daunting challenge. To help family caregivers 

and health care providers work more closely in partnerships, we created a websitewwww.nextstepincare.org. The website is home to 25 guides for family caregivers in English, 
50 


82190.025

Spanish, Chinese, and Russian, and a robust complement of guides for providers. The guides to 

HIP AA were among the first on the website and in recent months they have become the most 

frequently downloaded. 5 I think that says something about the level of confusion that exists in 

the public and among health care providers as well. 

6 

In 2012 the United Hospital Fund and the AARP Public Policy Institute collaborated on a 

national survey offamily caregivers to determine the extent of the medical/nursing tasks they 

perform, how they learn to do these tasks, and who helps them. 6 We found that nearly half 

(46%) offamily caregivers were doing one or more medical/nursing tasks (defined as medication 

management of various kinds, wound care, monitoring medical equipment, or similarly 

demanding tasks), in addition to the personal care and household chores more usually associated 

with family caregiving. When asked who taught them, these caregivers typically responded, "I 

learned on my own." Yet their family members, most of whom had multiple chronic conditions, 

had been to hospital ERs or had been admitted to the hospital, sometimes more than once, in the 

previous year. And when we asked who else helped at home, the answer again typically was, 

"No one." Family caregivers arrange doctor appointments, transportation, supplies, and other 

necessities. In effect, they are care managers without portfolio. You can see why we titled the 

survey report, "Home Alone: Family Caregivers Providing Complex Care." 

We did not specifically ask about HIPAA in this survey. But in my work I hear regularly from 

family caregivers all over the country who tell me their stories about being shut out of important 

discussions about their ill family member and about feeling helpless and terrified when they get 

home and realize that they don't know what to do to take care oftheir relative. When I talk to 
51 


82190.026

7 

groups of caregivers and professionals, I often ask if anyone has had an experience with HIP AA, 

Invariably many hands are raised, and heads nod in agreement. I particularly remember one 

family caregiver, a big, burly detective who takes care of his father. He said, "It's my job to get 

information from people who don't want to talk to me. But when I come to the hospital and ask 

about my dad, I can't get anyone to tell me what's going on." Ifhe couldn't jump over the 

HIPAA barrier, what chance do the rest of us, lacking his confidence and skills of persuasion, 

have? 

My HIP AA Experience 

In my previous professional experience, I worked at The Hastings Center, a bioethics institute, 

and was active in advocating for strict confidentiality protections for people with HIV lArDS who 

often suffered loss of housing, employment, and benefits because of unauthorized disclosures of 

their diagnosis. So it is with some chagrin that I recently found myself on the wrong side of the 

privacy law. My sister, who was in severe abdominal pain, asked me to accompany her to the 

Emergency Room of a major New York City medical center. We waited and waited and finally 

a triage nurse told my sister to follow her into a room. I got up to join her, but the nurse stood in 

my way, saying, "You can't come with her. It's a HIPAA rule." My sister said, "But I want her 

with me." No way. I should have insisted but I had learned from my long experience with my 

late husband that a family member who raises questions or challenges a nurse quickly gets 

labeled as a pest or an even nastier epithet, and I did not want to jeopardize my sister's care. 

(She recovered and is fine, despite two very unpleasant days on a gurney in the ER corridor.) 

Why Did We Need HIPAA in the First Place? 
52 


82190.027

8 

Before HIPAA, confidentiality of medical information was covered by a patchwork of state laws 

and regulations that sometimes conflicted and certainly confused practitioners as well as patients. 

HIP AA was primarily intended to give workers and their families the right to transfer their health 

care insurance from one job to another without penalties and to simplify administrative processes 

in transmitting information, especially electronically. The privacy provision was included as the 

final section of the law, although it has come to be its most familiar segment. 

The Privacy Rule, finalized in 2003 and revised several times since then, was intended to sort out 

these problems and give providers clear direction. In 2009, as part of the American Recovery and 

Reinvestment Act (ARRA), the expansion of health information technology was included as the 

Health Information Technology for Clinical and Economic Health Act (HITECH). This act 

significantly increased the enforcement provisions ofHIPAA, especially around security and 

transfer of electronic personal health information. 

The "HIP AA Scare" and Enforcement 

In many institutions, however, HIP AA was introduced by lawyers and risk managers who 

stressed the legal and financial consequences offailing to comply with regulations. Regardless of 

the trainers' intent, staff members who attended these sessions clearly heard the message, "If you 

want to be safe, don't tell anyone anything." One professional in the United Hospital Fund's 

Transitions in Care Quality Improvement Collaborative remarked that in her organization, even 

asking a patient if a family member helps him at home is considered a HIPAA violation. 

This training was not so much about protecting patients as protecting oneself and the 

institution. The result was what has been called the "HIPAA scare," a situation in which even 
53 


82190.028

9 

patients were not given information about their condition because of fears that the nurse or 

doctor would get into trouble. (Patients' inability to access their own information is the third 

most common problem reported to the United States Department of Health and Human Services' 

Office of Civil Rights.) That fear has been passed on to new employees who may trust what they 

learn through informal communication more than what they are told in formal trainings. 

At the same time, fears have been reinforced by reports that institutions have been fined and 

employees censured or fired because ofHIPAA violations. The most publicized violations have 

been failures to protect large amounts of data, not unwarranted disclosures of an individual 

patient's information. After a year-long examination of cybersecurity and vulnerability to 

hackers, the Washington Post concluded that health care is among the most vulnerable industries 

in the country, in part because of aging technology and failures to fix known software flaws. 

Fears that an individual doctor or nurse can be sued for disclosing information are common but 

exaggerated. An individual who believes that protected health information has been 

inappropriately disclosed has no legal recourse under HIPAA other than a complaint to the 

Office of Civil Rights. Although HIPAA creates a right to privacy, there is no right to sue a 

doctor, nurse, or hospital. The individual can file a lawsuit under state law alleging violation of 

privacy, and would bear the burden of proving harm, but HIPAA would not be a factor. State 

investigations can, however, result in fines. Some of the HIPAA violations that have resulted in 

staff being fired relate to theft of social security numbers or credit care numbers, which were 

crimes before HIPAA. Other violations have involved staff checking out their neighbors or exspouses information or a celebrity's data. These are bad enough but they should not be confused 
54 


82190.029

10 

with a daughter's justifiable desire to know what kind of follow-up care her mother will need, 

especially if she is going to be the one expected to provide it. With increasing attention under 

HITECH to breaches of confidentiality and increased penalties, it is possible that a new 

"HITECH scare" may emerge. While there is ample reason for concern about lax security, it 

would be unfortunate if this new wave of compliance anxiety overshadowed basic principles of 

communication and good clinical care. 

HIPAA'S Chilling Effect on Communication 

While fears of being sued or fined are certainly prevalent, in my opinion the overriding reason 

HIPAA is used to cut off communication is that it serves as a convenient excuse not to talk to 

families or listen to what they know about the patient. Iffamilies are kept at arm's length, the 

easier it is to avoid difficult conversations about prognosis or treatment options. With some 

exceptions, health care professionals are not well trained in or skilled at communicating with lay 

people-patients first of all but even more so their families. Families are welcomed in marketing 

material, not so much in hospital rooms. 

Part of the reason HIPAA has been so misunderstood and misused is that it fits neatly into an 

already well established pattern of keeping family caregivers at arm's length. Families ask 

questions. They want answers. If they are doing their job, they are good advocates for their 

family members. A law that limits sharing information offers a convenient but misguided 

rationale for withholding information. 
55 


82190.030

11 

Health care providers, schooled not only in HIP AA law but also in patient autonomy, sometimes 

make assumptions about patients' concerns over privacy. In fact, most patients want-and 

need-the support and understanding of the key people in their lives. Almost four in five 

respondents in a recent study of over 18,000 veterans were willing to share access to their 

electronic health records with family members and other nonprofessionals. 7 Social support is 

clearly an important element in managing chronic illnesses, and it is difficult for family and 

friends intimately involved with the patient's care to provide that support without relevant 

information. 

As I noted, there are certainly cases in which a patient adamantly refuses to have information 

shared with some or all family members. The reasons may be varied. For example, a relative 

long out of the family picture shows up unexpectedly and demands information about the 

patient's condition. Or the patient has had a long history of conflict with a particular family 

member and does not want to share any information. In our experience working with over 40 

health care organizations in New York City, however, we find that the most common reason is 

not related to privacy at all but to a desire not to burden a family member with responsibilities. 

"I don't want my daughter to worry about me. I will be fine on my own." Understandable but 

unrealistic and ultimately self-defeating. These cases require negotiation, especially if the family 

member is going to be responsible for follow-up care. At the same time health care providers 

should not agree to withhold vital information from the patient at the family'S request unless the 

patient has asked not to be informed. Establishing rules for communication are important and 

are best accomplished at the outset of care. 
56 


82190.031

12 

Recommendations 

• OCR should reinforce to health care providers the provision in HIPAA that permits 

disclosure of relevant protected patient information to family caregivers or others who are 

going to be responsible for providing, managing, or paying for a patient's care. 

• As part of its Conditions of Participation, the Centers for Medicare and Medicaid 

Services (CMS) should encourage hospitals and other covered entities to convene a group 

of senior leaders and staff to review relevant elements of the organization's privacy 

policies and practices. This should include general information about HIPAA 

compliance but also any specific practices that deviate from the general rules (requiring 

written consent, for example, for disclosures to family members). It should also include 

information about the protections in place to protect the security of data collected and 

stored in an electronic health record. 

• Staff should be trained (or retrained) on HIP AA and HITECH so that all understand the 

same principles and rules. As a practical matter, it helps to have one or two family 

members be designated to receive updates and to avoid giving information over the 

telephone to unfamiliar people. 

• CMS should encourage health care organizations to create a simple statement of the 

organization's policy and practices that patients and family can understand. Patients are 

required to sign a legal disclaimer that they have been informed about the organization's 

policies, but these are usually written in language that only health care lawyers can 

understand. Instead of giving patients confident that their in formation will be protected 

from theft and misuse, these statements usually describe the many ways in which the 

organization can use the patient's information. 
57 


82190.032

13 

Thank you for your attention and I will be glad to answer any questions. 

1 Feinberg, L., Reinhard, S.D., Houser, A., and Choula, R. Valuing the Invaluable: 2011 Update. 

The Growing Contributions and Costs of Family Caregiving. Washington: AARP Public Policy 

Institute, available at http://assets.aarp.org/rgcenter/ppi/ltc/i51-caregiving.pdf 

2 Science Daily, December 10,2012. 

http://www.sciencedaily.com/releases/2009/12/091210000845.htm 

3 Krumholz, H.M. Post-hospital syndrome--an acquired transient condition of generalized risk. 

New England Journal of Medicine Jan 102013; 368(2): 100-102. 

4 Quoted in http://www.usatoday.com/storv/news/nation/20 13/0 1/22/patients-post-hospitalsvndrome/18538131 

5 http://www.nextstepincare.org/Caregiver Home/HIPAAI 

http://www.nextstepincare.org/next step in care guides/211Provider HIPAA/English 

6 Reinhard, S.C., Levine, c., and Samis, S. Home Alone: Family Caregivers Providing Complex 

Care. Washington and New York: AARP Public Policy Institute and United Hospital Fund, 

2012. Available at: http://www.uhfnyc.org/publications/880853 

7 Zulman, D.M., Nazi, K.M., Turvey, C.L., et al. 2011. Patient interest in sharing personal health 

record information. Annals of Internal Medicine 155:805-810. 
58 

Mr. MURPHY. Thank you, and Mr. Wolfe, you are recognized for 

5 minutes. 

TESTIMONY OF GREGG WOLFE 

Mr. WOLFE. Good morning, Chairman Murphy and members of 

the Oversight Committee. My name is Gregg Wolfe, CEO of 

Kaplan, Leaman, and Wolfe Court Reporting and Litigation Support and Federal Official Court Reporter for the Eastern District of 

Pennsylvania. 

I am very thankful for the invitation extended to me so that I 

may testify to address the necessary and dire need to change the 

HIPAA law regarding minors and legally emancipated adults who 

either have a mental disorder, disability, or drug and/or alcohol addiction. I will set forth the reasoning for the exception to our valuable HIPAA law, which will have a positive impact on our society. 

My son, Justin, was a gregarious, affectionate, caring, compassionate, and intelligent young man whose life came to a sudden end 

on December 19, 2012, from a heroin overdose at the very young 

age of 21. 

Justin had attended Drexel and Syracuse Universities for his 

freshman and sophomore years respectively, carried a 3.0 GPA, but 

each year ended poorly due to aberrant behavior. Justin had been 

seeing therapists since he was 15 1⁄2 due to anxiety, OCD, and 

ADHD. 

He was placed on Adderall when he was almost 17 years old. Unlike physical illness, mental illness has a much longer maturation 

and duration until one discovers the effects and results with which 

to treat and possibly cure. 

In 2012, Justin told his mother that he was addicted to Percocets 

and Oxycontin. She, in turn, took him to our primary care physician without my knowledge, per Justin’s request. At that time, Justin apprised the doctor of his addiction, but also, when his mother 

was not present in the room, he stated that he had been using heroin for a few months prior to that date. 

Justin had asked that I not be apprised of any of those substances and did not want his mother being informed of his heroin 

usage. Without the heroin usage, the doctor expressed dire concern 

to Justin’s mother and told her to take him immediately to a recommended crisis center for treatment. However, upon departing 

the office, Justin convinced his mother, through his drug-manipulative behavior, to take him instead to a Suboxone doctor he knew 

of, which she did. 

Justin would not allow his mother into the treatment room. 

There Justin admitted to using heroin for the previous year, and 

he was prescribed Suboxone. 

Two months later, against Justin’s wishes, I was only informed 

of his Percocet addiction and implored him to enter into drug rehabilitation treatment. Justin was working two jobs during this time, 

with little time to attend treatment. Additionally, he convinced his 

mother and I the Suboxone was helping him with his recovery. 

As another month passed, Justin was residing in his college 

apartment, and he finally hit rock bottom. We finally gave him an 

ultimatum, and he entered intensive outpatient treatment for 5 

weeks that summer. Once in rehab, I contacted the intake director 

59 

to inquire about his progress. I was informed that he could not disclose any information under the HIPAA regulations. I was extremely frustrated as I could not be apprised of my son’s condition. 

During Justin’s 5-week rehabilitation, I sent him to see an experienced psychiatrist weekly, which ensued until his ultimate demise this past December. I explained to the psychiatrist his history 

with abuse, for which he tried to counsel Justin, as well as to prescribe medication for his depression, anxiety, and OCD. I later 

learned, however, upon Justin’s passing, that he had not disclosed 

his heroin addiction to the psychiatrist, except to say that he had 

tried it once. 

Upon Justin’s passing, his depression and OCD medication were 

found untouched in his apartment. Oddly, he continued to take his 

anxiety medication. Justin returned to school last fall at Temple 

University where he appeared to be doing well. He even joined 

AEPI, a wonderful fraternity, where he pledged and was fully supported by the brotherhood. 

However, Justin obviously was terribly and secretly addicted to 

heroin, in addition to having mental disorders. He died of an accidental heroin overdose just a few weeks later. 

Though doctors knew since May, 2011, no one in our family was 

aware that Justin was using heroin, a lethal and insidious drug. 

Everyone was in shock and disbelief when we found out. Nevertheless, it was too late. 

I have confronted numerous parents, and nine out of ten people 

are not aware that snorting heroin is an option, which is how Justin used the drug, not by injection. Most are also shocked to learn 

that heroin is only $5 to $10 a bag. 

It was alarming to learn that it is actually cheaper to buy a bag 

of heroin on the street than it is to purchase Percocet and 

Oxycontin. Even kids from affluent suburban neighborhoods like 

my son traveled to dangerous places like Camden, NJ, and North 

Philadelphia in Pennsylvania to buy drugs. Justin sold some of his 

personal belongings and items stolen from his mother, pawned his 

computer on several occasions, and actually sold his Suboxone and 

Adderall medication, which I learned after the fact by reading his 

text messages. 

I hereby request an exception be added to HIPAA allowing parents of minors with a mental disorder or addiction, who maintain 

legal residency in their parents’ homes, living under the auspices 

of their parents’ care, and who are under their parents’ health insurance coverage as specified by President Obama, until the age of 

26, access to that minor’s medical records for the following reason: 

prevention of harm to individuals and to society. 

One. Any type of addiction or mental disorder can be life threatening to not only one’s self but to society as a whole as indicative 

of the Newtown Massacres, Columbine, the Aurora shootings, to 

name just a few. 

Justin was non-violent and would never intentionally hurt a soul, 

but unintentionally his life cut short destroyed other lives including 

his younger brother, Austin, who is a Type 1 diabetic, not to mention the individuals to whom he sold his Suboxone and Adderall. 

After Justin’s passing, Austin told us of his reckless disregard 

when driving as well as when conducting some of his activities. 

60 

Thank God he never hurt anyone on the road. I have pictures of 

Justin’s apartment from his last months that demonstrate how he 

resided at college, including cigarette burns in his bedding from obviously nodding out, which could have set the apartment complex 

ablaze, resulting in injury or death to himself and others. 

Two. Justin’s stepfather had taken him assault rifle target shooting on occasion for sport. Had we known about his heroin addiction, he would not have armed him. Justin had often asked my permission to become licensed to buy a gun, which I was against despite not knowing about his addiction. However, I am forever 

thankful for not allowing it, especially now that I know he was 

using a mind-bending drug. 

Mr. MURPHY. Mr. Wolfe, I know—we are out of time. Can you 

give a final summary, and we can have you come back to that element two? Is there a final summary you can give to your statement 

there? 

Mr. WOLFE. I do. I have some very important points to make, 

and it will only take 3 or 4 more minutes. 

Mr. MURPHY. I will give you an additional minute. Go ahead. 

Mr. WOLFE. Thank you. 

Three. Justin’s lying and manipulation was the result of his heroin addiction. I have learned that heroin rewires the synapses of 

the brain so the only way to experience pleasure is by doing more 

of the drug. One becomes numb to all other surroundings, emotions, and empathy, thereby resulting in the aforementioned behavior. 

Drug-related deaths have risen steadily over the last 11 years according to a study from the Center for Disease Control. In 2010, 

drug overdoses killed 38,000 people, making drugs a more common 

cause of death than car accidents, guns, or alcohol. By comparison, 

approximately 8,500 homicides were the result of firearms. 

According to a 2011, article in Psychology Today, accidental drug 

overdosing is the second most cause of death of young people in the 

U.S., exceeding attributable to firearms, homicides, or HIV AIDS. 

According to the U.S. Department of Health and Human Services, ‘‘With an immature prefrontal cortex, which does not develop 

until 24 to 25 years old, even if teens understand that something 

is dangerous, they may still go ahead and engage in risky behavior. 

With young adults not having their frontage cortex fully developed, 

those with mental disorders and or addictions exacerbate the irrational behavior.’’ 

In many circumstances, parents know what is best for their children, especially if given the appropriate medical information with 

which to exercise judgment and guidance. In an effort to help other 

parents in similar situations, I have launched an all-out campaign 

to the media, President Obama, lawmakers in New Jersey, Pennsylvania, and Delaware, and Congressional leaders such as yourselves to call attention to this issue, and to lobby for adding additional language to HIPAA that may help protect troubled young 

adults and their communities from harm. 

Parents are unable to operate effectively in a vacuum, without 

knowledge by healthcare professionals about our drug-induced, or 

mentally disabled, legally-aged children who do not have the 

wherewithal to reason or think rationally for themselves. The abVerDate Nov 24 2008 14:42 Nov 07, 2013 Jkt 037690 PO 00000 Frm 00066 Fmt 6633 Sfmt 6633 F:\MY DOCS\HEARINGS 113\113-37 CHRIS
61 

sence of rationale may result in life-threatening decisions or, as in 

my son’s case, premature death. 

HIPAA has exceptions for public health and safety built-in. Item 

number five under Permitted Uses and Disclosures whereby protected health information can be disclosed without an individual’s 

consent, including serious threat to Health or Safety. Covered entities may disclose protected health information that they believe is 

necessary to prevent or lessen a serious and imminent threat to a 

person or the public, when such disclosure is made to someone they 

believe can prevent or lessen the threat, including the target of the 

threat.’’ So it should stand to reason language addressing this particular safety hazard is prudent and necessary. 

In closing, I am hereby requesting the following language be 

added to this HIPAA exception to avoid ambiguity. Parents or legal 

caretakers of a minor and/or emancipated adult with documented 

drug abuse and/or mental health histories, who continue to cover 

the minor and/or emancipated adult with health coverage, and/or 

continue to support the individual financially, will have access to 

that individual’s healthcare records until the age of 26 to prevent 

him/her or society from harm. 

Although Justin’s family, friends, nor Justin himself, could not 

save him, it is my hope that with change Justin’s situation can 

help save millions of young lives in the future. Addiction and mental disabilities wreak havoc on our society and affect all ethnicities 

and socioeconomic backgrounds. 

When you look at all the famous and intelligent people whose 

lives were tragically taken due to mental disturbances and drug 

abuse, this country has lost a wealth of talent and success which 

would have been an asset to the growth and strength of our Nation. 

Thank you very much. 

[The prepared statement of Mr. Wolfe follows:] 

62 


82190.033

Gregg B. Wolfe, RPR, CM 

Good Morning, Chairman Murphy, Vice Chairman Burgess, Ranking Member DeGette 

and Members of the Oversight and Investigations Subcommittee. My name is Gregg 

Wolfe, CEO of Kaplan, Leaman & Wolfe Court Reporting & Litigation Support and 

Federal Official Court Reporter for the Eastern District of Pennsylvania. 

I am very thankful for the invitation extended to me so that I may testify to address the 

necessary and dire need to change the HIP AA law regarding minors and legally 

emancipated adults who either have a mental disorder, disability or drug and/or alcohol 

addiction. I will set forth the reasoning for the exception to our valuable HIP AA law, 

which will have a positive impact on our society. 

My son, Justin, was a gregarious, affectionate, caring, compassionate and intelligent 

young man whose life came to a sudden end on December 19, 2012 from a heroin 

overdose at the very young age of 21. 

Justin had attended Drexel and Syracuse Universities for his freshman and sophomore 

years respectively, carried a 3.0 GPA, but each year ended poorly due to aberrant 
63 


82190.034

behavior. Justin had been seeing therapists since he was 15 and a half due to anxiety, 

OeD and ADHD. 

He was placed on Adderall when he was almost 17 years old. Unlike physical illness, 

mental illness has a much longer maturation and duration until one discovers the effects 

and results with which to treat and possibly cure. 

In 2012, Justin told his mother that he was addicted to Percocets and Oxycontin. She, in 

tum, took him to our primary care physician without my knowledge, per Justin's request. 

At that time, Justin apprised the doctor of his addiction, but also, when his mother was 

not present in the room, that he had been using heroin for a few months prior to that date. 

Justin had asked that I not be apprised of any of those substances, and did not want his 

mother being informed of his heroin usage. Without disclosing the heroin usage, the 

doctor expressed dire concern to Justin's mother and told her to take him immediately to 

a recommended crisis center for treatment. However, upon departing the office, Justin 

convinced his mother, through his drug-manipulative behavior, to take him instead to a 

Suboxone doctor he knew of, which she did. 

Justin would not allow his mother into the treatment room. There, Justin admitted to 

using heroin for the previous year, and he was prescribed Suboxone. 

2 
64 


82190.035

Two months later, against Justin's wishes, I was informed ONLY of his Percocet 

addiction, and implored him to enter into drug rehabilitation treatment. Justin was 

working two jobs during this time, with little time to attend treatment, Additionally, he 

convinced his mother and I the Suboxone was helping him with his recovery. 

As another month had passed. Justin was residing in his college apartment and he finally 

hit rock bottom. We finally gave him an ultimatum and he entered Intensive Outpatient 

Treatment for five weeks that summer. Once in rehab, I contacted the intake director to 

inquire about his progress. I was informed that he could not disclose any information 

under the HIP AA regulations. I was extremely frustrated as I could not be apprised of my 

son's condition. 

During Justin's 5-week rehabilitation, I sent him to see an experienced psychiatrist 

weekly, which ensued until his ultimate demise this past December. I explained to the 

psychiatrist his history with abuse, for which he tried to counsel Justin, as well as to 

prescribe medication for his depression, anxiety and OCD. I later learned, however, upon 

Justin's passing, that he had not disclosed his heroin addiction to the psychiatrist, except 

to say that he had tried it once. 

Upon Justin's passing, his depression and OCD medication were found untouched in his 

apartment. Oddly, he continued to take his anxiety medication. Justin retumed to school 

last fall at Temple University where he appeared to be doing well. He even joined AEPI, 

a wonderful fraternity, where he pledged and was fully supported by the brotherhood. 

3 
65 


82190.036

However, Justin obviously was terribly and secretly addicted to heroin, in addition to 

having mental disorders. He died of an accidental heroin overdose just a few weeks later. 

Though doctors knew since May 2011, no one in our family was aware that Justin was 

using heroin, a lethal and insidious drug. Everyone was in shock and disbelief when we 

found out. Nevertheless, it was too late. 

I have confronted numerous parents, and nine out often people are not aware that 

snorting heroin is an option, which is how Justin used the drug, not by injection. Most 

are also shocked to learn that heroin is only 5-10 dollars a bag. 

It was alarming to learn that it is actually cheaper to buy a bag of heroin on the street than 

it is to purchase Percocet or Oxycontin. Even kids from affluent suburban neighborhoods 

like my son traveled to dangerous places like Camden, NJ and North Philadelphia, PA to 

buy drugs. Justin sold some of his personal belongings and items stolen from his mother, 

pawned his computer on several occasions, and actualy sold his Suboxone and Adderall 

medication, which I learned after the fact by reading his text messages. 

I hereby request an exception be added to HIP AA allowing parents of minors with a 

mental disorder or addiction, who maintain legal residency in their parents' homes, living 

under the auspices of their parents' care, and who are under their parents' health 

insurance coverage as specified by President Obama, until the age of 26, access to that 

4 
66 


82190.037

minor's medical records for the following reason -- PREVENTION OF HARM TO 

INDIVIDUALS AND TO SOCIETY. 

1. Any type of addiction or mental disorder can be life-threatening to not only one's 

self, but to society as a whole, as indicative of the Newtown Massacres, 

Columbine, the Aurora shootings, to name just a few. 

Justin was non-violent and would never intentionally hurt a soul. But, 

unintentionally, his life cut short destroyed other lives including his younger 

brother, Austin, not to mention the individuals to whom he sold his Suboxone and 

Adderall. After Justin's passing, Austin told us of his reckless disregard when 

driving as well as when conducting some of his activities. Thank God he never 

hurt anyone on the road. I have pictures of Justin's apartment from his last months 

that demonstrate how he resided at college, including cigarette burns in his 

bedding from obviously nodding out which could have set the apartment complex 

ablaze, resulting in injury or death to himself and others. 

2. Justin's stepfather had taken him target shooting on occasion for sport. Had we 

known about his heroin addiction, he would not have armed him. Justin often 

asked my permission to become licensed to buy a gun, which I was against 

despite not knowing about his addiction. However, I am forever thankful for not 

allowing it, especially now that I know he was using a mind-bending drug. 

5 
67 


82190.038

3. Justin's lying and manipulation was the result of his heroin addiction. I have 

learned that heroin rewires the synapses of the brain so the only way to experience 

pleasure is by doing more of the drug. One becomes numb to all other 

surroundings, emotions and empathy, thereby resulting in the aforementioned 

behavior. 

4. Drug-related deaths have risen steadily over the last 11 years, according to a study 

from the Center for Disease Control. In 2010, drug overdoses killed 38,329 

people, making drugs a more common cause of death than car accidents, guns or 

alcohol. By comparison, approximately 8,500 homicides were the 

result of fIrearms. 

5. According to a 20 II article in "Psychology Today," accidental drug overdosing is 

the second most cause of death of young people in the US, exceeding those 

attributable to firearms, homicides or HIV/AIDS. 

6. According to the U.S. Department of Health & Human Services, "With an 

immature prefrontal cortex, which does not develop until 24-25 years old, even if 

teens understand that something is dangerous, they may still go ahead and engage 

in risky behavior." With young adults not having their frontal cortex fully 

developed, those with mental disorders andlor addictions exacerbate the irrational 

behavior. 

6 
68 


82190.039

In many circumstances, parents know what's best for their children, especially if given 

the appropriate medical information with which to exercise judgment and guidance. In an 

effort to help other parents in similar situations, I have launched an all-out campaign to 

the media, President Obama, lawmakers in NJ, PA and DE, and congressional leaders 

such as yourselves to call attention to this issue, and to lobby for adding language to 

HIP AA that may help protect troubled young adults -- and their communities -- from 

harm. 

Parents are unable to operate effectively in a vacuum, without knowledge by healthcare 

professionals about our drug-induced, or mentally disabled, legally aged children who do 

not have the wherewithal to reason or think rationally for themselves. The absence of 

rationale may result in life-threatening decisions or, as in my son's case, premature death. 

HIPAA has exceptions for public health and safety built-in. Item #5 under "Permitted 

Uses and Disclosures" whereby protected health information can be disclosed without an 

individual's consent, including, "Serious threat to Health or Safety. Covered entities may 

disclose protected health information that they believe is necessary to prevent or lessen a 

serious and imminent threat to a person or the public, when such disclosure is made to 

someone they believe can prevent or lessen the threat, including the target of the threat." 

So, it should stand to reason language addressing this particular safety hazard is prudent 

and necessary. 

7 
69 


82190.040

In, closing, I am hereby requesting the following language be added to this HIP AA 

exception to avoid ambiguity. Parents or legal caretakers of a minor and/or 

emancipated adult with documented drug abuse and/or mental health histories, who 

continue to cover the minor and/or emancipated adult with health coverage, and/or 

continue to support the individual financially, will have access to that individual's 

healthcare records until the age of 26 to prevent him/her or society from harm. 

Although Justin's family, friends, nor Justin himself, could not save him, it is my hope 

that with change Justin's situation can help save millions of young lives in the future. 

Addiction and mental disabilities wreak havoc on our society and affect all ethnicities 

and socioeconomic backgrounds. 

When you look at all the famous and intelligent people whose lives were tragically taken 

due to mental disturbances and drug abuse, this country has lost a wealth of talent and 

success which would have been an asset to the growth and strength of our nation. 

8 
70 

Mr. MURPHY. Thank you. Mr. Kelley, you are recognized for 5 

minutes. Mr. Kelley. 

TESTIMONY OF EDWARD KELLEY 

Mr. KELLEY. Thank you, Mr. Chairman. I am a father of a paranoid schizophrenic son. He was diagnosed at age 14, which means 

for half his life he has had this illness, and I am afraid I have some 

rather harsh news and some points to make that are going to fall 

in line, and I thank Congressman Cassidy for his comments because he really gets right to the point. 

My wife and I, upon learning of this diagnosis, embarked upon 

educating ourselves in every aspect of mental health treatment, including navigating the system, familiarizing ourselves with all the 

things that are in our way, and then we took upon ourselves to go 

out and educate others, and we have done that by teaching classes, 

we have done that by serving on boards, we have done that at 

speaking engagements, we have done it by raising money, and we 

have also done it by bringing people into our home and comforting 

them and helping them to cope. 

And so what I am going to tell you is that we are actually 

ashamed of ourselves as to what we did not know before our son 

became mentally ill, and I would dare say that if the members of 

this committee were to spend a couple of days with someone with 

psychosis, this would fly. You would change things tomorrow. 

And so what needs to happen is there needs to be recognition 

that there is a gaping hole, and I want to clarify something. There 

is a difference between anosognosia, which is lack of insight, and 

a psychotic episode. They are two entirely different things. 

Anosognosia can last for long, long periods of time and lack of insight, and you refuse treatment, and you don’t want anybody to 

help you of any kind, most importantly your family members. Not 

just parents. Brothers, sisters, grandparents. 

And so what happens is, you are setting a stage for tragedy, literally propping it up because there is this gaping hole we are trying to teach or trying to address the needs of the severely mentally 

ill the same way we are the mainstream mentally ill population, 

and it doesn’t work. It is illogical. 

My son has thought he has been a U.S. marshal looking for his 

gun. He has thought the aliens were invading him. He thought he 

was a secret agent. He thinks to this day he served in two Iraq 

wars. He has been naked in the snow. He has lived homeless under 

a bridge. He thinks my wife is a stripper and a prostitute and that 

I am a sexual predator. For an entire year he did not believe that 

we were his parents. Now, you tell me that this individual can possibly make responsible decisions about his care. 

But when he gets into the hospital, and that is a big if because 

sometimes we don’t have the recent history from prior hospitalizations to give the new hospital. By the way, he has been in 14—for 

14 years he has been in eight hospitals in four counties and one 

city dozens of different times. And so you have this broken chain 

of treatment. 

So imagine a medical system where physicians and treatment 

providers can’t rely on prior history to treat this person. It is beyond comprehension, and the other thing that happens is it stifles 

71 

accountability, and now, when I tell you that people hide behind 

HIPAA, I am a 14-year-educated man that has been in every situation possible, and it is only the grace of God and I think there is 

a plan out there for my wife and I to somehow make a difference, 

that we are sitting here and that our son hasn’t killed himself. He 

is far more likely to kill himself than he is to live the rest of his 

life with his illness. 

And so what we find is that once he gets in the hospital, treatment can be delayed or not done at all, and I want to cite this example. Our son escaped from a mental health facility that was 

locked. HIPAA was thrown out the window. The hospital was calling us, the police were calling us, they were trying to pry into his 

bank records. Every privacy violation you can imagine was enacted 

to try to do this manhunt for my son. They found him 4 days later. 

They dragged him into a state hospital in shackles so we can talk 

about stigma later. Once he was in there he verbally assaulted the 

Administrative Hearing Judge, he was put on suicide watch, he 

was completely out of it, and when the time came for his hearing 

to see whether he should receive treatment, we were precluded 

from participating because of HIPAA, and that panel looked me in 

the eye afterwards and said, we can’t do it. Our hands are tied. 

Two days later a patient was—a staff member was killed in his 

wing. We don’t even want to know what happened, but this is what 

did happen. He was 1 year, 1 year in that facility. The abuse, the 

things that happened to him in that hospital and they never, ever 

let us in. When he was 18, they couldn’t live without us. When he 

became 18, we were the enemy. We might as well have been 

strangers on the street. We have doctors who have shared with us 

behind the scenes some things that they knew they were going to 

get in trouble with. They told us, we can lose our jobs, but we have 

to tell you. We are members of community, and people know us, 

so people took chances, but when we got outside of our community, 

there were no changes being taken, and we were left out. 

The other thing that happens is imagine somebody who is mentally ill being discharged back into real society. Even under the 

best plans with families being involved, it is a very difficult process. But take a look at someone who is not part of a discharge plan 

that includes a support network. Our son has been released and 

sent on buses, and we haven’t found him for weeks, wondering if 

he is dead. 

HIPAA empowers homelessness. Our son has been gone. No 

money, no clothes that are adequate, nothing. Gone. We look 

around in shelters. Gone. We say why didn’t you tell us? We can’t. 

HIPAA precludes that. And we say, we thought—and then this 

whole idea, this notion that they have to tell us if it is a threat to 

us. Well, they are not supposed to let him out if they are a threat. 

So they have already decided he is not a threat, so they won’t let 

us do it. 

So we search for him, the shelters can’t tell that they are there, 

and then the next thing that happens is this person who has been 

released, you don’t want this person released like this. No support, 

isolated, in fear, frustrated, angry, and we are his first target. 

Right? We are the first target. 

72 

And so people are being released every day without discharge 

plans involving the family, and they have no way to transition back 

into life, and you don’t want that. You don’t want somebody that 

has psychosis as a symptom that pops up, and by the way, this 

idea of anticipating and predicting when imminent danger is coming, I just fought in the State of Maryland for 4 months to try to 

get that across. Not one person on this planet can predict the tipping point of someone with a severe mental illness. You can’t do 

it. 

So what you try to do is you rely on who? You rely on the people 

closest to that person, and who is that is the family, but the family 

can’t do it. We can’t give recent history to the next hospital or doctor because we can’t get it, so what is worse is as each year goes 

by, we have less ability to help. So this idea that we are going to 

provide information to the hospital, it doesn’t work, and it is scary. 

So in closing, I would like to say that HIPAA has a lot of gaping 

holes in it. This is the biggest, but if there are ways to beat 

HIPAA, we seek to find it, which is bad. Our son and other people’s 

sons and parents deserve the right to be collaborative and informed 

so that they are safe and their child is safe. 

Thank you. 

[The prepared statement of Mr. Kelley follows:] 

73 


82190.041

APRIL 26, 2013 TESIMONY OF EDWARD F. KELLEY III 

COMMITTEE ON ENERGY AND COMMERCE 

CONGRESS OF THE UNITED STATES 

HOUSE OF REPRESENTATIVES 

Thank you Mr. Chairman and members of the Committee. 

For background purposes - my wife and I have been married for nearly 31 years. We have 3 childrentwo sons and a daughter - two of which were blessed with great health; and one - our middle child - our 

other son, born with an illness no one should ever have to endure. Since his diagnosis 14 years agoone of paranoid schizophrenia - my wife and I have sought to become (first) better educated about 

mental illness - particularly severe mental illnesses; and, have sought to navigate the mental health 

system to find ways in which to help our son - and others - improve their lives; and - help the families 

of others who are ill help their loved ones - and themselves. My wife has been on the Boards of three 

(3) prominent Mental Health Advocacy Organizations; taught classes to help families cope with their 

loved ones' illnesses and how to better navigate the 'system'; and raised monies for these causes. 

Those of us who offer to open up Our hearts to you - do not do so without considerable thought and 

apprehension. Not because we are not fully committed to making a difference - but rather because we 

are often at risk for being exploited by what we say; or, those we love are at risk for being harmed by 

our speaking up. This is not easy - and we have taken this chance before - and - in one recent situation 

-my family has been exploited beyond comprehension. At the end ofthe day, we seek only to help 

educate those in a position to make a difference- 0 that my family - and millions of others - have hope. 

There is a gaping hale in addressing the needs far the severely mentally iII- and their families. Mental 

Health Reform has helped immensely with improving the availability of care for the mentally ill. But in 

doing so has often addressed the needs for the severely mentally ill in the same manner as that what is 

done for the 80% of those who suffer from mental illness, but are not as ill and/or have far better 

opportunities to recover. The severely mentally ill are far different - and need far different rules - as 

do their families. To not do so is utterly illogical. There are 11 to 12 million people in the US who are 

severely mentally ill. And if you multiply that 'times' the number of people in their family trying to help 

- well the math is staggering as to how many people are affected by this approach. Starting with HIPAA. 

To set the stage properly - here are a few items: 

1. For over 14 years our son has been hospitalized dozens of times. 

2_ He has been in 8 different hospitols -located in 4 different counties and one city 

3. Since our son turned 18 - he has refused repeatedly to allow hospitals and doctors to disclose 

information to us-whenever he is psychotic-which is normally the reason for his hospitalization. 

4. When someone is severely mentally ill- as has been the case with our son - they have an 

impairment of the brain known as 'anosognosia' - which quite simply creates a belief within an 

indiVidual that they are NOT ill. 
74 


82190.042

5. With this impairment - our son refuses treatment and refuses to allow his medical providers to 

speak with us or to provide us with any information regarding his status or treatment (if any). 

6. We, as parents, try to make contact with his providers, and those providers then ask our son to 

sign a release authorizing them to share our son's condition and treatment. His anger is then 

directed at us for 'daring' to put him in the hospital and wanting 'control over his life'. 

Our family - and I believe the families of millions of others who ore severely ill - want to toke 

responsibility for their loved one(s}. But so much stands in the way of American families - and this role 

is already a painful, difficult task. Rather than have the support to help us deal with a situation that is 

already tragic, we are furthered stressed because of laws that cannot possibly have been intended to 

place such a heavy burden on us. We have lost our son to a cruel, horrible mental illness. And each time 

we try to help him recover, we are blocked in so many directions. 

We have been prevented from getting him timely (or any) treatment because we have no recent 

medical records to support our case. This delay or lack of treatment has horrific consequences 

on our son. Even if our son is hospitalized, we find ourselves begging for the opportunity to help 

him - mostly we cannot. We are not his seen as parents - we are seen as the enemy. 

HIPAA stifles accountability. Who - if not the family - can make sure our loved one is being 

properly treated or not? We are at the mercy of medical providers who will do as they see fit, 

because they can hide behind HIPAA. Decisions to treat or not treat; decisions on medication; 

having the opportunity to understand the history of our son before treating him; these and 

other important factors are dropped out. Our son is at risk when we are left out. 

When our son was under 18, the hospitals and doctors relied immensely on our input and 

involvement. We would spend as much time as they requested or needed - giving them any 

information we could; and they in return would share with us their diagnosis, treatment plan 

and concerns. At the very least this process gave us assurances that mistakes have the best 

chance of being avoided, or repeated; and, would give us some sense of peace that he was 

being taken care of by people who had a reliable reference point for addressing the matter. 

Once our son turned 18, we - his parents - were the enemy_ Our son's delusions included a 

belief that HE owned our home - not us. He believed he had served in two (2) wars in Iraq and 

Afghanistan and had been wounded. He believed he had shrapnel in his body from those 

experiences, and that was the cause of his hospitalizations. He often would believe he was a U.S. 

Marshall- or a spy - and that we - his parents - were getting him hospitalized so that he could 

not do his job. He has seen a friend "living" in my wife's eye - and burned his yearbook to get 

that person out of her eye. He has told doctors that I have abused him and that my wife was a 

stripper and prostitute - and that he was traumatized from our actions. He has lived under 

bridges when he had a nice place to live. He has accidently set himself on fire falling asleep with 

a burning cigarette in his hand, on his chest. He has been victimized thru beatings and robbery 
75 


82190.043

because he was incapable of protecting himself. He has been naked in the snow for an extensive 

period of time - two times in one day! He is so ill- yet - since he became 18 - it has been a 

nightmare to help our son. 

With us having access to doctor and hospital records - we could have helped each subsequent 

doctor and staff treat our son - faster and better - or before he was released. Yet - as he is 

moved around from hospital to hospital- 8 in 4 counties and the city of Baltimore -there is no 

way to do this - as we are turned down. 

We have watched our son be given medications that are life damaging - because there is no 

record of what works or does not work. We usually do not know what medication he is being 

given. So his health is in jeopardy. As we look back now - we see a broken chain of 

hospitalizations, psychiatric evaluations and treatments that are unknown. Every hospitalization 

is a new beginning. We have had a judge tell us she will not "institutionalize" our son - when we 

wanted to get him hospitalized - because we did not have current records to prove he needed 

same. We have had doctors tell us that we cannot participate in med-panel hearings, in the 

hospital, because our son has privacy rights under HIPAA. 

We have not known where our son was; what hospital; when he was released; or what was 

done to him. 

The argument made is that the ill person can be convinced to allow disclosure - and allow the 

families to help the medical providers. Well that is not the case when someone is severely 

mentally ill- because they cannot because of their illness. 

The argument is made that the loved ones can gjyg the hospital information. Well- that 

information may need further explanation, but the hospital cannot ask for it. The information 

may lack what happened in several prior hospitalizations, because the hospitals would not 

release anything to the loved ones. In many cases all we knew was he was in the hospital- and 

that was it. It is not working this way. 

We have been told that a hospital can give notice to a family member - when the loved one is to 

be released - if the hospital feels the family members are in danger. Well- the hospital is not 

supposed to release anyone if they feel that person is a danger to themselves or others. How 

does that work? 

Our son was hospitalized; escaped from a locked unit in the hospital; a search ensued for 4 days; 

he was caught and brought to another hospital. He was placed on suicide watch; fired his public 

defender during an administrative hearing; and was completely and utterly delusional. Yet my 

wife and I were not allowed to testify at a med-panel hearing, because of HIPAA laws. He ended M 

~ 

'" Q., 
76 


82190.044

up spending 1 year in that State hospital- without proper treatment - because of privacy laws 

and the issues concerning involuntary medication. We were powerless to help. 

We have called emergency rooms to speak with a doctor - and been told - "we cannot 

acknowledge a person is here in the hospital". Sometimes a hospital tells us. Other times they 

do not. We sometimes 'get around' the situation by calling the phone in the patients' sitting 

area - as patients answer the phone and use itto make calls - and ask patients if ('name of our 

son') is there. 

Our son has been released numerous times without our knowledge. He has been placed in a bus 

from a hospital 2 hours away - and gone into Baltimore City - and we could not find him for 

days and days. He has been released and walked out with no money or adequate clothing. We 

have found him in our garage when we thought he was in the hospital. We have laid awake 

countless nights wondering if he was being treated properly; or if he had been released and had 

been beaten, killed or otherwise victimized. 

Often times neighbors or friends would tell us they saw our son - at varying places - when we 

thought he was being safely treated in the hospital 

Communities and people are affected by lack of proper treatment when we families cannot help their 

loved ones: stress and loss of jobs; damage to the brain of the loved one; damage to the loved one's 

heart or nervous system; homelessness; substance abuse; victimization; abuse; medical condition 

decline; isolation; fear; desperation; suicide. 

And these can, and are, the consequences of not allowing those who want to help their loved oneshelp their loved ones - because HIPAA says we cannot. 
77 


82190.045

EXHIBIT TO TESTIMONY OF EDWARD F. KELLEY III - APRIL 26,2013 

COMMITTEE ON ENERGY AND COMMERCE 

CONGRESS OF THE UNITED STATES 

HOUSE OF REPRESENTATIVES 

WE HAVE EXPERIENCED ALL OF THESE: 

A. Emergency Room Personnel often times prevents the patient's family from coming into the 

admitting area at the time their loved one is brought in. If the family member brought their 

loved one in, they can be denied going into the back area with their loved one. If their loved one 

came in to the hospital thru an emergency petition, the family member does not usually 

accompany their loved one. If the loved one came in to the emergency room without the 

family's knowledge, they have to start calling around when/if they suspect something has 

happened. 

B. If you know your loved one was taken to a particular emergency room - and you call to provide 

information you feel is helpful- medication, prior hospitalizations, diagnosis - often the person 

on the other end ofthe phone says "we cannot acknowledge that any person is or is not in this 

hospital. Our agreeing to take information could be construed as acknowledgement the person 

IS in the hospital." Or - they say they can receive your information, but the family has NO idea 

how or if it is being used; especially given the loved one may deny everything. 

C. No 'system' is available for providers (hospitals) to access the loved one's (patient's) m:iQr 

history of mental health hospitalizations - so 'experiment' can begin with each admission. 

D. When your loved one is in the emergency room - and the family is prevented from contributing 

information - several negative consequences can happen: 

1. Release without treatment. 

2. Provide inadequate treatment by administering medications that do not work or 

address the symptoms - especially if anger, anxiety, depression, hostility or psychosis 

are masked by the patient or exacerbated with substance use. 

3. Treatment with medications that have already proven to cause harm 

E. During an Administrative Hearing at the Hospital- assuming you are asked to participate: 

1. Hospital can elect to ignore family's input and, or prevent testifying 

2. Hospital can decide to release the person without understanding the situation more 

clearly - as they do not have adequate information 

3. Hospital can continue to require person to remain in the hospital- but shut out the 

family from helping them properly treat the patient. 

4. Patients can be kept in the hospital for longer periods of time - without any treatmentwhich is so cruel- because the hospital had inadequate information. 
78 


82190.046

PAGE 2 - EXHIBIT TO TESTIMONY OF EWARD F. KELLEY III 

F. Release of Loved One by the Hospital 

1. Hospital can determine to not inform family of the release of the person - if they 

determine the person is not a threat [which they already have (determined the patient 

is not a threat to self or others) if they plan to release the patient. 

2. Family's home is often the place where released person often goes first - and the family 

is not aware of their pending arrival; or may not even be there when their loved one 

arrives. 

3. If the patient goes somewhere else, after their release, they often are homeless and 

vulnerable to attack. 

4. The family can find themselves frantically trying to locate their loved one. 

G. Flaws in the HIPAA System Exist Anyway 

1. If the loved one files with the courts· for his/her release from a hospital in which they 

were involuntarily committed - that filing becomes public record [see at end of this 

ExhibitJ. 

2. Staff members of the Hospitals sometimes take a personal risk, and tell families 'off the 

record' what is going on - but that employee may have limited information - 50 the 

family gets part of the message. 

Example A - Hospital would not acknowledge our son was admitted. We found out because a friend of 

ours took a chance and called us privately. Hospital did not accept our offer to provide history, 

medication experience, diagnosis of illness - as our son specifica lIy advised them there was to be no 

contact with us. A few weeks later - that same person called us to say our son may be getting released 

soon - and that the staff there had a conversation debating whether or not to advise us to move to an 

undisclosed location - but decided they could not because of HIPAA laws. 

Example B - Our son was admitted involuntarily into a hospital- and the hospital refused to allow us to 

provide testimony and information regarding his prior history, including his hostility towards us. Our 

son escaped that hospital, and was eventually caught by the police [quite a dysfunctional situation -

hospital felt he was not a danger - so no medication - but once he escaped - four counties and 

Baltimore city searched together for him. [what was interesting is that the police called to ask if we 

knew where he was- but not the hospita!!!!! We were spending the night in D.c.] He was found after 4 

days by the police - and taken to a different hospital - and -despite being on SUicide 'watch' - he was 
79 


82190.047

deemed to not be a dangerto self or others. When his Med Panel hearing came up - we were not 

allowed to testify due to HIPAA. THEN - when I demanded that I felt we had a right to provide 

testimony - they asked me to remain in the waiting room so they could call the Maryland Attorney 

General's office for guidance. They came back 30 minutes later and advised me that due to HIPPA, my 

son could require I not be allowed to testify. When I called the Attorney General's office the next dayto ask why they had made that deCision, they advised me they had NOT spoken with the staff at Spring 

Grove. SO - Despite our son being in the hospital for a year - and - despite his condition - despite only 

in the last 4 weeks had they been medicating our son - they did NOT call us to advise us he had been 

released from the hospital. My wife called me while I was in Michigan - to advise me she had found him 

sleeping in our garage. 

Example C - Our son was 19 - and his hospital placement took him out to Washington County, MDhours away. We could not coordinate anything over the phone - due to HIPAA. Eventually he was 

released - and placed on a commercial bus and sent back to Baltimore City. It took us weeks to figure 

out if he was alive or dead - and his condition. 

Example D - When our son was being diagnosed for classification as being 'disabled', the psychiatrist 

asked our son if it would be OK if his parents attended their session,. Our son refused. When he went 

into the adjoining room - he told the doctor he had served in both Gulf wars and had shrapnel in his 

body - which was causing all sorts of problems. The interviewer believed him!!! 

So many times we would have no idea as to our son's condition at the hospital - as he wou Id refuse to 

see us - and often when we would go to visit - the staff would not acknowledge whether he was there 

or not - so we had no idea if he had been released or not. We would lie awake at night wondering 

where he was - what condition he was in - whether he had been released. 
80 


82190.048

PUBLIC RECORDS OF OUR SON - FOUND ONLINE AT THE MARYLAND JUDICIARY CASE SEARCH WEBSITE 

CASE # 1: 

case Information 

Court System: Circuit Court for Baltimore Coun 

Case Number: 03C06013732 

Title: 

Case Type: 

Case Status: Closed/Inactive 

Case Disposition: 

Name: Kelley, Jon Paul 

Address: Spring Grove Hospital 

City: CatonsvilieState:MDZip Code:21228 

(Each pef"nilantll1espondent is displayed below) 

Party Type: DefendantParty No.: 1 

Shows he is a patient at Spring Grove Hospital 

I 

! 

Business or Organization Name: Superintendent Spring Grove Hospital Center 

Address: Spring Grove Hospital 

CIty: CatonsvilieState:MDZip Code:21228 

Attorney(s) for the Defendant/Respondent 

Name: Malone, Esq, Daniel 

Appearance Date: 02/05/2007 

Practice Name: Office Of Attorney General 

Address: 300 West Preston Street 

Room 302 

Clty: BaltimoreState:MDZip Code:21201 

Document Tracking 

(Each Document listed. Documents are lis~ed in ooc~ment Np'.}St;'q4:ff.ncf.fNo. o~erJ 

Doc No.jSeq No.: 1/0 

File Date: 12/27/2006CI05e Date:Ol/05/2007Deci5ion: 
81 


82190.049

Party Type: Plaintiffparty NO.:1 

Document Name: Petition for Habeas Corpus 

Doc No./Seq No.: 1/1 

File Date: 01/26/2007C!ose Date:Decision: 

Party Type: DefendantParty No.: 1 

Document Name: Response To Petition 

Doc No./Seq No : 2/0 

File Date: 01/0S/2007Close Date:0l/OS/2007Decision:Denied 

Document Name: Order for Habeas Corpus 
82 


82190.050

CASE # 2 

Shows our son is a patient at Spring Grove Hospital Shows he was fighting to get out 

CO""~"" ~_~~._~ .... -"""_ I Case Number: 07013093 

Title: the Matter of Jon Paul Kelley 

Case Type: ministrative Agency AppealFiling Date:11/15/2007 

Case Status: 

Address: 

City: 

Doc No./Seq No.: 1/0 

File Date: 

Party Type: PetitionerParty NO.:l 

Document Name: Petition for Judicial Review/Release 

Doc No./Seq No.: 2/0 

File Date: 04/23/2009Close Date:04/23/2009Decision: 

Document Name: Notice of Cont. Dismissal Lack of Pros. 

82190.051

THE GAP IN TREATING THE SEVERELY MENTALLY ILL- APRIL 26. 2013 TESTIMONY OF EDWARD KELLEY 

THE SIGNS OF STRUGGLE APPEAR 

, I 

Anosoatlosin 

NorOEN/AL 

[--------------------- TREA1.MI'Nl.GAP· Jl:IE.PEBSON !l<.OTHER.S---------] • 

, - ' 

-

'i i 

FAMILY SHUT OUT FROM 

-DELAYS TREATMENT 

FAMILY SHUT OUT 

WHEN LOVED ONE 

GETS (IF) HOSPITALIZED 

SUBSTANCE USE 

TO SELF MEDICATE 

HOMELESSNESS 

UNKNOWN PLACES 

I?/ ................ : #1. 

FAMILY CANNOT VISIT OR NOT TREATED 

HELP WITH TREATMENT PLAN PROPERLY OR 

RELEASED TOO 

('." :: 

",. ",. 

ANGER/FRUSTRATION HE INCREASED ISOLATION FAMILY HAS NO 

"DOES NOT UNDERSTAND" "NO ONE UNDERSTANDS" 

OR INCARCERATION OR TRAG

BECOME A VICTIM 
84 

Mr. MURPHY. Thank you, Mr. Kelley. Ms. Thomas, you are recognized for 5 minutes. Thank you. 

TESTIMONY OF JAN THOMAS 

Ms. THOMAS. First of all, I would like to thank Congressman 

Braley for asking me to come to Washington to tell my story, and 

I would like to thank Chairman Murphy and Representative 

DeGette for holding this hearing today on this very important subject. My name is Jan Thomas, and the story I have to tell is a 

nightmare that could have prevented. My life has not been the 

same since this tragedy occurred, and it changed the lives of my 

entire family and my community. 

On June 24, 2009, what started out as a normal beautiful spring 

morning ended up being the beginning of a nightmare. Shortly before 8:00 am, a 24-year-old former student, Mark Becker, walked 

into our high school weight room, and in front of 22 young high 

school students emptied his gun at close range into my husband, 

Ed. Ed did not survive his injuries, and he died on the way to the 

hospital. He was only 58 years old, and he had taught and coached 

for 36 years. 

In one quick moment, so many lives were impacted forever. Our 

family lost a son, husband, father, grandfather, and brother whom 

we all loved very much. The students in the weight room that day, 

along with our extended community, lost a mentor, friend, teacher, 

and a coach. They lost their sense of confidence and security, and 

the horror of that day will be with them forever. 

Innocent youngsters, including our own young grandsons, suddenly realized that the world has a dark side. They were taught 

a horrible but truthful lesson that day. Bad things do happen to 

good people for no explainable reason, even when they think they 

are safe. 

Our grandsons were robbed of the deep love of their grandpa, 

and they will miss all of the experiences they could have had with 

him. My sons lost their father, whom they loved very much, and 

I lost my husband and my life partner on that day, and we miss 

him every day. 

But the real tragedy of that day is the fact that it could have 

been prevented. Only 4 days before Ed was murdered, this same 

young man rammed his car into the garage of an acquaintance and 

tried to break his way into the home with a baseball bat. When police arrived, he fled in his car, leading the law enforcement on a 

high-speed chase. When the police finally apprehended him, he was 

taken to an area hospital for psychological evaluation. 

Less than 24 hours before my husband died, Mark decided he 

didn’t want to stay at the hospital, and so not following the advice 

of his doctor, Mark was dismissed. 

No one knew. Law enforcement was not notified, even though 

they had requested that the hospital let them know when he was 

going to be dismissed. The hospital’s justification for not notifying 

the law enforcement prior to his release was that HIPAA prevented 

this disclosure. Even his parents did not know until Mark himself 

called them later that evening. 

No one knew that Mark had been released, but Mark’s privacy 

had been protected. During the investigation into the murder, it 

85 

was revealed to us that Mark had feelings of animosity and resentment toward Ed. We didn’t know that. If Mark had come to my 

home that morning and asked where Ed was, I would have innocently sent Ed’s killer directly to him and Ed to his grave, and 

what a horror to think that I may have had to live with that. 

Once again, Mark’s privacy was protected. Adults with severe 

mental illnesses are not always able to make good choices for themselves concerning their treatment or their actions. They may need 

help of a family member or other responsible parties to be sure 

they receive required treatment. They may need outsiders to keep 

them and others out of harm’s way, but due to HIPAA, even Mark’s 

parents were unable to get requested information or help make decisions for his treatment. 

So I would ask you. Is the privacy of one individual more sacred 

than a life? Is it more important than the welfare of our general 

public? Is it more important than allowing our law enforcement to 

know when a potentially dangerous offender is being released back 

into the very community that they risk their own lives every day 

to protect? 

Ed was an inspiration to so many in our community, and most 

importantly, he was a loving son, father, grandfather, and brother. 

I urge Congress to update this law so we can prevent further tragedies like this one. 

Thank you. 

[The prepared statement of Ms. Thomas follows:] 

86 


82190.052

Testimony 

Jan Thomas 

Committee on Energy and Commerce 

Subcommittee on Oversight and Investigations 

Friday, April 26, 2013 

I would like to thank Congressman Braley for asking me to come to Washington to tell 

my story. I'd also like to thank Chairman Murphy and Representative DeGette for 

holding this hearing today on a very important subject. My name is Jan Thomas and 

the story I have to tell is a nightmare that could have been prevented. My life has not 

been the same since this tragedy occurred. It also changed the lives of my entire family 

and my community. 

On June 24, 2009, what started out as a normal beautiful spring morning ended up 

being the beginning of a nightmare. Shortly before 8:00am, a 24 year old former 

student, Mark Becker, walked into our high school weight room, and in front of 22 high 

school students emptied his gun at close range into my husband, Ed. Ed did not 

survive his injuries and died on the way to the hospital. He was only 58 years old, and 

had taught and coached for 36 years. 

In one quick moment, so many lives were impacted forever. Our family lost a son, 

husband, father, grandfather, and brother, who we loved very much. The students in 

the weight room that day, along with our extended community, lost a mentor, friend, 

teacher, and a coach. They lost their sense of confidence and security. The horror of 

that day will be with them forever. 

Innocent youngsters, including our own young grandsons, suddenly realized that the 

world has a dark side. They were taught a horrible but truthful lesson that day. Bad 

things do happen to good people for no explainable reason, even when they think they 

are safe. 

Our grandsons were robbed of the deep love of their "grandpa". They will miss all of the 

experiences they could have had with him. My sons lost their father, whom they loved 

very much. I lost my husband and life partner on that day. We miss him every day. 

But the real tragedy of that day is the fact that it could have been prevented. Only four 

days before Ed was murdered, this same young man rammed his car into the garage of 

an acquaintance, and tried to break his way into the house with a baseball bat. When 

police arrived, he fled in his car leading law enforcement on a high speed chase. When 

the police apprehended him, he was then taken to an area hospital for psychological 

evaluation. 
87 


82190.053

Less than 24 hours before my husband died, Mark decided he didn't want to stay at the 

hospital. Not following the advice of his doctor, Mark was dismissed from the hospital. 

No one knew! Law enforcement was not notified, even though they had requested the 

hospital let them know when he was being dismissed. The hospital's justification for not 

notifying law enforcement prior to his release was that HIPAA prevented this disclosure. 

Even his parents didn't know until he called them later that evening. 

No one knew he had been released, but Mark's privacy had been protected. During the 

investigation into the murder, it was revealed that Mark had feelings of animosity and 

resentment toward Ed. We didn't know this information. If Mark had come to my home 

and asked where Ed was that morning, I would have innocently sent Ed's killer directly 

to him and Ed to his grave. What a horror to think I may have had to live with that. 

Once again, Mark Becker's privacy was protected. Adults with severe mental illnesses 

are not always able to make good choices for themselves concerning their treatment or 

their actions. They may need help of a family member or other responsible parties to be 

sure they receive required treatment. They may need outsiders to keep them and others 

out of harm's way. Due to HIPPA, even Mark's parents were unable to get requested 

information or help make decisions for his treatment. 

I ask you. Is the privacy of one individual more sacred than a life? Is it more important 

than the welfare of the general public? Is it more important than allowing our law 

enforcement to know when a potentially violent offender is being released back into the 

very communities they risk their own lives to protect? 

Ed was an inspiration to so many in our community. Most importantly, he was a loving 

son, husband, father, grandfather, and brother. I urge Congress to update this law so 

we can prevent further tragedies like this one. 
88 

Mr. MURPHY. Thank you, Ms. Thomas. Ms. McGraw will be recognized for 5 minutes. 

TESTIMONY OF DEVEN MCGRAW 

Ms. MCGRAW. Thank you very much. I really appreciate this opportunity, and I want to thank the Chairman and the subcommittee for focusing on these issues which are clearly very critical. I direct the Health Privacy Project at an organization called 

the Center for Democracy and Technology, which is a non-profit 

public interest and advocacy organization that works on behalf of 

consumers. 

We like to think of privacy as playing an incredibly important 

role in making sure that people who are suffering from stigmatizing conditions like mental illness will actually get into treatment. Many people express, one out of six in surveys consistently, 

that if they didn’t have some guarantees in confidentiality that 

they would not seek treatment, and that is the reason why we have 

privacy laws. They are not aimed at trying to create obstacles for 

people necessarily but to create the kind of treatment environment 

that people with stigmatizing conditions with want to be in. 

Having said that, they are not absolute. They have lots of exceptions, and the previous panel talked about them, some of the members of this panel have talked about them as well, that allow for 

the notification of persons in the event of a serious and imminent 

threat and also notification of family members except in cases 

where there has been an objection by a patient who has the right 

to object. So in this case it would be either an adult or an emancipated minor or in some States that allow minors to consent for 

treatment on their own and to be able to control their privacy 

rights. In that case the minor would hold the right. If that objection has not occurred or you are not dealing with someone who is 

incapacitated, HIPAA does provide for the ability for providers to 

share information with family members, with close friends, or with 

people that the patient designates. 

Having said that, I think it is abundantly clear from the testimony that we have heard today that HIPAA is badly mangled in 

terms of how people interpret it, and using it frequently as a shield 

not to disclose information or because they fear liability, which, 

frankly, is not anywhere in HIPAA, and it is—what is incredibly 

frustrating to me when I hear these stories, and I am sure it is 

frustrating for all of you, too, is that HIPAA doesn’t say you can’t 

disclose. So for people to blame this on HIPAA is just incredibly 

frustrating because, in fact, HIPAA does allow those disclosures in 

those cases, and where the disconnect is happening is just incredibly frustrating to me. Again, I am a privacy advocate, but I believe 

in the reasons for these exceptions. We try to take a very balanced 

approach to these issues and understand the reason why those exceptions exist, and yet for whatever reason the myth that you can’t 

disclose to family members, and, again, this is—the disclosure to 

family members are not bound by the potential for a serious and 

imminent threat. 

It is the case, though, that if an individual objects, again, if they 

have the competency and the power to object, then that would be 

the case where you couldn’t disclose. But I would say more often 

89 

than not there is, again, experiences of the folks at this table notwithstanding, people actually want their family involved in their 

care. I have had people say to me, my mother, my elderly mother, 

who I am caring for, I would like to be able to have her doctor talk 

to me about her treatment and yet that office is telling me that 

HIPAA will not allow it to happen. And that is so untrue and so 

I am incredibly sympathetic to the frustration of people who are 

told that HIPAA requires something that it doesn’t, and I am trying to figure out what we can do better in terms of educating folks 

about what HIPAA does and what it doesn’t do because it sounds 

to me like too many people are hiding behind it in circumstances 

where there are clear exceptions that would allow for that information to be shared. 

Some of the testimony of Director Rodriguez in the first panel, 

frankly there was a lot more—I had a lot greater understanding of 

the exception for family members than I did before the hearing, 

and so that suggests to me that this guidance, which I think is 

good, it is not the letter that everyone has been talking about because the letter deals with serious and imminent threat. This is 

guidance about what can be shared with family members because 

often patients, in fact, want their information to be shared with 

one or more of their family members or a close friend who is helping to care for them, and yet it doesn’t happen. 

And it could be made more clear, frankly, and we could find better ways of disseminating this guidance. I mean, I know where it 

is on the Web site, but there is probably lots of folks who can’t find 

it, who aren’t aware that it exists, and particularly when faced 

with a person and a healthcare facility telling them, which is probably something that they unfortunately believe, that HIPAA won’t 

allow that information to be shared, when, in fact, it does. 

I am happy to answer any questions, and I appreciate the opportunity. 

[The prepared statement of Ms. McGraw follows:] 

90 


82190.054

1634 1 Street NW 

Swtt' 1100 

Wasbng!an, DC 20006 

Statement of Deven McGraw 

Director, Health Privacy Project 

Center for Democracy & Technology 

Before the U.S. House Committee on Energy & Commerce 

Subcommittee on Oversight & Investigations 

Does HIPAA Help or HInder patient [are and Public saleI}'? 

April 26, 20t3 

Chairman Murphy and Members of the Subcommittee: 

On behalf of the Center for Democracy & Technology (COT), I thank you 

for the opportunity to testify today. 

The Center for Democracy and Technology ("COr) is a non-profit Internet 

and technology advocacy organization that promotes public policies that 

preserve privacy and enhance civil liberties in the digital age. As 

information technology is increasingly used to support the exchange of 

medical records and other health information, COT, through its Health 

Privacy Project, champions comprehensive privacy and security policies to 

protect health data. COT promotes its positions through public policy 

advocacy, public education, and litigation, as well as through the 

development of industry best practices and technology standards. 

Recognizing that a networked health care system can lead to improved 

health care quality, reduced costs, and empowered consumers, COT is 

using its experience to shape balanced, workable privacy solutions for a 

health care system characterized by electronic health information 

exchange. 

The question posed at this hearing is whether the privacy regulations 

under the Health Insurance Portability and Accountability Act of 1996 

(HIPAA) help or hinder patient care and public safety. The short answer is 

that HIPAA's provisions by design enable the sharing of health 

information, including mental health information, for both patient care and 

public health and safety. However, frequently these provisions are not 

fully understood and are too often misinterpreted, which may have a 

detrimental impact on both policy goals. 
91 


82190.055

Privacy Is FUDdamenlallo Good Realm tare 

Americans consistently express concerns about the privacy of their health information. 

Researchers have focused on this issue more intensively in the last several years in 

response to initiatives aimed at increasing adoption of electronic health records. In a 

2006 survey, when Americans were asked about the benefits of and concerns about 

electronic health records: 

• 80% said they are very concerned about identity theft or fraud; 

• 77% reported being very concerned about their medical information being 

used for marketing purposes; 

56% were concerned about employers having access to their health 

information; and 

• 55% were concerned about insurers gaining access to this information.' 

Privacy rules are frequently criticized as providing obstacles to effective care, but in fact 

the opposite is true: patients who mistrust whether their information will be handled 

confidentially will not fully participate in their own health care. 2 Without appropriate 

protections for privacy and security in the healthcare system, people will engage in 

"privacy-protective" behaviors to avoid having their personal health information used 

inappropriately.' Such privacy-protective behaviors include failing to seek care for 

sensitive medical conditions, asking health care providers to leave sensitive information 

out of the medical record, and traveling outside of the area to seek care. 4 According to 

a 2007 poll, one in six adults (17%) - representing 38 million persons - say they 

withhold information from their health providers due to worries about how the medical 

data might be disclosed.' A September 2011 study by the New London Consulting 

commissioned by FairWarning®, a vendor of breach detection software, found that: 

1 Study by Lake Research Partners and American Viewpoint, conducted by the Markle Foundation 

(November 2006). In a more recent survey conducted by the Markle Foundation, more than 80% of both 

the public and doctors surveyed said that requiring protections and safeguards for patient privacy was 

important. http://www.markle .org/publications/1443-public-and-doctors-agree-importance-specific-privacyprotections-health-it (January 2011) 

, See Janlori Goldman, "Protecting Privacy to Improve Health Care," Health Affairs (Nov-Dec, 1998) 

(Protecting Privacy); Promoting Health/Protecting Privacy: A Primer, California Healthcare Foundation 

and Consumers Union (January 1999), http://www.chcf.org/topics/view.cfm?itemID=12S02 (Promoting 

Health/Protecting Privacy). 

3 1d. 

'Id. 

S Harris Interactive Poll #27, March 2007. Persons who report that they are in fair or poor health and racial 

and ethnic minorities report even higher levels of concern about the privacy of their personal medical 

records and are more likely than average to practice privacy-protective behaviors. National Consumer 

Health Privacy Survey 200S, California HealthCare Foundation (November 200S). 
92 


82190.056

• 27.1 % of respondents stated they would withhold information from their care 

provider based on privacy concerns. 

• 27.6% said they would postpone seeking care for a sensitive medical condition 

due to privacy concerns. 

• Greater than 1 out of 2 persons said they would seek care outside of their 

community due to privacy concerns, and 35% said they would drive more than 50 

miles to seek care6 

The consequences of this climate of fear are significant - for the individual, for the 

medical community, and for public health and safety: 

• The quality of care these patients receive may suffer; 

• Their health care providers' ability to diagnose and treat them accurately may be 

impaired; 

• The cost of care escalates as conditions are treated at a more advanced stage 

and in some cases may spread to or impact others; and 

• Research, public health, and quality initiatives may be undermined, as the data in 

patient medical records is incomplete or inaccurate. 7 

Assurances of confidentiality are particularly important for mental health treatment. It is 

estimated that one in four adults in America suffers from a diagnosable mental disorder 

in a given year; 8 nearly 2/3 do not seek treatment due in part to lack of knowledge, fear 

of disclosure, potential rejection of friends, and discrimination.9 Laws protecting mental 

health information are designed to help address these fears and remove potential 

barriers to treatment. 

Protections and permissions lor Ilsln!! amI! or Dlsclosin!! Health inlormatlon 

The HIPAA Privacy Rule sets parameters for the use and disclosure of identifiable 

health information by health care providers, health plans, and health care 

clearinghouses, and the contractors (or business aSSOCiates) who obtain identifiable 

health information in order to perform services on their behalf. The Privacy Rule takes a 

decidedly balanced approach to privacy, giving individuals the right to control certain 

6 htlp:ilwww.fairwarningaudil.comldocumentsI2011-WHITEPAPER-US-PA TI ENT -SURVEY. pdf 

7 Protecting Privacy, supra note 2. 

8 NIMH _ The Numbers Count: Mental Disorders in America, 

htlp:ilwww.nimh.nih.govlhealthlpublicationslthe-numbers-count-mental-disorders-in-americanndex.shtml. 

9 "Facts about Stigma and Mental Illness in Diverse Communities: National Alliance on Mental Illness, 

http://www.nami.orgIContentiMicrosites270INAMI Howard CountylHome2581Muiticuiturai Action11Stigm 

aandMentallllnessinDiverseCommunilies.pdf. 
93 


82190.057

uses and disclosures while also expressly allowing uses and disclosures to meet routine 

health care needs and public policy goals. In general, the Privacy Rule requires the 

express authorization of the patient before identifiable health information can be 

accessed, used or shared, but the Rule includes a number of exceptions designed to 

facilitate access and sharing of health information for patient care, to facilitate payment 

for care, for public health, and for other uses deemed critical to a functioning health care 

system. Of particular importance to this hearing, the Privacy Rule allows a patient's 

health information to be shared to facilitate treatment, without the need to obtain either 

an oral consent or formal written authorization from the patient. 

The Privacy Rule treats all identifiable health information the same, with one notable 

exception: psychotherapy notes are provided with additional protections. Not all mental 

health information about a patient qualifies as "psychotherapy notes;" that term is limited 

to the notes of a mental health professional taken during a counseling or therapy 

session. 1o Entities covered by the Privacy Rule must obtain a specific, formal 

authorization from the patient in order to disclose psychotherapy notes in most 

circumstances (such notes can be used internally to treat the patient).11 In addition, the 

right of patients to access and obtain a copy of their health information does not apply to 

psychotherapy notes.12 

The Privacy Rule also includes a number of provisions that expressly allow certain uses 

and disclosures of health information for important public policy reasons. These 

exceptions allow entities covered by HIPAA to use or disclose information: when 

required to by law; for public health activities; for the reporting of abuse; for health care 

oversight; for judicial and administrative proceedings; for law enforcement; and to 

coroners, to note just a few examples. 13 

'0 Psychotherapy notes are "notes recorded (in any medium) by a health care provider who is a mental 

health professional documenting or analyzing the contents of conversation during a private counseling 

session or a group, joint or family counseling session and that are separated from the rest of the 

individual's medical record. The term 'psychotherapy notes' excludes data relating to medication 

prescription and monitoring, counseling session starts and stop times, the modalities and frequencies of 

treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, 

functional status, the treatment plan, symptoms, prognosis, and progress to date." 45 C.F.R. 164.50L 

11 45 C.F.R 164.508(a)(2). Such notes may be used by the originator in order to treat the patient; they 

also can be used for training purposes and to defend against a legal action or other proceeding. Id. Of 

note, the U.S. Supreme Court, in a case recognizing psychotherapist-patient privilege in federal rules of 

evidence, acknowiedged the critical role that confidentiality of psychotherapy notes plays in mental health 

treatment: "Effective psychotherapy ... depends upon an atmosphere of confidence and trust in which 

the patient is willing to make a frank and complete disclosure of facts, emotions, memories, and fears. 

Because of the sensitive nature of the problems for which individuals consult psychotherapists, disclosure 

of confidential communications made during counseling sessions may cause embarrassment or disgrace. 

For this reason the mere possibility of disclosure may impede development of the confidential relationship 

necessary for successful treatment." Jaffree v. Redmond, 518 U.S. 1 (1996). 

"45 C.F.R. 164.524(a)(I)(i). 

13 See proviSions of45 C.F.R. 164.512. 

{~'cftWWW'Cdt.org .~ 4 
94 


82190.058

Of specific interest for this hearing, entities covered by HIPM are expressly permitted 

to use or disclose information to avert a serious threat to health or safety. Specifically, 

an entity may, 

"consistent with applicable law and standards of ethical conduct, use or 

disclose protected health information if [it), in good faith, believes the use 

or disclosure is necessary to prevent or lessen a serious and imminent 

threat to the health or safety of a person or the public; and [the use or 

disclosure] is to a person or persons reasonably able to prevent or lessen 

the threat, including the target of the threat.,,'4 

Entities are expressly presumed to be acting in good faith if they are acting based on 

actual knowledge "or in reliance on a credible representation by a person with apparent 

knowledge or authority."'5 On January 15, 2013, the HHS Office for Civil Rights issued 

a two-page, to-the-point letter to health care providers alerting them to this exception, in 

the hope of dispelling widespread myths that HIPM does not permit such disclosures.'s 

The HIPM Privacy Rule provides a floor of privacy protections, at least for health data 

collected, used and shared by entities covered by its provisions. However, it is not the 

only law protecting mental health data. States are permitted to enact more stringent 

protections for health privacy, and nearly all states have specific statutes related to 

mental health privacy.'? In addition, Congress has expressly acted to protect the 

privacy of health information in other sensitive records, and these laws were not 

preempted by HIPM. In recognition of the potential stigma and the legal implications of 

seeking alcohol and drug treatment, Congress enacted the Federal Confidentiality of 

Alcohol and Drug Abuse Patient Records law, which provides heightened protections for 

alcohol and drug use treatment records maintained by any programs receiving some 

form of federal assistance.'8 The Family and Educational Rights and Privacy Act of 

1974 (FERPA) protects the privacy of student education records, including information 

related to treatment of a student for substance use or mental health conditions.,9 Most 

state laws restricting disclosures of health information typically include emergency 

exceptions;2o however, we are not aware of any comprehensive compilations of state 

14 45 C.F. R. 512{j). This provision also includes the circumstances under which law enforcement can be 

alerted when an individual has admitted committing a violent crime or is believed to have escaped from a 

correctional institution or from lawful custody. 45 C.F.R. 5120)(1)(ii). 

15 45 C.F.R. 5120)(4). 

" http://www.hhs.govlocrlprivacylhipaalunderstandinglconsumerslrighttoaccessmemo.pdf. 

17 Beckerman, J et aI., "Health Information Privacy, Patient Safety, and Heatth Care Quality: Issues and 

challenges in the Context of Treatment for Mental Health and Substance Abuse," BNA's Health Care 

Policy Report, vol. 16, No.2 (January 14, 2008). This article includes a comprehensive discussion of 

HIPAA's provisions regarding "preemption." 

1· ld. See 42 C.F.R. Part 2 for the regulations that set forth the stringent rules regarding use and 

disclosure of patient information. 

19 1d. See 34 C.F.R. Part 9 for regulations. 

20 1d. 
95 


82190.059

mental health laws (such state law surveys are typically expensive to produce and 

rapidly rendered out of date) that would enable us to discuss state law provisions in 

more detail. FERPA includes an exemption allowing disclosure of student information in 

emergencies, when the information is necessary to protect the health or safety of the 

student or others.21 Regulations governing federally assisted alcohol and drug treatment 

programs have more limited exceptions for emergencies. 22 

DUllY to Share Health IDi0rmation with Family, friends under B1PAA 

When HIPAA's Privacy Rule first went into effect a decade ago, people widely believed 

that it did not permit disclosure of a patient's health information to family members 

under any circumstances. That has never been the case, but this myth stubbornly 

persists. The Privacy Rule expressly permits disclosure.to someone who is involved in 

a patient's care or in payment for that care -- either a family member, other relative, or a 

close personal friend of the patient, or any other person identified by the patient --

unless the patient objects to the sharing of that information.23 The information that may 

be shared is only information that the person involved in the patient's care (or in paying 

for that care) needs to know (so past diagnoses not related to the patient's current 

health condition, for example, could not be shared under these provisions). If the 

patient is not conscious (or not present), a provider can still share relevant health 

information with family or friends if he or she believes it is in the patient's best interest to 

do so. 

The HHS Office for Civil Rights has issued guidance on these proviSions, which 

explains them more clearly and in non-legallanguage;24 however, it is unclear how 

many providers, individuals, and family members are aware of this guidance. This 

guidance also may not be in sufficient detail to address common questions and clear 

misperceptions. 

HIPAA requires that a patient's "personal representative" be treated as the patient for 

purposes of the Privacy Rule. 25 Persons who, under applicable law, have authority to 

act on behalf of a patient for health care decision purposes must be treated as personal 

representatives. For minors, this typically is a parent, guardian or other person acting in 

loco parentis; however, where state law permits the minor to seek care without the 

21 Id. See 20 U.S.C. 1232g. 

22 42 C.F.R. Part 2 permits disclosure of information without consent to enable notification of medical 

personnel in the event of a medical emergency (in a situation that poses an immediate threat to the health 

of any individual); to enable notification of law enforcement if an immediate threat to health or safety of an 

individual exists due to a crime on program premises or against program personnel; and to enable 

reporting under state law of suspected child abuse or neglect. Information can be disclosed to law 

enforcement about an immediate threat to the health or safety of an individual not involving a crime on 

program premises or against program personnel if patient-identifying information is not disclosed. 

http://www.samhsa.gov/aboutilaws/SAMHSA 42CFRPART2FAQil Revised.pdf. 

23 45 C.F.R. 510(b). 

24 http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/provider flg.pdf. 

25 45 C.F.R. 164.502(g). 
96 


82190.060

consent of a parent, which in !;lome states may be the case for mental health treatment, 

the minor has greater authority to designate when a parent or guardian can receive 

health information. State laws typically establish the circumstances under which an 

individual may act as the personal representative of another with respect to health care 

decisions. 

paths Forward 

As noted above, the HIPAA Privacy Rule permits the sharing of relevant mental health 

and other personal health information in order to avert a serious threat to health or 

safety, and to family members and friends who are involved in a patient's care, with 

some exceptions. It is important to keep in mind, however, that the Privacy Rule 

permits but does not require information to be shared in these circumstances. (The 

Privacy Rule only expressly requires information to be shared in two instances: (1) with 

the patient or his or her personal representative, or (2) with the government in the event 

of a HIPAA compliance audit.) 

Fear of liability for violating HIPAA's provisions, coupled with misunderstanding of its 

provisions, can be a recipe for not sharing, even in circumstances where such sharing is 

expressly permitted and arguably important for patient care and/or publiC safety. 

Additional guidance from the Office for Civil Rights, with even greater clarity on 

permitted uses and disclosures, could be enormously helpful at dispelling myths and 

easing the concems of mental health professionals. Working with relevant professional 

societies to ensure that this guidance is widely disseminated (and written in terminology 

likely to be understood) would also be helpful. The Administration should also take 

steps to ensure such guidance can be issued in a timely way. 

States should also examine their statutes covering mental health information to ensure 

that they meet the needs of patients both for confidentiality and to have the wanted 

support of family and close friends in their care, and urgent public safety needs. 

(oncluslon 

Thank you for the opportunity to present this testimony, and I would be pleased to 

answer any questions you may have. 
97 

Mr. MURPHY. Thank you very much. We thank all the panelists. 

I want to also say here that our hearts go out to the families, Mr. 

Wolfe, Mr. Kelley, and Ms. Thomas. It is a sad tragedy and Mr. 

Kelley, that you are still dealing with here. 

We are going to recognize each person for 5 minutes. 

I just want to make it clear, Ms. Levine, you stated you had 

some opinions in your testimony. You are not a licensed provider, 

am I correct? 

Ms. LEVINE. No, no. We are—— 

Mr. MURPHY. And you are not a practicing therapist in this field? 

Ms. LEVINE. Not at all. 

Mr. MURPHY. OK. It is just very important for the record because 

on page ten of your written testimony you said that doctors don’t 

want to share information, and it is, ‘‘a convenient excuse not to 

talk to families or listen to what they know about a patient.’’ You 

went on to say it is, ‘‘easier to avoid difficult conversations about 

prognosis and treatment options.’’ 

Dr. Martini, is that true that doctors don’t want to know this, 

they don’t want to know this information, they don’t want to talk 

to families because it is difficult? 

Dr. MARTINI. No. I think that the vast majority of physicians 

that I work with are very interested in sharing that information 

and very much want, I think, to involve families in care. I mean, 

I think we know that particularly for psychiatric patients that their 

prognosis is approved, that, one of the ways I look at it is I see a 

patient perhaps at the very most an hour a week, and the families 

are dealing with these individuals on an ongoing basis, and I think 

any recommendation that I make as a clinician is much more likely 

to be successful if I am able to get the support of the family. 

Mr. MURPHY. Mr. Wolfe, Ms. Thomas, and Mr. Kelley, just real 

briefly, just in a word or two because I don’t have a lot of time, 

also from your standpoint because you have also talked to providers about these cases, do you think in these cases the providers 

did not want to talk to you, or they did, but they felt they could 

not because of their interpretation of the law? 

Mr. Wolfe? 

Mr. WOLFE. Yes. My family physician told me later that he did 

want to disclose it, but he felt that he was under the obligation of 

the HIPAA rules not to disclose it. 

Mr. MURPHY. Mr. Kelley? 

Mr. KELLEY. In 14 years I have never encountered a situation 

where a treatment provider did not want to disclose it. In fact, they 

went out on a limb and would secretly tell us. No, I have never had 

that. 

Mr. MURPHY. Ms. Thomas? 

Ms. THOMAS. I can only speak for what law enforcement told me 

and also what Mark’s parents have told me about, and they all had 

difficulty getting information. 

Mr. MURPHY. Thank you. Mr. Wolfe, Mr. Kelley, you heard from 

Mr. Rodriguez from the Office for Civil Rights that the law, it 

sounds like he is saying that the law is adequate, and the problem 

is that providers aren’t really aware of the law and are 

unjustifiably worried about lawsuits, perhaps even hospital adminVerDate Nov 24 2008 14:42 Nov 07, 2013 Jkt 037690 PO 00000 Frm 00103 Fmt 6633 Sfmt 6633 F:\MY DOCS\HEARINGS 113\113-37 CHRIS
98 

istrators who pressure staff not to disclose information or they will 

be fired. 

Do you think that is true that it is adequate, both the way the 

law is worded and in terms of the way information gets out to providers? 

Mr. Wolfe? 

Mr. WOLFE. I don’t think it is adequate as far as getting out to 

the providers because both in my son’s case with the rehab situation, as well as my family care physician, both of them after Justin 

deceased, I confronted them, and they both told me that they definitely would have said something with regard to informing me. 

However, again, with Justin signing the HIPAA disclosure, they 

were not permitted to. So I do feel that they did have an obligation. 

They knew that it was a life-threatening situation with the use of 

heroin, but they were obliged to follow the HIPAA regulations. 

Mr. MURPHY. Thank you. Mr. Kelley? 

Mr. KELLEY. In all due respect I fear there is a significant detachment from reality here. Not with you, sir, but with Mr. 

Rodriguez. It is underlined, unless the patient objects, and someone 

that is severely mentally ill universally wants to object. They don’t 

believe they are ill. 

So that gets thrown out the window, and the fact is that we need 

to have exceptions for the severely mentally ill. It is just plain and 

simple. 

Mr. MURPHY. Ms. Thomas? 

Ms. THOMAS. I can speak on behalf of the fact that I am a volunteer EMT for our community, and the threat of lawsuit, it prevents 

us even from feeling like we are able to tell direct family members 

conditions of patients that we transport. So either it is misunderstanding but that is what is emphasized to us in our training. 

Mr. MURPHY. Thank you. Ms. McGraw, in your written statement you said that 17 percent, or about 38 million, say they would 

withhold information from healthcare providers due to worries 

about how medical information may be disclosed. You were citing 

a study. 

Ms. MCGRAW. Yes. 

Mr. MURPHY. My understanding is that study was on general 

health issues, not mental health or severe mental illness. Am I correct? 

Ms. MCGRAW. No. That is right. In the time that I had to prepare for this testimony I looked for some more specific statistics on 

persons being held back from seeking treatment for mental health, 

and I didn’t have—— 

Mr. MURPHY. Sure. 

Ms. MCGRAW [continuing]. Enough time to find something directly on point. I did find something on the National Alliance on 

Mental Illness Web site that talked about how two-thirds of the 

people with mental illness do not seek treatment for a number of 

reasons; the lack of knowledge, fear of disclosure—— 

Mr. MURPHY. Yes. I appreciate that, and I hope if you find some 

other studies, could you—— 

Ms. MCGRAW. Yes. I would be happy to keep looking. 

Mr. MURPHY. I might also say that—— 

Ms. MCGRAW. I just ran out of time. 

99 

Mr. MURPHY [continuing]. We have folks here also saying that 

doctors didn’t disclose information, and people are over-interpreting 

the law, not disclosing it here, and you are saying that perhaps patients are also over-interpreting that it would be disclosed. 

Let me ask you this. Could you—something very important. You 

said it is badly mangled. I think those were your words. What 

could be done to clarify the law? Do we need legislative language, 

do we need to cite case law, do we need some clarification from the 

Office for Civil Rights, more public education? What do we need 

here? 

Ms. MCGRAW. The badly mangled part is—was the reference to 

the fact that we had all this testimony about what is really in 

HIPAA and yet people are being told, in fact, that HIPAA is something that it is not and with significant consequences. 

You know, more guidance and better ways of disseminating it so 

it is not, you don’t have to look really hard for it on a Web site absolutely is the first step that we should be pursuing here, and 

ideally that could be done in conjunction with the professional societies who have more effective mechanisms for doing outreach to 

their members. You know, having read this guidance, I am like, 

well, it is clear, but it could be made more clear, more examples. 

In this circumstance you can do X. In this circumstance, you can 

do Y. 

Mr. MURPHY. Thank you. We will look forward to getting your 

specific recommendations. 

Mr. Braley, 5 minutes. 

Mr. BRALEY. Thank you, and I should also note, Mr. Chairman, 

that Ed Thomas’s sister, Connie Flaharty, is also in the audience 

today. This has impacted her as well, and Jan, I think some of the 

things that your testimony brought out is there is this 

misperception that the issues we have been talking about today are 

unique to large urban areas with a higher concentration of people 

who are seeking treatments for severe mental illness. Parkersburg 

is a town of 2,000 people. Five years ago this May it was nearly 

destroyed by an F5 tornado, and your husband, Ed, was one of 

those people in the town who rallied people to come back, put the 

community back together, and one of the other things that I think 

is so important about your story is that Mark Becker is someone 

you and Ed knew very well. 

Ms. THOMAS. Exactly. Yes. He was a member of our community. 

We have known him his entire life and his parents, and I know 

their frustration in getting him treatment, but there again, I agree 

with what they are saying. When it comes to severely mentally-ill 

people, you can’t classify them with someone that has cancer or 

hepatitis or those kinds of things because their thinking is just not 

rational, and I think there maybe needs to be some exceptions to 

those rules there. 

Mr. BRALEY. Well, and one of the other things that we know is 

that from the stories that have come out, you and Ed went to the 

same church as Mark Becker’s parents. So it wasn’t like this was 

a stranger in your family, and I know that the Becker family has 

expressed some of the exact same frustrations as parents that we 

have heard from the other panelists in trying to get Mark the help 

he needed so that he could put his life back together, and I think 

100 

that is one of the most disturbing things about this topic is these 

are stories we hear over and over and over again, and it points to 

a breakdown in our ability to get people who need it the services 

that they need in communities all over this country. 

But one of the things that I am really interested in is how this 

particular tragedy in your life has changed how people in your community think about the problems we have been talking about. 

Ms. THOMAS. Well, it is hard to speak for other people, but I do 

think there needs to be more awareness of mental health. I think 

this needs to be expanded on quite a bit. I don’t think there is 

enough resources out there for people. I think the fact that no one 

knew that Mark was released and a threat was very frustrating to 

people. I mean, there were a lot of victims involved. It wasn’t just 

our family. Those young kids were 14 and 15 years old that witnessed their coach getting shot down at close range in cold blood, 

and it all could have been prevented, and I think that is a big frustration for a lot of people. They are just—he was not able to get 

out of harm’s way, and he was loose on the streets just because he 

wanted to be. 

Mr. BRALEY. Well, I think one of the other things this points to 

is I lived with somebody with a severe mental illness 40 years ago, 

and I remember the stigma attached to mental illness then, and I 

think we would like to think that we have come a long ways as a 

society in dealing with mental illness—— 

Ms. THOMAS. Yes. 

Mr. BRALEY [continuing]. As something that is just as real and 

impacts people’s lives as much as other diseases, but I think the 

reality is that there is still a lot of stigma attached to it. We like 

to avoid having these conversations unless it is impacting us personally. So I want to thank all the panelists for having the courage 

to come share your stories. I know that it has been an incredible 

challenge for all of you. 

And one of the things that I talked about earlier is this challenge 

that family members have with adult children of being able to have 

a role in making decisions about their care when there are sometimes obstacles, and Dr. Martini, you talked about this a little bit, 

and one of the questions I had raised earlier was whether this risk 

to self or others standard is still a viable way of getting patients 

the help they need for a truly effective treatment. You gave examples of both sides of the story; one where a family’s intervention 

was counterproductive, one where the need for family intervention 

was not provided that could have been in the best interest of the 

patient. 

So how do we resolve this? 

Dr. MARTINI. Well, I think, Congressman, what I would like to 

do is think about what you last referred to, what is in the best interest of the patient, what do we think is going to help the patient 

most, help them in their recovery. I understand that there are 

issues around the release of information and confidentiality, and I 

understand that patients are sensitive about that, but what we are 

talking about is not a release of information generally out to the 

community. What we are talking about is thinking about particular 

cases, looking at those cases on a more individual basis, and deciding if this patient is going to do well, what is going to be necessary, 

101 

what kind of information needs to be shared, should that information be shared with family members, are they an asset in this particular case, and can they help out this individual? Would it be a 

good idea to share the information with the primary care physician 

in their community who quite often coordinates care in a variety 

of ways. That is also an asset that quite often is not part of the 

process in some ways because the patients are reluctant to have 

any local connection know much about what is going on with them. 

Mr. BRALEY. Thank you. 

Dr. MARTINI. So it is what is in the interest of the patient. 

Mr. MURPHY. Thank you. Mr. Braley, that article you referenced 

before from Sports Illustrated, would you submit that for the binder so it is in the record as well? 

Mr. BRALEY. I would be happy to. 

Mr. MURPHY. That has got to be tragic for all the reasons someone would be on the cover of Sports Illustrated, that has got to be 

the saddest. It is. Thank you. 

Now recognize for 5 minutes the gentleman from Virginia, Mr. 

Griffith. 

Mr. GRIFFITH. Mr. Chairman, if I could pass at this time, I would 

appreciate that. 

Mr. MURPHY. We will do that. We will go to Mr. Johnson for 5 

minutes. 

Mr. JOHNSON. Thank you, Mr. Chairman. First of all, panel 

members, I would like to reiterate thank you so much for being 

with us today and for your testimony. I know these are very tough 

testimonies to give, and our hearts go out to you. 

Ms. Levine, you suggest that healthcare workers sometimes use 

HIPAA as an excuse not to share information and not simply because they are afraid of fines or sensors. Why else would someone 

withhold information from inquiring family members? 

Ms. LEVINE. Well, because the role of a family member in the 

care of someone who is, as I said, my, most of my experience is 

with older adults, although I personally was the family caregiver 

for my late husband for 17 years. He had a traumatic brain injury 

and was quadriplegic. So I have my own experiences with this system. 

But family members ask hard questions. They want to know a 

lot of information about why did this happen, what can I expect, 

why are you giving this medication when it is on the list that says 

this is contraindicated. I can’t tell you, and this is not to disparage 

the nursing profession because they are fabulous, but I have had 

so many nurses say to me, are you trying to tell me how to do my 

job? OK. Yes. I think I am because my husband should not have 

this medication and that medication together. 

So there is a kind of—I can’t tell you how many physicians, 

nurses have said to me, family members, they are pests, they are 

nuisances, and they are. I mean, I am not denying that because 

they ask the hard questions. The patient in the bed is in pain or 

is sedated, not going to be a trouble. 

Mr. JOHNSON. OK. 

Ms. LEVINE. So it is, I think it is a truth universally acknowledged that family members are important on the day of discharge, 

102 

take—get them home but not necessarily in the course of a hospitalization. 

But I really think that the HIPAA scare, and I am now concerned that there is now going to be a high tech scare because I 

am already getting emails from vendors saying, we are going to 

protect you from these horrible audits that are going to happen, 

and if you only you hire us, you know, you will be safe. 

Mr. JOHNSON. Oh, yes. Every time there is a new government 

regulation an industry crops up—— 

Ms. LEVINE. Yes. 

Mr. JOHNSON [continuing]. Around, providing services. 

Ms. LEVINE. And, so, I mean, it is not one thing. It that things 

support each other—— 

Mr. JOHNSON. OK. 

Ms. LEVINE [continuing]. Is my feeling. 

Mr. JOHNSON. Let me quickly go to several other questions. 

One of your recommendations has been for OCR to reinforce to 

healthcare providers the provision in HIPAA that permits disclosure of relevant information, protected health information to family 

caregivers or others who are going to be responsible for providing, 

managing, or paying for a patient’s care. How do you suggest OCR 

go about doing this? 

Ms. LEVINE. Well, I think throughout—and I agree that the Web 

site is one way but not the best way. I think that there can be involving the medical professions, involving the people, the risk managers who are doing a lot of the training, involving the leaders and 

saying, this is not good patient care. We are concerned about hospital readmissions. One of the reasons people come back to the hospital in 30 days and cost Medicare tons of money is that the family 

members who are responsible for that care don’t know what to do. 

Mr. JOHNSON. OK. 

Ms. LEVINE. So they bring them back. 

Mr. JOHNSON. Do you have recommendations for CMS as well? 

Ms. LEVINE. Yes. CMS should definitely encourage as part of the 

conditions of participation in Medicare and Medicaid to make sure 

that the training that they are responsible, accountable for training 

the hospitals and nursing homes to train their staff in a balanced 

way, and one more thing which I didn’t get a chance to say. 

Mr. JOHNSON. Quickly. I am running out of time but go ahead. 

Ms. LEVINE. Just quickly. When we encounter through our contacts with providers, patients who object to having a family member involved, it has nothing to do with privacy. It has to do with 

I don’t want my—I don’t want to worry my daughter, I don’t want 

her to—— 

Mr. JOHNSON. OK. 

Ms. LEVINE [continuing]. Have any responsibilities. It is not the 

privacy. 

Mr. JOHNSON. Got you. OK. Mr. Kelley, you have observed that 

a clear culture of fear pervaded one of the facilities your son was 

admitted to. How does this culture of fear impact decision making 

by those healthcare workers and facilities tasked with taking care 

of your son? 

Mr. KELLEY. And it is more than one hospital, sir, but essentially 

we are not in a position to prevent horrific things from happening, 

103 

and we have had some candid discussions with staff and doctors in 

multiple hospitals, where they all acknowledge that, they use the 

word, our hands are tied, due to the HIPAA privacy rules. And so 

we try to go further and emphasize the inability of the patient to 

take care of themselves and make good decisions, and it doesn’t 

phase them. 

So what happens is the patient gets mistreated actually, and so 

our son has come home and been on the wrong medication and has 

been in a horrible condition. So it is pervasive. It is not just isolated in one situation. 

Mr. JOHNSON. Thank you. Mr. Chairman, I yield back. 

Mr. MURPHY. Thank you. The gentleman’s time has expired. 

Ms. DeGette for 5 minutes. 

Ms. DEGETTE. Thank you very much, Mr. Chairman, and I would 

like the panel to know that I have read all of your testimony even 

though I wasn’t here to hear you say it, and for those of you have 

lost loved ones, my deepest condolences. I know, as I said in my 

opening statement, I know how difficult it is to have a child with 

a severe illness. My child has a physical illness, not a mental illness, and she is now a freshman at college. So I know what you 

have been dealing with in terms of—and Dr. Martini, I know what 

you were talking about in your testimony, too, of the parents paying the college, you know, the college tuition, parents obviously love 

the child and are deeply concerned, and yet the child is over 18, 

and they are wanting to become independent, and they do have privacy issues. It is a really hard balance especially when you are 

dealing with some of these mental illnesses which as we learned 

in our previous briefings in this panel from professionals, bipolar 

disease manifests, which is at the root of some of the violence, most 

notably suicides, that evidences itself in young men between the 

ages of 18 and 25 and in young women at a slightly older age. But 

this is right at the age where they are becoming independent from 

their families, and most of the time they are over 18. 

So it is a hard balance because on the one hand it is like Ms. 

McGraw was talking about, you want these young people to not 

feel the stigma so that they will get medical treatment and on the 

other hand as parents we want to know if they are at risk to themselves or to others, and so it is a balance. 

Dr. Martini, something you said just a moment ago really struck 

me, which is, you know, in trying to grapple with this issue you 

said that we need to look at the individual. The doctor, we need 

to rely on the doctors to look at the individual cases and to see if 

this is a situation where having parental involvement or involvement of another responsible adult would be appropriate to let them 

know. And I guess I agree with that, but I guess I also in listening 

to the testimony of the last panel would—that is exactly what they 

were saying. What they were saying is in their interpretation of 

HIPAA that is exactly what medical providers are allowed to do. 

And so I think what we need to do is we need to—providers need 

to understand what their abilities are under HIPAA. Wouldn’t you 

agree with that? 

Dr. MARTINI. I mean, I think that that is a very important part. 

I think educating providers about HIPAA also in a way that makes 

it seem like this is more of a collaboration that—— 

104 

Ms. DEGETTE. Right. 

Dr. MARTINI [continuing]. There is information to be gained. I 

mean, for example, the State of Tennessee has created a review 

panel of physicians that can look at cases and can override aspects 

of HIPAA if that panel, and it is an objective panel—— 

Ms. DEGETTE. Right. 

Dr. MARTINI [continuing]. Decides that this particular situation 

is worthy of that, and I think those kinds of initiatives where 

HIPAA is seen as not simply a government regulation—— 

Ms. DEGETTE. Mandate. Yes. 

Dr. MARTINI [continuing]. But as a process, as something that 

they can participate in, I think the outcome would be better. 

Ms. DEGETTE. I agree with that, and if we still have our HHS 

witnesses here, yes, we do, some of them, is I think we should also 

have our federal agencies work with the colleges because a lot of 

these problems seem to come with the colleges trying to balance 

the important privacy protections for their students and also letting parents know. And, again, I think they would have some leeway, but we would have to work with them to let them know that. 

Dr. MARTINI. I think it is a very good point. 

Ms. DEGETTE. OK. 

Dr. MARTINI. I think there would also need to be some help for 

them because coordinating mental healthcare for students some 

thousands of miles away would be a challenge. 

Ms. DEGETTE. And this goes to my—the last thing I want to talk 

about because it is not just the HIPAA issues. It is also access to 

treatment, and I think some of you have probably seen this in your 

communities. I had—I was actually at the eye doctor, and the assistant came in, and she said she had a 19-year-old son diagnosed 

with bipolar, and he had become violent. He was—he actually put 

himself into a 72-hour hold and then he was released, and he actually, you know, involved his parents, and they were involved with 

it. They couldn’t find any mental health treatment for this kid in 

Denver, Colorado, and this is another issue as well is, you know, 

once you diagnosis this, you have got to be able to find treatment. 

I think, Doctor, you probably agree with that. 

Dr. MARTINI. Absolutely. I think work force is a big issue, certainly in pediatric mental health services—— 

Ms. DEGETTE. Yes. 

Dr. MARTINI [continuing]. And also I think, I kind of alluded to 

this a little bit, we also need to work on access through primary 

care. I mean, the thing to remember is that a majority of the mental health problems are actually treated by local physicians in the 

community, and we need to work with them, we need to help them, 

we need to educate them so that access begins locally. 

Ms. DEGETTE. Thank you. Thank you, Mr. Chairman. 

Mr. MURPHY. Thank you. I now recognize the gentleman from 

Virginia, Mr. Griffith, for 5 minutes. 

Mr. GRIFFITH. Thank you, Mr. Chairman. I appreciate your patience. 

Let me follow up on that. I think, Dr. Martini, you were talking 

about local health professionals being involved and trying to make 

sure people get treatment. Is it your opinion or what are your 

thoughts, can HIPAA also stand in the way of proper communicaVerDate Nov 24 2008 14:42 Nov 07, 2013 Jkt 037690 PO 00000 Frm 00110 Fmt 6633 Sfmt 6633 F:\MY DOCS\HEARINGS 113\113-37 CHRIS
105 

tions between, for example, the treating mental health professional 

and a patient’s general care physician? 

Dr. MARTINI. I think that there have been cases that I have 

worked on where the family, the patient, does not want the local 

physician to know about the extent of the psychiatric problems in 

part because the local physician is in the community, knows a 

great many people. I think that a good bit of that anxiety is misplaced on the part of the patient, but I can understand it. I also 

think that what we need to do is we need to work with these local 

clinicians and physicians to involve them more in mental 

healthcare to educate them to make them part of the mental health 

system so that families recognize that the help that they provide 

is going to be in the patient’s and the family’s best interest. 

Mr. GRIFFITH. Because one of my concerns that we heard from 

a previous hearing was it takes—or informal hearing but it took 18 

months for the average person with a mental health problem to, 

you know, get to see a mental health professional, and that is of 

concern and something that we need to address, but it would seem 

to me that your primary care physician might be in a position to 

shorten that time period just by making the referrals or by saying 

this is not such a big deal, and when it is a trusted family physician, a lot of times they can be helpful in that regard. 

Also in following up, if the professional is not in the immediate 

community, I represent a rural area, so the mental health professional may be, you know, the next community over, 30, 40, 50, 60 

miles, maybe more, and if they can then communicate with the 

local healthcare provider, it does create some benefits there. 

From the perspective of the patient, why do you think such communication, free communication between the healthcare providers 

is important? 

Dr. MARTINI. I think that on the part of the patient what it will 

allow them to do as you were pointing out is receive services, I 

think, more efficiently. I think that the local practitioners understand the community, understand what is available in the community, what is available not simply from the standpoint of medical 

services and mental health services but also within the community, 

within schools. They are familiar with that. I think that our—what 

we need to do as mental health professionals is we need to work 

with them to teach them what they can do, to get them comfortable 

with what they can do in their practices, and also to teach them 

when they can, when they should refer to us, and then as part of 

that we need to be available. We need to make ourselves available, 

and that is a big question. We do need to increase the size of our 

workforce but also we need to do this in a much more efficient and 

effective way. 

Mr. GRIFFITH. Thank you very much. 

Ms. McGraw, I noted in your testimony that the fear of liability 

for violating HIPAA’s provisions coupled with misunderstanding of 

its provisions can be a recipe for not sharing. 

Ms. MCGRAW. Yes. 

Mr. GRIFFITH. And I am just wondering if you are familiar with 

and I hate to ask Ms. Thomas, but I would ask, are you familiar 

with suits that go the other way, where permission could have been 

granted. I mean, in Ms. Thomas’s case, you know, the police asked 

106 

to be notified, he clearly—the police had made a determination he 

was dangerous to the community, they didn’t want him out of on 

the streets, the hospital then used HIPAA as a shield to say, oh, 

well, we couldn’t tell the police anything. 

So I am just wondering if you, Ms. McGraw, have heard of any 

suits, and Ms. Thomas, did you all even consider suing them for 

letting this dangerous person back out on the streets when HIPAA 

would have allowed it? 

Ms. MCGRAW. So I can tell you that HIPAA does not actually 

have any provisions that enable anyone to sue on enforcement of 

it. So either a patient in terms of privacy rights or someone else 

in terms of sort of over-interpretation. Keep in mind also that 

HIPAA’s allowance of disclosures for these reasons that we have 

talked about is permissive. It still relies on the judgment of 

healthcare providers to make the judgment call about what is in 

the best interest of the patient. 

Having said that, we need to keep in mind that HIPAA’s the 

floor and that there are State laws that may provide greater protections, and they may medical privacy statutes that could be used 

for—to impose liability in those circumstances. 

But I certainly have never heard of anybody being sued for not 

releasing information except in the case of information that a patient asks for that is about them, because you are required under 

HIPAA to disclose that information. You can be held accountable 

under HIPAA for not doing so. 

Mr. GRIFFITH. I guess my concern that, and I was a practicing 

attorney for a lot of years, but my concern is that is one of the 

ways people like to hate lawyers, and I understand that, but that 

is one of the ways you sometimes get rectification in some of these 

cases, not that the money is important. It can’t bring anybody back, 

but it may keep somebody from making that mistake again. I 

mean, here we had an individual in your case, Ms. Thomas, who 

the police bring in, he has just run his car into the back of a garage, he is clearly either a danger to himself or to others. They 

bring him in, they want psychological evaluation because he is a 

threat to somebody, and the hospital just lets him walk out even 

though the police ask for notification. I can’t think of anything else 

that would—and to me that is the classic definition of negligence, 

and I am very sorry. If you want to answer you can but—— 

Ms. THOMAS. No. It is fine. It was considered as far as looking 

into a lawsuit, however, we were unable to get Mark’s records due 

to HIPAA, and we just decided that it probably wouldn’t be—it 

really wasn’t going to benefit anybody at that point in time to proceed with a lawsuit. 

Mr. GRIFFITH. And I respect that decision. 

Mr. MURPHY. The gentleman’s time has expired. 

Mr. GRIFFITH. Thank you. I appreciate it, Mr. Chairman, and I 

yield back. 

Mr. MURPHY. Recognize Ms. Schakowsky for 5 minutes. 

Ms. SCHAKOWSKY. Thank you, Mr. Chairman. 

First of all, I just want to say that I hope in future hearings and 

other events that we will include testimony and participation from 

the patient community, and I know that there is some—I know 

there is a discussion right now—— 

107 

Mr. MURPHY. Excuse me. 

Ms. SCHAKOWSKY [continuing]. About including testimony—— 

Mr. MURPHY. We cannot—we are not permitted to have any outbursts, and I would ask that members not say things that might 

also provoke some outburst. So I ask the folks be—just continue on. 

Go ahead, Ms. Schakowsky. 

Ms. SCHAKOWSKY. OK, and I know there is some discussion 

about including written testimony, highly footnoted, into the 

record, and I would certainly recommend that that be done without 

much ado. 

I wanted to—and let me thank especially the family members 

who came here with your stories. I know it has got to be very, very 

hard to do, and it is much appreciated. 

So I want to understand the examples that, a couple of examples 

that you gave. You had a patient, a former patient with a mild 

form of autism, and eventually his parents went to court against 

his wishes because they said their son could not care for himself 

and thus remained dependent, and you conclude, ‘‘Unfortunately, 

the subsequent ruling in their favor was counter to our goals of 

psychiatric treatment and derailed his progress in therapy.’’ 

So are you saying that that was a bad decision that the son 

should have been able to do what he wanted to do? 

Dr. MARTINI. No. What I was saying was that because the son 

would not allow his parents to be involved in his affairs, nor would 

he let them be involved in therapy, so I couldn’t incorporate them 

into any of the programming that I was trying to organize, any of 

the treatment that I was trying to organize, couldn’t involve them 

in the medications that he was prescribed, and they had serious 

concerns about how he was going to function. Because we couldn’t 

negotiate that, because he continued to refuse to allow them to participate, this was the only recourse that they had, it went counter 

to our therapy because the purpose of the therapy for me was to 

make him more functional, that my goal was—— 

Ms. SCHAKOWSKY. I understand that, but what would—at the 

point that you are saying if they had been involved earlier and I 

understand that, but at the point of someone making a decision, an 

adult making a decision about what they want to do, is there—I 

am trying to understand what a better outcome might have been 

and could it have been done without going—having to go to court. 

Dr. MARTINI. I think that is one of the reasons I put it in there 

is because I was searching for another way to have a better outcome without having to go to court. If there was a mechanism, for 

example, similar to the thing I mentioned in Tennessee where 

there was an opportunity to appeal or to present the case in front 

of a review board involved in HIPAA to say this is what is going 

on in this case, I think it is in this individual’s best interest to have 

the parents involved, to have them actively participate because I 

think it is more likely that this individual is going to be successful. 

His treatment is going to be successful, and his life, I think, is 

going to be less traumatized. If you have an opportunity to do that 

and there is a means to modify what is happening with the HIPAA 

regulations in these particular cases, I think that it would be an 

advantage not just for the family but also for the patient. 

108 

Ms. SCHAKOWSKY. So you asked the question, if there is a bias 

in these situations, should it be towards parental involvement rather than away from it. What do you conclude? 

Dr. MARTINI. Pardon me? 

Ms. SCHAKOWSKY. What do you conclude? If there is a bias in 

these situations, should it be toward parental involvement rather 

than away from it? 

Dr. MARTINI. I think that if there is a bias in the situation, you 

know, as a child and adolescent psychiatrist, my bias has been to 

involve families. We involve families as often as possible in treatments, and I think that for a variety of reasons, and I think if 

there is going to be a bias in that situation, my recommendation 

would be that it be toward family involvement, particularly if there 

are no specific reasons within that family, if there are no contraindications within the family, nothing that would adversely affect 

the patient. 

Ms. SCHAKOWSKY. Just wonder, I mean, and I am not weighing 

in on either side, but I think there are people in the independent 

living community that would feel that a young adult with autism, 

that there may be some better ways for that individual to live in 

the community with support, help, et cetera, rather than as you 

used the word, dependent, at home. 

Do you see that as part of the negotiation that might involve everyone? 

Dr. MARTINI. Absolutely. I mean, I think in this particular case 

the goal for this patient was greater independence. What the hope 

was in treatment was that he would be able to manage his affairs, 

that the level of anxiety that he felt in new situations would go 

down, that we would increase the capabilities that he had to manage his medications. The sense was that having his parents involved, I think, would have expedited that process. 

Ms. SCHAKOWSKY. Thank you. I yield back. 

Mr. MURPHY. Thank you. Recognize Ms. Ellmers for 5 minutes. 

Mrs. ELLMERS. Thank you, Mr. Chairman, and I would also like 

to say to the panel, thank you so much—and I am going to get 

emotional—for coming and sharing your stories because this is the 

only way we are going to change anything in mental health. I know 

how difficult it is for you to come forward, but I can just say how 

much we appreciate your input so that we can make the right decisions moving forward. 

With that I would like to start, Ms. McGraw, thank you for your 

comments to my colleague. You know, one of the areas, as a nurse, 

and Ms. Levine, I completely I associate myself with your statements because I think sometimes it is easier to just give a blanket, 

hey, you don’t know what you are talking about. You are the family 

member. Anyone who knows better for your family is you. So, unfortunately, that is one of the downfalls of nursing is sometimes we 

share our opinions a little too openly. 

But I am concerned about the misconception of lawsuits because 

as we know, there are so many frivolous malpractice lawsuits out 

there. This is one of those gray areas where healthcare professionals do not feel that they are protected. Certainly HIPAA violations can be weighed against them, but at the same time as far as 

109 

malpractice, that is not necessarily an avenue that will be taken. 

Am I correct with your testimony? 

Ms. MCGRAW. Yes. Well, certainly there is nothing in HIPAA 

that would enable someone to be sued. Again, to the extent that 

you have seen sort of any lawsuits in this space around privacy violations, they are filed under state law provisions. 

Mrs. ELLMERS. OK. 

Ms. MCGRAW. And I don’t do malpractice work, but, again, if you 

are being—if you are facing a malpractice lawsuit, that is a State 

law action. 

Mrs. ELLMERS. Perfect. Thank you, and Mr. Wolfe, I would like 

to ask you a few questions. 

Mr. WOLFE. Thank you. 

Mrs. ELLMERS. With your situation especially, and as sensitive as 

it is, again I thank you for being brave and sharing that with us. 

I read over your testimony to find that you were in a situation 

where you knew what was happening to your son, you knew that 

there was a drug addiction, and because of that behavior on his 

part with the manipulation that they do so well—— 

Mr. WOLFE. Right. 

Mrs. ELLMERS [continuing]. He was able to manipulate and then 

kind of get his way. 

Mr. WOLFE. Yes. 

Mrs. ELLMERS. And then you were able to get him into a treatment facility but then you were told that they could not share information with you because of HIPAA. Correct? 

Mr. WOLFE. Exactly, and the manipulation, the lying that goes 

along with addiction from what I have learned from my son and 

from others since this has happened was just to give you one quick 

example, I wanted him to go into an inpatient treatment program 

immediately, and he said to me, Dad, I don’t want to go into an 

inpatient treatment because I don’t want to start using heroin or 

crack cocaine. And I as a parent had to make the decision what to 

do—— 

Mrs. ELLMERS. Yes. 

Mr. WOLFE [continuing]. And I did my research and I did hear 

that people do smuggle in—— 

Mrs. ELLMERS. Yes. 

Mr. WOLFE [continuing]. Heroin and crack cocaine, and there are 

a lot of other users than Percocet using, which is what he had indicated that he was doing to the family—— 

Mrs. ELLMERS. Yes. 

Mr. WOLFE [continuing]. Not letting us know that he was doing 

heroin. So, therefore, the lies and manipulation unfortunately, we 

sent him to an outpatient which he said he would agree to go to, 

and when I tried to confront the outpatient counselor for the first 

couple of weeks I was denied any access to any records or be told 

why he was there. 

Mrs. ELLMERS. You know that unfortunately is a story that we 

continue to hear, and I do agree with you. I do think that there 

are some changes that need to be made. More clarifications, I 

think, than anything so that both healthcare professionals, family 

members, and patients can all understand a little better what can 

be shared and what cannot. So I thank you. 

110 

Mr. WOLFE. Thank you. 

Mrs. ELLMERS. Dr. Martini, I have just about 30 seconds left, but 

I do want to say just very recently I was at the Partnership for 

Children in Cumberland County, North Carolina, I represent in the 

second district of North Carolina. We had a lengthy discussion 

about mental illness, especially in relation to children. I have a 

very good friend whose son is autistic and now is starting to show 

signs of depression and some, beginning signs of mental illness. 

They are having an incredibly difficult time trying to find the correct physician for him because of his autism that had already been 

diagnosed. 

Quickly, could you just say a few words about that? 

Dr. MARTINI. I think that the availability of services is a critical 

issue. I think at child and adolescent psychiatry we need to expand 

our workforce not just among psychiatrists but with all child and 

mental health professionals. I think we also, as I alluded to before, 

we need to work with community physicians. We need to work with 

schools. There are ways to provide services for children locally that 

can be efficient and effective beyond simply going to a tertiary center. 

Mrs. ELLMERS. Thank you so much. I appreciate the Chairman 

giving me a few more seconds. Thank you. 

Mr. MURPHY. The gentlelady’s time has expired. 

Mr. Scalise is next, but I understand he is going to allow Dr. 

Cassidy to go first. 

Dr. Cassidy, you are recognized for 5 minutes. 

Mr. CASSIDY. Thank you, Mr. Chairman, and thank you, Mr. 

Scalise. 

Every one of you, thank you for your note of reality. 

Ms. McGraw, clearly we are all concerned about privacy and yet 

you can respect that there is a certain ambivalence that we must 

have or that is exhibited by this. So thank you all. 

Ms. Levine, the way that you said that the HIPAA laws should 

be written in something that a patient understands, I put exclamation mark, exclamation mark, exclamation mark because it is 

written to avoid liability, not to inform people of what their rights 

are. 

Now, thank you, all. 

Dr. Martini, what a great name for a psychiatrist. 

Dr. MARTINI. I like it. 

Mr. CASSIDY. I asked Mr. Rodriguez a question, and you put 

here, if you had a patient who was—if Lithium is still used for bipolar, and if the level is declining but the patient is still compensated, would you feel that current HIPAA laws would allow you 

to speak to the parent of someone who is emancipated by age or 

by law that, listen, if this Lithium level goes any lower, they are 

going to have a psychotic break. This is not an immediate danger, 

but Mr. Rodriguez seemed to indicate that that would permissible. 

Would you accept that in your practice that is what most psychiatrists or whomever are doing? 

Dr. MARTINI. If the patient explicitly stated that he did not want 

that information shared if the patient was not in imminent danger 

to self or others, I think most psychiatrists would believe that they 

should not share that information. 

111 

Mr. CASSIDY. Now, if the patient had a history of being non-compliant with Lithium and having bipolar episodes and creating some 

of these terrible heart-rendering stories occurring, would that 

change the calculus, or would it still be, no, we cannot do it? 

Dr. MARTINI. I think that what—when I talk to colleagues of 

mine about that situation, if they are dealing with a patient that 

they know is dangerous, if they are non-compliant with their medications, they inform families and significant others, and they take 

the risk that they may be in violation of HIPAA because they believe that it is in the best interest of the patient. 

Mr. CASSIDY. Now, it is interesting because you say they take the 

risk, and yet that is a perception and yet some of what we have 

heard is that that should not be a risk. It should be kind of like, 

wow, don’t worry. It is not a risk, but it tells me that there is an 

ambiguity even among people who are full-time professionals. 

Would you accept that? 

Dr. MARTINI. Well, I think that that is true. I think that the 

problem is that it is that idea of waiting until imminent danger. 

A patient can be non-compliant on medication and for a period of 

time look pretty stable, and you know that eventually—— 

Mr. CASSIDY. Now, not to be rude but we know that there are 

going to be a pattern of episodes, and so we know, man, he is off 

his Lithium. I see his level going down. Boom. It is going to happen 

again. Now, he doesn’t pull a gun, he doesn’t do anything terrible, 

but he does live under a bridge, he does leave his family, he does 

sell all his possessions and run down the street, whatever. 

In that would there be ambiguity among your colleagues whether 

they are at risk? 

Dr. MARTINI. I think that if when they are seeing the patient, if 

the patient appears stable and is doing well but they know they 

are non-compliant with the medications, understanding that mood 

disorders quite often are episodic, I think that there would be some 

concern if they told the family but they understand that in many 

situations they need to do that because the patient has a history. 

Mr. CASSIDY. So, again, there is a perception they are running 

a risk? 

Dr. MARTINI. I think there is a perception that they are running 

a risk. 

Mr. CASSIDY. Now, Ms. McGraw, Mr. Kelley used the term, I am 

not quite sure how to pronounce, but I think we are all familiar 

with it if we have a teenager. On the other hand, his is far more 

dramatic than that. A year of no insight. Now, this gentleman, his 

son said that his parents could not know his history, and yet he 

had no insight. We are not quite sure how to address that. What 

would you suggest? 

By the way, I was also struck as smart as you are and you are 

an expert in privacy, you learned something from Mr. Rodriguez’s 

testimony. I will tell you, an ER physician seeing 20 patients a 

night who is not in your specialty, not hearing this testimony, 

there is no way that ER physician, there is no way that she can 

actually be as facile with this information that we are demanding. 

What suggestions would you have as to regards of Mr. Kelley’s 

son? 

112 

Ms. MCGRAW. Well, one of the things that we have had a lot of 

conversation about and when I said that I learned something from 

Director Rodriguez this morning was how the concept of incapacity 

plays in the capability to share information with family members, 

which is not contingent on serious or imminent risk but circumstances under which a mental health professional can make a 

judgment about talking to a family member when they believe it 

is in the best interest of the patient, which is in circumstances 

when the patient is not around to object or in incapacity. And in 

looking through the guidance that is right in front of me about the 

ability to talk to family members, the issue of this incapacity which 

is, in fact, in the regulatory language, it is not really explored in 

very much detail. 

So it does leave a lot of uncertainty on the part of providers 

about how they are—you know, how do they comply with that and 

what does that mean, and it certainly would be helpful to have the 

guidance explore that issue in a little more detail in my opinion. 

Mr. CASSIDY. Thank you very much. I yield back, and thank you, 

again, Mr. Scalise. 

Mr. MURPHY. Thank you. Mr. Scalise, you are now recognized for 

5 minutes. 

Mr. SCALISE. Thank you. Thank you, Mr. Chairman, for having 

the hearing, and I especially want to thank those family members 

who have been impacted by mental illness for coming here and 

sharing your stories with us. We had I thought a real helpful forum 

back on March 5 where we had some other family members, including Pat Milan, who is from my district, whose son, Matthew, took 

his life, we being treated for mental illness. They, you know, they 

actually thought they were making progress. Both Pat and his wife, 

Debbie, were trying to get information from the doctor, from the 

treatment centers, and were not able to get that information, and 

HIPAA was being thrown up as the reason that they couldn’t get 

access. It turned out after the fact, unfortunately, after he took his 

life, that in his file he had actually authorized his parents to have 

access to information, and so it was just incredibly frustrating, angering, you know, for us hearing this at the forum that we had but 

especially to them as parents who were trying to get the right kind 

of help for their kids, for their son, and just couldn’t get that access. 

And so when we hear these stories, and I know, Ms. McGraw, 

you talked about it, Ms. Thomas, that people hiding behind HIPAA 

when it turns out that HIPAA really may not be the impediment. 

How do we get some clarity in HIPAA to remove this gray area, 

if it is even in fact gray, that is stopping vital information from 

being shared with family members, you know, and even in cases 

where these patients want their parents to have that access, and 

yet it is being denied. 

If, you know, anybody from Dr. Martini and maybe go across. If 

we can try to figure out what is this disconnect that is stopping 

this information from being shared when the law by many people’s 

own interpretation doesn’t preclude that information from being 

shared. 

Dr. MARTINI. I think the thing that is missing in these situations 

is a discussion of the clinical presentation and looking at these 

113 

cases on a much more individual basis and providing within the 

law some flexibility for whether it is appeal or whether it is involvement by clinicians so that there is an opportunity for a psychiatrist, a psychologist to present the case to an objective body to 

make a request for modifications in HIPAA in those particular situations. 

Again, thinking about what is in the patients’ best interests and 

to have that objective body rule on that process I think somehow 

making it feel as though this is not simply the government telling 

people what to do, but it is the government giving people an opportunity to protect their rights but also to ensure the patients get the 

best care possible. 

Mr. SCALISE. Ms. Levine? 

Ms. LEVINE. I think we need to start with medical education, 

nursing education, and all other kinds of education to have objective people presenting the rules of HIPAA, what is permissible, so 

forth, not the risk managers. I am sorry if anybody here is a risk 

manager, but I think this perception of the legal liability, yes, anybody can sue anybody for anything, but the real risk is in the security of the electronic data, and that seems to have been ignored in 

all of this HIPAA scare. The Washington Post did a—— 

Mr. SCALISE. And I apologize. I have only got a minute left, and 

I want to get to the four remainder—— 

Ms. LEVINE. Yes. So I think we need to do the education in an 

objective way, balanced way, and think about the patients’ best interests. 

Mr. SCALISE. Thanks. Mr. Wolfe. 

Ms. LEVINE. Definitely include the family. 

Mr. WOLFE. Yes. I just want to say that I feel that the parents, 

it is very important for parents to be apprised of what is happening 

with their children, even when they are legally emancipated, and 

I think that is important to be put into because of the Obamacare 

since we do take care of them until the age of 26 under our insurance, I would not have lost Justin if I was made aware of what he 

was going in for. So I think the parents have to be made aware. 

We are the best caregivers with regard to our children, and there 

has to be an exception with regard to that. 

Mr. SCALISE. Thanks. Mr. Kelley. 

Mr. KELLEY. I would like to ask that the committee start expanding the definition of a family member beyond a parent because 

there are other members of the families that are in these roles, but 

quite frankly, change is hard, and I want to thank Ms. McGraw 

from the bottom of my heart because it is taken so long to hear 

what she just said. We need to change things, and sometimes you 

can’t get change unless you change things. There has got to be a 

carve out for the severely mentally ill or this unless the patient objects clause will rule the world. 

Mr. SCALISE. Thanks. Ms. Thomas. 

Ms. THOMAS. I guess I would kind of agree with what he said. 

I think we need to be made more aware of what HIPAA actually 

does prohibit, and I do think there probably should be some special 

clauses there for the mentally ill. 

Mr. SCALISE. Thanks. Ms. McGraw finally. 

114 

Ms. MCGRAW. Yes. Lots more guidance, clear, understandable, 

disseminated to places that people can easily find it, maybe in a 

hotline for questions. 

Mr. SCALISE. Thank you, Mr. Chairman. I yield back the balance 

of my time. 

Mr. MURPHY. The gentleman’s time has expired. 

At this time we have finished the testimony. I understand that 

the Ranking Member has a unanimous consent request. I do want 

to say this. 

This committee has a practice of only accepting sworn testimony. 

We are going to be asked to accept a letter signed by a number of 

organizations which states in its first paragraph that they are submitting a statement for the record in advance of the hearing. I 

want to say that we only became aware of this at 7:15 this morning, and we have not had time to fully review this statement. In 

this case it is not a letter but as I said before, a ‘‘statement for the 

record,’’ which does not follow the tradition of this committee for 

sworn testimony. 

Moreover, this is a point of personal privilege for the Chairman. 

One of the groups who have signed this letter for the record has 

repeatedly circulated false statements about the Chairman and 

Ranking Member and have repeatedly and purposely misrepresented the serious and important work we are doing here on behalf 

of patients, families, healthcare providers, and the public. They 

have repeatedly and deliberately misrepresented the committee 

work with these false statements. 

Thus, in this case submitting a statement for the record without 

it being sworn testimony is of concern to the Chair, and I yield to 

the Ranking Member for her statement. 

Ms. DEGETTE. Thank you. Well, Mr. Chairman, I would ask 

unanimous consent to place a letter dated April 25, 2013, about the 

position of these organizations regarding HIPAA. It is signed by 

the American Civil Liberties Union, the Autistic Self-Advocacy Network, and the Baseline Center for Mental Health Law, and I would 

ask unanimous consent to put this in the record as the opinion of 

these organizations. 

As we have discussed before, I have been on this subcommittee 

now for 16 years, Mr. Chairman, and it has always been the practice of the committee to take testimony under oath, and you are absolutely correct that this letter obviously is not under oath. It has 

also been the practice of this committee, though, to get extensive 

information from folks who might have expertise or opinions or otherwise, and I have seen this happen numerous times from both 

sides of the aisle. Simply accepting a document into the record does 

not necessarily imply agreement with the position stated in that 

document by either the Chair, the Ranking Member, or any other 

member but rather it helps to give a more full picture of what people think. 

But I agree with you. I do not consider this April 25 letter to be 

testimony or to substitute for testimony. I believe that it is a statement of that group, and we have done that. I have got many examples here I could give, but in the interest of time I won’t. I simply 

ask for the Chair’s comity in putting this in and look forward to 

115 

working with you so that we can clarify documents that will be put 

in in the future. 

I would also note we also did put an article from Sports Illustrated in the record today. So it seems to me this letter would be 

appropriate. 

Mr. MURPHY. I thank the Ranking Member, and out of my respect for the Ranking Member and understanding some of the 

unique circumstances in this case, for the unanimous consent we 

will accept this into the record at this time. 

I do want to thank the panelists today in continuing our series 

to deal with this critically important issue for the American people. 

Not since John F. Kennedy was President I think have we had 

such a focus on the issues of mental health and mental illness in 

this country. 

Your statements today, the passionate statements from the family members, and, again, our sympathies and our prayers go out to 

you, the expertise, Dr. Martini, Ms. Levine, and Ms. McGraw, and 

those in our first panel, I ask that you stay in contact with us. We 

have a great deal of respect for what you have given to us today 

and look forward to working with you. 

I would like to also add this. I am very proud of the committee 

members on both sides of the aisle. I think that the members here 

have shown an absolute dedication to working on this. The statement we had earlier today, there is something like 38,000 suicides, 

700,000 emergency room admissions for people who have attempted 

harm to themselves, and all the issues involved. This committee is 

focused more than any other subcommittee I think in Congress in 

our memory and I deeply thank the Ranking Member for her compassion and her passion in this. I also thank Mr. Braley for his 

bringing Ms. Thomas in today. 

Again, thank you all very much. I would like to say in conclusion 

that I remind members they have 10 business days to submit questions to the record. I ask the witnesses to all agree to respond 

promptly to any questions we forward to them. 

With that this committee is adjourned. 

[Whereupon, at 11:35 a.m., the subcommittee was adjourned.] 

[Material submitted for inclusion in the record follows:] 

PREPARED STATEMENT OF HON. TIM MURPHY

Last month, I convened a bipartisan forum to address a difficult, painful, and 

much-ignored topic: severe mental illness and violence. At our forum, Pat Milam 

told us about his son, Matthew, who had paranoid schizophrenia. For years, Matt 

suffered before taking his own life at just 22 years old. 

During that forum, Mr. Milam explained that his son’s doctors were unwilling to 

share concerns about Matt’s high risk of suicide. Mr. Milam believed that the inability to receive and discuss crucial information because of HIPAA was a contributing 

factor in his son’s death. Another witness, Liza Long, dreaded the difficulties she 

would face trying to remain involved in her own mentally ill son’s care once he 

turns 18 due to privacy restrictions in HIPAA. 

I’ve been convening regular public forums in my district to discuss the state of 

our damaged mental health system. At each discussion, parents testified about the 

HIPAA-created challenges they experienced in getting the best care for their youngadult mentally ill children. As I have just mentioned, in some of these cases, the 

outcome was tragic. 

In 2002 my constituents, Charles and Debi Mahoney, lost their son, Chuck, to suicide. The warning signs were there. Chuck struggled with severe depression. His 

fraternity brothers, his ex-girlfriend, and college therapist all knew he was in danVerDate Nov 24 2008 14:42 Nov 07, 2013 Jkt 037690 PO 00000 Frm 00121 Fmt 6633 Sfmt 6633 F:\MY DOCS\HEARINGS 113\113-37 CHRIS
116 

ger and warned the college. But college administrators said federal privacy laws 

prevented the school from notifying Chuck’s parents about his condition. As the 

light was chased from this young man’s heart, those who were in a position to help 

did not. 

The stories of the Mahoney’s, the Milam’s, and those we will hear today compel 

us to act with care and compassion as we develop ways to overcome institutional 

barriers to quality mental health treatment. 

Ultimately, parents may be in the best position to help children suffering from 

significant mental illness by providing emotional support, medical history, and coordinating care with various mental health professionals. 

Today we will examine the ways in which federal privacy laws, beginning with 

whether HIPAA, applied properly or improperly, interferes with the quality of patient care or compromises public safety or both. 

To be sure, HIPAA’s obstruction of health information-sharing between provider 

and family in no way is limited to mental health. Some of our witnesses will testify 

that a widespread misunderstanding of what HIPAA says can prevent individuals 

with serious long-term medical conditions from obtaining appropriate care. 

HIPAA, as initially conceived and enacted, reflected an effort to replace a patchwork of state laws and regulations impacting the confidentiality of medical information. From the start, HIPAA was accompanied by considerable anxiety on the part 

of providers, or the ‘‘covered entities.’’ Fearful of new penalties for violating HIPAA, 

doctors and nurses were refusing to even talk about a patient’s illness with caretakers, all of whom were caretakers, spouses, siblings, or those managing the affairs 

of their elderly parent. 

Unfortunately, ‘‘if you want to be safe, don’t tell anyone anything’’ became the 

prevailing attitude at the expense of the patient. 

HIPAA has implications that go beyond healthcare into the arena of public safety. 

According to data from the Government Accountability Office, the records of 1.5 million people who have been either involuntarily committed to mental health treatment, or deemed mentally incompetent by a court of law, and are therefore prohibited from owning a firearm, are missing from the National Instant Criminal Background Check System, also known as NICS. 

Many states have said confusion over HIPAA has prohibited them from sharing 

these records with FBI and helping to keep firearms out of the hands of the violently mentally ill. 

I’m encouraged that a letter sent by our committee in mid-February spurred the 

Department of Health and Human Services to announce last Friday plans to reform 

HIPAA so states could upload these records into NICS. I appreciate the work on 

this issue by HHS Office of Civil Rights Director Leon Rodriguez, who will testify 

here today. 

Our goal with this hearing is to peel away the numerous layers of misinformation 

surrounding HIPAA so that we can ensure patients are getting the right treatment 

and the public is kept safe. Sometimes this may involve communication with the 

parents or family of a patient, who often possess unique insight into their loved 

one’s condition. At other times it involves communication with law enforcement, so 

providers take the right steps to report threats of violence. 

To that end, we will be hearing first from Mr. Rodriguez and Mark Rothstein. Mr. 

Rothstein is a professor of law and medicine at the University of Louisville, and a 

noted expert on the HIPAA privacy rule. From 1999 to 2008, he served as chair of 

the statutory advisory committee to the Secretary of HHS on health information policy. 

Next, we will hear from a panel of practitioners and family members who will 

comment on their personal experiences with HIPAA. Dr. Richard Martini is a Professor of Pediatrics and Psychiatry at the University of Utah School of Medicine. 

Carol Levine directs the United Hospital Fund’s Families and Health Care Project, 

which focuses on developing partnerships between healthcare professionals and family caregivers. 

I want to especially thank the family members who are here today—Gregg Wolfe, 

Ed Kelley, and Jan Thomas. Gregg’s son, Justin, who was diagnosed with a mental 

illness and had a substance addiction, died of a heroin overdose last December. Ed’s 

son, Jon Paul, has had severe mental illness for the last 14 years. These fathers’ 

efforts to obtain the best possible treatment for their sons was repeatedly stymied, 

in no small part due to misinterpretations of HIPAA by those responsible for their 

care. Jan’s husband, Ed, a beloved high school football coach, was murdered in 2009 

by a young man with mental illness. The parents of her husband’s killer believe that 

they were frustrated by HIPAA in trying to understand the full extent of their son’s 

paranoid schizophrenia. To Gregg and Jan, I want to extend our deepest sympathies. 

117 

We also have with us today Deven McGraw, Director of the Health Privacy 

Project at the Center for Democracy and Technology. This is an important subject, 

and I look forward to exploring this issue with my fellow subcommittee members 

at this hearing. 

# # # 

PREPARED STATEMENT OF HON. STEVE SCALISE

Mr. Chairman, families across America are grieving and searching for answers 

about why America’s mental health system has failed them and how it can be fixed. 

At the center of this investigation is a focus on the Health Insurance Portability and 

Accountability Act, otherwise known as HIPAA, which was passed more than fifteen 

years ago in an effort to promote patient privacy through the protection of health 

information and records. HIPAA has been highlighted as the source of many communication issues and roadblocks between patients, providers, and parental guardians. I will be submitting a series of questions for the record on behalf of my constituents, Pat and Debbie Milam, who tragically lost their son Mathew and experienced many obstacles within the mental health system. Mr. Chairman, I am committed to helping the Milams and other families in similarly frustrating situations 

get to the bottom of these systemic failures in America’s mental health system. I 

appreciate your interest and look forward to continuing to work with you on this 

important issue. 

118 


82190.072

QUESTIONS FOR THE RECORD 

Leon Rodriguez, Director, Office for Civil Rights, U.S. Department of Health and Human 

Services 

"Does HIP AA Help or Hinder Patient Care and Public Safety?" 

April 26, 2013 

Committee on Energy and Commerce, Subcommittee on Oversight and Investigation, U.S. 

House of Representatives 

The Honorable Tim Murphy 

Question 1: 

In your prepared testimony, you wrote: "be assured that OCR's enforcement efforts are 

not directed toward imposing penalties on health care providers who make good faith 

efforts to comply with the Privacy Rule with regard to communications with patients' 

family members and friends." What will your office do, after this hearing, to make sure 

this is more widely known? 

OCR's focus is on systemic security problems and longstanding failures of certain entities to 

fulfill individuals' rights under the Privacy Rule. The resolution agreements that OCR has 

entered into, as well as the single civil money penalty that we have imposed, demonstrate these 

priorities. 

To assist providers in understanding the law and our enforcement, our outreach efforts include 

posting a plain language guide for health care providers on communicating with patients' family 

members, friends, or others involved in their care, and providing a searchable set of frequently 

asked questions about this topic and more. 

OCR also posts a significant amount of information about our enforcement activities on our 

website, I which includes pages dedicated to enforcement statistics, case summaries, and detailed 

information about cases that have been resolved informally-through demonstrated corrective 

action or with a corrective action plan and settlement amount paid by a covered entity--or that 

have resulted in a formal enforcement action against a covered entity. 

In addition, we regularly announce and emphasize our enforcement priorities through our many 

public speaking engagements at conferences and webinars directed to the regulated 

community.Question 2: 

As a geueral matter, how much discretion is left up to OCR in deciding whether to pursue 

penalties and corrective measures against a covered entity at all? What types ofHIPAA 

privacy rule complaints are most likely to result in OCR taking corrective measures or 

imposing penalties? What guides OCR's discretion? What factors does OCR consider? 

1 http://www.hhs.gov/ocr!privacvlhipaalenforcementlindex.html. 

1 
119 


82190.073

The statute requires the Secretary to impose civil money penalties whenever the Department 

makes a formal determination that a violation has occurred, and to formally investigate those 

cases where our preliminary review indicates a possible violation due to willful neglect. 

Otherwise, the Office for Civil Rights (OCR), acting on behalf of the Secretary, retains 

discretion with respect to accepting cases for investigation or review, and resolving these matters 

informally with the covered entity, most often through the demonstrated corrective action of the 

entity to come into compliance. The regulatory provisions relating to HIPAA enforcement are 

found at 45 CFR Part 160, Subparts C, D, and E. 

In the vast m!\iority of cases, the covered entity will, through voluntary cooperation and 

corrective action, be able to demonstrate satisfactory compliance with its HIPAA privacy or 

security obligations. However, where we find indications of noncompliance due to willful 

neglect, or where the nature or scope of the noncompliance warrants additional enforcement 

action, OCR would pursue a resolution agreement with a payment of a settlement amount and an 

obligation to complete a corrective action plan, or would impose a civil money penalty. In 

addition to indications of noncompliance due to willful neglect, when deciding whether to enter 

into a resolution agreement with, or proceed to formal enforcement against, a covered entity, 

OCR would consider factors including whether the entity's noncompliance affected a very large 

number of individuals or resulted in demonstrated financial, physical, or reputational harm to 

individuals; whether the entity was noncompliant over a prolonged period oftime or had failed 

to comply with multiple requirements of the Privacy or Security Rules; and whether the entity 

had a history of noncompliance or had failed to implement effective corrective actions in prior 

informal resolution cases. 

The ultimate goal of our enforcement efforts is to protect the privacy rights of all individuals 

under the HIP AA Privacy and Security Rules through compliance by covered entities and 

business associates. Strategic use of our civil money penalty authority and high-profile 

resolution agreement cases draw attention to longstanding, systemic failures to comply with 

security or privacy requirements and raise the awareness of all covered entities and business 

associates of their obligations in these areas. 

Question 3: 

Are you concerned that the increased penalties for HIP AA privacy rule noncompliance 

that recently went into effect pursuant to the HITECH Act will make covered entities even 

more hesitant than before to share protected health information? Why or why not? Is OCR 

doing anything to address this preemptively? 

The purpose of higher penalties for HIPAA violations is to increase the incentive for covered 

entities and business associates to comply with their privacy and security obligations. 

Compliance involves knowing when and with whom the entity can share protected health 

information. As indicated above, we continue to educate covered entities and the public 

2 
120 


82190.074

regarding the ability of health care providers to share information with individuals' friends, 

family members, and others involved in their care. 

Question 4: 

For which states does the HIP AA Privacy Rule prohibit state mental health facilities from 

submitting records for individuals who have been involuntarily committed or adjudicated 

as mentally defective to the National Instant Criminal Background Check System? 

On April 23, 2013, OCR issued an Advance Notice of Proposed Rulemaking (ANPRM) seeking 

comment from states and the public regarding barriers that HIPAA may pose to NICS reporting. 

Through this process, we hope to learn more about the nature and extent of any HIP AA barriers 

to reporting by the states. The comment period will end June 7, 2013. 

As described in Question 5 below, previously, the rule did pose challenges for a New York 

mental health agency. New York has since changed state law, and we understand that the 

HIP AA Privacy Rule no longer has that effect. 

Question 5: 

What is the nature or structure of those facilities that creates the conOict with the Privacy 

Rule? 

As mentioned in Question 4 above, OCR has issued an ANPRM for the purpose of learning more 

about the nature and extent of any HIP AA barriers to reporting by the states. 

It is our understanding that in the case of New York the state mental health agency is responsible 

for making information regarding individuals prohibited for mental health reasons from having 

access to a gun available to the Federal background check system. Because the mental health 

agency is a HIPAA-covered entity, it previously faced some challenges to reporting the records 

to the NICS. Ultimately, New York State passed a statute that requires the mental health agency 

to repOrt this information to the NICS, making the disclosure permissible under HIPAA as a 

disclosure that is "required by law." Thus, to our knowledge, HIPAA no longer prevents New 

York from reporting this type of information to the NICS. 

Question 6: 

Wbat options do the parents of a young, mentally ill, adult have if: their child's healtbcare 

provider believes (perhaps falsely) that the HIP AA Privacy Rule prevents them from 

sbaring information witb tbe family, the child has refused to sign a release granting access 

to his health records to the parents, and a judge wbo has reviewed the case believes that the 

cbild has the right to refuse disclosure of his records because during a court appearance 

tbe cbild seemed to be of sound mind? Does HIPAA provide an exemption for such 

circumstances? 

3 
121 


82190.075

A health care provider is permitted to disclose information to the family members of an adult 

patient who has capacity and indicates that he or she does not want the disclosure made, only to 

the extent that the provider perceives a serious and imminent threat to the health or safety of the 

individual or the public and the family members are in a position to lessen the threat. Otherwise, 

under HIPAA, the provider must respect the wishes of the adult individual who objects to the 

disclosure. However, HIPAA in no way prevents health care providers from listening to family 

members or other caregivers who may have concerns about the health and well-being of the 

individual, so the health care provider can factor that information into the individual's care. 

4 
122 


82190.076

The Honorable Steve Scalise 

Question 1: 

What is the controlling factor to determine the age that a person gains Federal HIPAA 

rights? Is that governed by state or Federal law? Are there different standards and 

qualification ages for HIPAA in different states? 

HIPAA defers to state law to determine the age of majority and the rights of parents to act for a 

child in making health care decisions. Generally, parents or legal guardians are the personal 

representatives of their unemancipated minor child and can exercise the HIPAA rights of the 

child, including access to his or her health care record. However, there are certain exceptions, 

such as when state law permits the minor child to receive care without the consent of a parent or 

guardian and the child chooses to do so. 

Question 2: 

How many different institutions and medical providers have been found in violation of 

Federal HIP AA laws over the past 5 years? What was the amonnt of the fines paid in the 

last 5 years? By how many violators? 

From 2008 through 2012, OCR obtained corrective action from covered entities in more than 

13,000 cases in which our investigations found indications of noncompliance with HIPAA. 

During the same period, OCR reached resolution agreements with covered entities in II cases. A 

resolution agreement is a contract between HHS and a covered entity or business associate in 

which the entity agrees to perform certain obligations, make reports to HHS, and, generally, pay 

a resolution amount to HHS. The payments reSUlting from these II resolution agreements total 

approximately $10 million. 

OCR has also imposed a civil monetary penalty of about $4 million in one case in which the 

covered entity failed for up to a year and a half to provide 41 individuals with access to their 

health information, as required by the HIPAA Privacy Rule, and failed to cooperate with OCR's 

investigation. OCR found the covered entity had demonstrated willful neglect (the category of 

noncompliance for which the highest penalties may be assessed) in its failure to cooperate, when 

it refused to respond to OCR's repeated demands to produce the records, failed to cooperate with 

OCR's investigations ofthe complaints, and failed to produce the records in response to OCR's 

subpoena, which ultimately led to a default judgment against the entity after OCR petitioned to 

enforce its subpoena in United States District Court. 

5 
123 


82190.077

More infonnation about these cases, as well as other enforcement data and highlights, is 

available on OCR's website." 

Question 3: 

If a potentially suicidal patient is released to an outpatient setting from a hospital or other 

institution, should the doctor be required to contact the outpatient medical provider? 

Would it be a violation ofHIPAA if they did so? 

HIPAA pennits a covered health care provider to disclose infonnation about an individual to 

another health care provider without the patient's authorization for treatment and coordination of 

care purposes, or to avert a serious and imminent threat where the second provider is in a 

position to lessen or avert the threat. The provider's decision whether to make such a disclosure 

is guided by professional ethical standards and state laws governing the practice of medicine. 

Question 4: 

If a doctor deems an outpatient is at "high risk for suicide or other bad outcomes," is it a 

violation of HIP AA for the medical provider to notify the parents or consult with family 

members with which the patient is living? Should the doctor be mandated to notify the 

other family members that the patient is a "high risk for suicide or other bad outcomes," 

and what to watch out for at home? 

A health care provider's "duty to warn" generally is derived from and defined by standards of 

ethical conduct and state laws and court decisions such as Tarasoffv. Regents o/the University 

o/California.3 HIPAA pennits a covered health care provider to notify an individual's family 

members of a serious and imminent threat to the health or safety of the individual or the public if 

those family members are in a position to lessen or avert the threat. Thus, to the extent that a 

provider detennines that there is a serious and imminent threat of an individual committing 

suicide, HIP AA would permit the provider to warn the appropriate person( s) of the threat, 

consistent with his or her professional ethical obligations and state law requirements. In addition, 

even where danger is not imminent, a covered provider may always communicate with 

individuals' family members, or others involved in the individual's care, to be on watch or 

ensure compliance with medication regimens, as long as the patient does not object to the 

disclosure. 

2 http://v.,,w.hhs.gov/ocr/privacvlhipaalenforcementlindex.html. 

3 http://cn.wikipedia.orglwiki/Regents of the University of California. 

6 
124 


82190.078

The Honorable Bill Cassidy 

Questions 1 & 2: 

Has HHS issued guidance which clearly states how a physician should handle the privacy 

rule when their patient is in a state of psychosis or other form of mental incapacitation? If 

this guidance exists, does it take into account the fact that oftentimes, an individual's 

disease influences them to reject the sharing of their health records, even if it is in their best 

interest? 

Does OCR plan to release sub-regulatory guidance to explaiu-in terms that apply to 

medical professionals-the instances in which an individual's mental illness would 

constitute "incapacity"? If so, when can this guidance be expected and how will you ensure 

it reaches the provider level? 

Section 164.510(b )(3) of the HIPAA Privacy Rule permits covered entities, when an individual 

is not present or is unable to agree or object to a disclosure due to incapacity or emergency 

circumstances, to determine whether disclosing information to the individual's family, friends, or 

others involved in the individual's care, is in the best interests of the individual. 

OCR's HIPAA guidance development efforts are an ongoing and continuous process, and we 

intend to address as part of these efforts the issue of incapacity with respect to individuals who 

have serious mental illness. OCR posts its guidance on its website as it becomes available and 

announces the availability of new guidance to covered entities, business associates, and the 

public through its listserv and at public speaking events. 

Question 3: 

Panelist Carol Levine said that ..• "When family caregivers ask about their patient's care, 

they are routinely told 'I can't tell you because of HIP AA. ' This is not only contrary to the 

law; it is not good clinical care and jeopardizes the patient's well-being." Is there a "public 

friendly" federal government website that addresses these common misinterpretations and 

clarifies the Privacy Rule to which a family member in this situation could direct a 

physician or hospital administrator? If so, is there a strategy or effort to disseminate this 

information? 

OCR has both provider-focused and consumer-focused web-pages and plain-language guides on 

HIPAA and health care providers' interactions with individuals' family members and other care 

givers.4 The consumer guideS encourages individuals to take the guide and discuss it with their 

health care providers and family members and other caregivers. 

4 For example, http;iiwww,hhs,goviocriprivacy/hipaa/understanding/coveredentities/ provider ffg.pdf and 

http;//\\ww.hhs.goviocriprivacyihipaaiunderstanding/consumers/sharing-familv-friends.pdf. 

'http;ii\\ww.hhs.gov/ocr/privacv/hipaaiunderstanding/consumers/consumer ffg.pdf. 

7 
125 


82190.079

In addition, our YouTube channel6 includes a video dedicated to this issue, which has been 

viewed more than 29,000 times. 

Question 4: 

I understand tbat mental bealtb and addiction Electronic Health Records (ERRs) are being 

shut out of state and local Health Information Exchanges (IDEs) because of aggressive 

federal interpretations ofHIPAA and 42 CFR Part 2. As far as I know, Kentucky and 

Rhode Island are tbe only state HIEs in tbe nation tbat actually sbare bebavioral healtb 

ERRs. Can HHS promulgate sub-regulatory guidance tbat will permit tbe sbaring of 

bebavioral bealtb ERRs wit bout changes to HIPAA or Part 2? 

HIEs are quickly integrating into the healthcare landscape, enabling real time access to patient 

health information from multiple sources. However, most HIEs currently do not have the ability 

to exchange behavioral health information in compliance with certain state and Federal privacy 

and confidentiality laws (e.g., state mental health laws, 42 CFR Part 2). The Substance Abuse 

Confidentiality Regulations, 42 CFR Part 2, govern the use and disclosure of patient alcohol and 

drug abuse treatment records. These regulations establish detailed requirements for obtaining 

patient consent when sharing substance abuse treatment information. The exchange of behavioral 

health information within an HIE may be done in compliance with HIPAA without changes to 

the law. While it is possible for behavioral health information to be shared within an HIE 

without changes to Part 2, presently, most HIE systems do not have the capacity to manage the 

consents or to control the redisclosure of select types of information as required. 

HHS has sponsored several promising projects to advance the goal of sharing behavioral health 

information within an HIE. These projects include: the Data Segmentation for Privacy (DS4P) 

Initiative, which is focused on the creation of standards to allow sensitive health information to 

be shared in compliance with confidentiality laws and regulations; a project, sponsored by the 

Substance Abuse and Mental Health Services Administration, funding five state health 

information exchanges (HIEs) to develop local consent policies and a common consent form 

compliant with 42 CFR Part 2; and an ONC-funded Behavioral Health Data Exchange 

Consortium, created to pilot the exchange of behavioral health medical records between 

providers in different states using the Nationwide Health Information Direct protocols. 

Additionally, through a Program Information Notice published on March, 22, 2012, ONC has 

already provided program guidance to state HIEs focused on assuring secure, trusted health 

information exchange. This guidance addresses issues related to individual choice, including 

offering meaningful choice and meeting the requirements of existing law. When considering the 

challenges of exchanging behavioral health information, it is important to also remember that 

state laws playa critical role. In particular, HIPAA only sets a Federal floor for privacy 

protections, and more stringent state laws may provide greater protections to sensitive health 

6 http://\\v,w.\"oulube.comiuser/USGovHHSOCR?fealure=chclk. 

8 
126 


82190.080

infonnation and additional requirements for exchange that must be considered by state HIEs. 

ONe has funded work identifying and classifying these laws. 

Question 5: 

It is the current policy of the OCR, ONC, and SAMHSA to require a patient to sign a new 

consent form every time a new provider joins a Health Information Exchange? In cases of 

serious mental illness, this is often not a practical expectation. Would HHS support, and 

issue guidance, that would permit a patient to opt-iu or opt-ont of sharing their mental 

bealth or addition Electronic Healtb Records (EHRs) in Healtb Information Excbanges 

(HIEs) witbout requiring the patient to sign a new form every time a new provider joins tbe 

HIE? 

A number of laws, both Federal and state, apply to the sharing of health records related to mental 

health and substance abuse treatment, including 42 CFR Part 2, which specifically relates to 

Federally-funded substance abuse treatment programs. Patient consent under 42 CFR Part 2 is 

meant to be infonned, a key factor of which is the ability of the patient to know and understand 

at the time of providing consent - precisely to whom he or she is giving authorization for access. 

Because it is impossible to anticipate future providers who may join an exchange, and equally 

impossible to predict future concerns a patient may have regarding his or her health record, 

pennitting a patient to opt-in or opt-out indefinitely of having substance abuse treatment records 

included in an exchange may violate these important infonned consent principles. SAMHSA has 

published two sets offrequently asked questions addressing consent and other issues.7 

1 Available at http;/!www.samhsa.govlhealthPrivacyidocsIEHR-FAOs.pdfand 

http://www.samhsa.gov/aboutilawsISAMHSA 42CFRPART2FAOll Revised.pdf. 

9 
127 


82190.081

The Honorable G. K. Butterfield 

Question 1: 

It is my understanding that health care providers covered by the HIPAA "Privacy Rule", 

must notify patients if the privacy of their health information is breached. What methods 

are used to notify those individuals? How does the Office for Civil Rights (OCR) enS\lre 

that health care providers are complying with the HIPAA "Privacy Rule"? What steps can 

individuals take if their health care record privacy has been compromised? 

Covered entities must notifY affected individuals of a breach of their unsecured protected health 

information without unreasonable delay and in no case later than 60 days following discovery of 

the breach. Covered entities must provide this individual notice in written form by first-class 

mail, or alternatively, bye-mail if the affected individual has agreed to receive such notices 

electronically. The individual notification must include, to the extent possible, a description of 

the breach, a description of the types of information that were involved in the breach, the steps 

affected individuals should take to protect themselves from potential harm, a brief description of 

what the covered entity is doing to investigate the breach, mitigate the harm, and prevent further 

breaches, as well as contact information for the covered entity. 

For breaches affecting more than 500 residents of a state or jurisdiction, HIPAA also requires a 

covered entity to notifY prominent media within the state or jurisdiction. 

In addition to notifYing affected individuals and the media (where appropriate), covered entities 

must notifY the Secretary of breaches of unsecured protected health information by visiting the 

HHS website and filling out and electronically submitting a breach report form. OCR reviews 

and verifies the breach reports received, and, where appropriate, investigates underlying 

compliance issues that may have contributed to the breach and whether breach notification 

requirements were complied with. In accordance with a HITECH Act requirement, OCR posts 

information on our website about all breaches affecting 500 or more individuals. This informs 

the public and covered entities of specific instances of significant breaches and highlights 

organizational vulnerabilities that may lead to breaches of information. 

Individuals may submit complaints for investigation by OCR if they are concerned that their 

health information has been impermissibly accessed or misused. In addition, the Federal Trade 

Commission (FTC) has information on its identity theft web pages about actions that individuals 

can take if they believe fraud was committed with their information.s 

Questiou 2: 

8 http://v.,\w.consumer.ftc.gov/articles/0326-medical-id-theft-health-intormation-older-peoplc. 

10 
128 


82190.082

If a patient objects to sharing information with certain family members or friends, is the 

provider able to communicate that request to other providers who may also treat the 

patient? 

Providers within the same legal entity or treatment setting are able to communicate regarding a 

patient's wishes in this regard, to ensure compliance by the covered entity with those wishes and 

thus, the Privacy Rule. With respect to other providers who may treat the patient, it is the right 

of the individual to agree or object to these other providers sharing information with his or her 

friends and family members. 

11 
129 


82190.083

The Honorable John D. Dingen 

Question 1: 

Does current law prohibit people who are involuntarily committed to a mental institution 

or otherwise formally adjudicated as having a serious mental condition from owning a 

firearm? 

The Gun Control Act of 1968, Pub. L. 90-618, as amended, prohibits persons who have been 

committed to a mental institution, and individuals adjudicated by a court, board, commission, or 

other lawful authority as having a serious mental condition that causes them to pose a danger to 

themselves or others or renders them incapable of managing their own affairs, from shipping, 

transporting, receiving, or possessing firearms or ammunition. 

The regulation, at 27 CFR 478.11, defines "committed to a mental institution" as: A formal 

commitment of a person to a mental institution by a court, board, commission, or other lawful 

authority. The term includes a commitment to a mental institution involuntarily, commitment for 

mental defectiveness or mental illness, as well as commitments for other reasons, such as for 

drug use. The term does not include a person in a mental institution for observation or a 

voluntary admission to a mental institution. 

Question 2: 

Are states required to upload mental health records into NICS so individuals who are 

prohibited from owning a firearm do not have access to them? 

As with all of the categories of prohibited persons under the Gun Control Act, states can but are 

not required to make available to the NICS the identifYing information for people prohibited 

from possessing a firearm for certain mental health reasons. Federal law encourages state 

reporting through various incentives, and some states have statutes requiring certain entities 

within the state to make this information available to the NICS. 

It is important to note, however, that the NICS never has mental health records. States report 

only the names of ineligible individuals (among those prohibited are individuals who have been 

committed to a mental institution and individuals adjudicated by a court, board, commission, or 

other lawful authority as having a serious mental condition that causes them to pose a danger to 

themselves or others or being incapable of managing their own affairs) and certain other 

identifYing information, such as their dates of birth, as well as codes identifYing the submitting 

entity and the prohibited category that applies to the individual. The NICS system never 

includes information on diagnosis, treatment, or other health records. 

12 
130 


82190.084

Question 3: 

Current law provides for an exception to the HIP AA privacy rule for certain law 

enforcement purposes. Do you believe this exception permits states to report mental health 

records to NICS? 

No. As described below, there are other provisions that may allow for the reporting to the NICS 

of identifying information for people prohibited from possessing a fireann for certain mental 

health reasons, but the HIPAA Privacy Rule's law enforcement provisions (at 45 CFR 

164.512(f)) would not pennit the disclosure because the purpose of the disclosure would not be 

related to a specific law enforcement inquiry. 

There are other Privacy Rule provisions that may apply and allow the disclosure, depending on 

the circumstances. Specifically, the Privacy Rule would allow the disclosure to the extent that a 

state has enacted a law requiring the disclosure. Alternatively, where there is no state law 

requiring reporting, the Privacy Rule would allow the disclosure to the extent the entity had 

designated itself a hybrid entity and separated its NICS reporting unit from its health care 

component(s), in which case the entity could report infonnation through the non-HIPAA-covered 

NICS reporting unit which would not then be subject to disclosure restrictions under the Privacy 

Rule. 

On April 23, 2013, OCR issued an ANPRM seeking comment from states and the public 

regarding barriers that HIPAA may pose to NICS reporting. Through this process, we hope to 

learn more about the nature and extent of any HIP AA barriers to reporting by the states. The 

comment period will end on June 7, 2013. 

Question 4: 

Do you believe states need to pass their own laws to explicitly permit mental health 

reporting to NICS if the privacy rule is amended in the manner described in the Advanced 

Notice of Proposed Rulemaking? 

It is our understanding that some states have health infonnation privacy restrictions in place that 

are more stringent than HIPAA. To the extent that is the case, if the Privacy Rule were changed 

to expressly pennit certain covered entities to report identifying infonnation about people 

prohibited from possessing a fireann for certain mental health reasons to the NICS under 

HIPAA, entities in some states still may face state law barriers to reporting such infonnation. We 

hope to learn more from public feedback we receive in response to our Advance Notice of 

Proposed Rulemaking (ANPRM) on HIPAA and NICS reporting, in which we requested 

comments on any HIP AA and non-HIP AA barriers states face in reporting certain infonnation to 

the NICS. The comment period will end June 7, 2013. 

13 
131 


82190.085

May 13,2013 

Mr. Mark A. Rothstein 

! ferbert F. Roehl Chair of Law and \,1cdicinc 

Director. Institute lor Biocthics. Health Policy and Law 

University of Louisville School of Medicine 

50 I East Broadway #3 1 0 

Louisville. KY 40202 

Dcar Mr. Rothstein: 

Thank you for appearing before the Subcommittee on Oversight and Investigations on Friday, 

April 26, 2013. to testify at the hearing entitled. "Does HlPAA Iklp or Ilinder Patient Care and Public 

Salely?" 

Pursuant to the Rules of the Committee on Energy and Commerce. the hearing record remains 

open f(lr ten husiness days 10 permit Members to submit additional questions for the record. which are 

attached. The 1(>rIllat ofyollr responses to these questions should be as follows: (I) the name ofthe 

I",kmber whose question you arc addressing. (2) the complete text of the question you arc addressing in 

bold, and (3) your answer to thm question in plain text. 

To ra~ilitatc the printing oCthe hearing record. please respond to these questions hy the close of 

business on Tuesday. Ma)' 28. 2013. Your responses should be ,,-mailed to the Legislative Clerk in Word 

fonnat at hrittanv.ha'\'ens:-a'nlaiI.housc~gov and mai led to Brittany Havc-ns. Legislative Clerk. 

Committee on Energy and Commerce, 2125 Rayburn lIollse omce Building, Washington. D.C. 20515. 

Thank you again lor YOllr time and errort preparing and deli,ering testimony before the 

Subcommittee. 

Sincerely, 

Tim ~l11rphy 

Chairman 

Subcommittee on Oversight and Investigations 

cc: Diana DeGette. Rankinp; Member. Subcommittee on O\'cr~ight and Investigations 

Attachment 
132 


82190.086

Written testimony of Mark A. Rothstein 

The Honorable Tim Murphy 

1. In your testimony, you recommend that in order to advance health privacy and 

public health and safety, redrafting some ofthe public purpose exceptions to the privacy 

rule to make them more explicit would make sense. Can you please explain how your 

recommendation could be implemented? 

Several of the Privacy Rule's 12 public purpose exceptions, 45 C.F.R. § 164.512, do not 

provide adequate detail to apprise covered entities about the permissible uses and disclosures of 

protected health information (PHI). Perhaps the best example is the provision permitting uses 

and disclosures of PHI "to avert a serious threat to health or safety," which plays a central role in 

the disclosure of mental health information. The regulation, 45 C.F.R. § 164.5120), provides, in 

pertinent part: 

G) Standard: uses and disclosures to avert a serious 

threat to health or safety. 

(1) Permitted disclosures. A covered entity may, 

consistent with applicable law and standards of ethical 

conduct, use or disclose protected health information, if the 

covered entity, in good faith, believes the use or disclosure: 

(i)(A) Is necessary to prevent or lessen a serious and 

imminent threat to the health or safety of a person or the 

public; and 

(B) Is to a person or persons reasonably able to prevent 

or lessen the threat, including the target of the threat ... 

This section of the Privacy Rule is related to the Tarasoffduty to warn imposed on 

mental health professionals. (Tarasoffv. Regents of the University of California, 551 P.2d 334 

(Cal. I 976))Yet, there is no single Tarasoffduty to warn, but 50 different jurisdiction-specific 

duties and various provisions contained in professional codes of ethics. According to the 

National Conference of State Legislatures, 29 states have laws mandating the reporting of serious 

threats, 16 states have permissive reporting laws, 4 states have no duty to report, and 1 state is 

listed as "other." (www.ncsl.orgfissues-researchfhealthfmental-health-professionals-duty-towarn.aspx) Other provisions of state laws vary widely. For example, some states apply different 
133 


82190.087

Written testimony of Mark A. Rothstein 

standards to different professionals (e.g., psychologists, social workers); other states differ on the 

circumstances when warnings are appropriate or vary in the individuals or entities that must be 

warned; and some states have immunity provisions if certain statutory requirements are 

followed. Consequently, the average person reading the applicable Privacy Rule provision would 

have no idea whether there was a privilege to breach confidentiality and/or a duty to warn 

without consulting a lawyer with special knowledge of the Privacy Rule and the particular state's 

privacy and duty-to-warn laws. 

Even though it was not intended by either Congress in the HIP AA statute or the 

Department of Health and Human Services (HHS) in its rulemaking, the Privacy Rule has 

become the de/acto legal standard for health privacy throughout the U.S. Accordingly, it is not 

good enough to have a series of broadly worded, "permissive" public purpose exceptions in the 

Privacy Rule. It is not good enough to say that disclosures are permitted, "consistent with 

applicable law and standards of ethical conduct," when these other sources of disclosure 

obligations are often indecipherable. It is especially not good enough to have a vague and 

inconsistent legal standard applied to serious threats to public health or safety. A reasonable, 

uniform, national standard should be adopted and implemented. 

From a legal standpoint, achieving a national standard is a complex problem, but not an 

insoluble one. The Privacy Rule provision on averting a serious risk to health or safety, 45 

C.F.R. 164.5120), combines two related issues. The first issue is raised explicitly by this part of 

the Privacy Rule: When is it permissible under the Privacy Rule for a health care provider to 

breach confidentiality and disclose PHI to avert a serious threat to health or safety? The second 

issue is raised implicitly by this section of the Privacy Rule: When does a health care provider 

have an affirmative duty to act to avert a serious threat to health or safety, the so-called "duty to 

warn"? The Privacy Rule's lack of specificity and its policy of deferring to "applicable law and 

standards of ethical conduct" serve to conflate the issues of breaching confidentiality and duty to 

warn; it also mixes federal and state law with professional standards to create an unintelligible 

morass. Most tragically, because of this confusion some uninformed and risk-averse mental 

health care providers may be reluctant to invoke their privilege to breach confidentiality and to 

exercise their duty to warn. Such reticence could result in the failure to prevent a life-threatening 

situation. 

2 
134 


82190.088

Written testimony of Mark A. Rothstein 

A helpful way of analyzing the problem is to view the two issues (breaching 

confidentiality and duty to warn) separately -- at least initially. For reasons of federalism, 

Congress may not want to enact legislation establishing a national standard for the duty to warn 

because it involves matters traditionally within the purview of the states. Similarly, because the 

statutory language in HIPAA only grants HHS limited regulatory powers, HHS would be unable 

to set a national standard for the duty to warn through rulemaking. Nonetheless, it is possible to 

achieve the goal of national uniformity for both breaching confidentiality and the duty to warn 

indirectly by utilizing existing federal legislation and a two-step process of harmonization. 

First, HHS clearly has the statutory authority to establish rules for when it is permissible 

under the Privacy Rule for a covered entity to breach confidentiality to avert a serious threat to 

health or safety. Indeed, HHS already has promUlgated such a rule, 45 C.F.R. § 164.5120), but it 

needs to be amended. After considering the views of all stakeholders, HHS should amend the 

current regulation and promulgate an explicit and detailed new regulation providing, for 

example, that when a psychotherapist or other provider of mental health services makes a 

reasonable determination that a patient or client constitutes a threat to cause death or serious 

harm to one's self or another, the provider is permitted, under the Privacy Rule, to disclose PHI 

to law enforcement personnel, any intended victim or victims, or others who are in a position to 

avert the harm. HHS should delete the reference to "applicable law and standards of ethical 

conduct" because it is the source of inconsistency and confusion. 

Amendment of the HIPAA Privacy Rule should be accompanied by comprehensive 

guidance and specific examples. HHS also should work with professional associations, state and 

local governments, nongovernmental organizations, and consumer groups to provide meaningful 

notice and information about the amended regulation. The new, presumably more understandable 

and practical regulation would replace the current regulation. 

The second step would involve the states. As noted earlier, the amended regulation would 

not expressly address the issue of when a health care provider has an affirmative duty to warn. At 

least initially, the duty to warn would remain a matter of state law, especially with regard to tort 

liability. Nevertheless, after a new Privacy Rule provision is promulgated with widespread input, 

3 
135 


82190.089

Written testimony of Mark A. Rothstein 

it is foreseeable that many states would move to harmonize their laws with a reasonable and 

uniform federal regulatory standard. State legislative initiatives to coordinate with the federal 

regulation are likely to receive strong support from mental health professionals, consumer 

groups, and the public, because having reasonable and uniform federal and state laws is not only 

easier for all affected individuals to understand, it is likely to prevent serious risks to safety and 

thereby save lives. 

At the same time the Privacy Rule is amended, all other federal laws and regulations 

dealing with the disclosure of mental health information and the duty to warn should be 

amended, as needed, to achieve consistency. Of particular importance is the Family Educational 

Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g, and the implementing regulations issued 

by the Department of Education, 34 C.F.R. Part 99. FERPA applies to most public and private 

postsecondary institutions and to the health records of students at campus health clinics. The 

FERPA regulations provide: "An educational agency or institution may disclose personally 

identifiable information from an education record to appropriate parties, including parents of an 

eligible student, in connection with an emergency if knowledge of the information is necessary 

to protect the health or safety of the student or other individuals." This permissive provision is 

broadly worded and, unlike the analogous HIPAA Privacy Rule provision, does not require a 

"serious and imminent threat." [The issue of "imminent threat" is further discussed in the answer 

to Representative Cassidy's question.] The divergence of the standards for disclosure of 

confidential information under FERPA and HIPAA further underscores the need for 

harmonization. 

As discussed in my testimony on April 26, 2013, individual health as well as public 

health and safety are advanced by maintaining strong protections for the privacy and 

confidentiality of mental health information. At the same time, for the small number of 

individuals with severe mental illness who constitute a serious threat to self or others, it is 

essential to have legal standards for health information disclosure that are reasonable, uniform, 

well understood, and consistently followed. Amending and clarifying the Privacy Rule is the first 

step in harmonizing federal and state disclosure laws. Coordinated federal and state efforts 

represent the best chance to reduce the risk of tragic violence while preserving the confidentiality 

upon which timely and effective mental health treatment depends. 

4 
136 


82190.090

Written testimony of Mark A. Rothstein 

The Honorable Bill Cassidy 

1. It seems to me that one of the biggest questions in a doctor's mind when dealing 

with a patient with a serious mental illness is whether a threat is not only serious, but also 

"imminent." As countless families have told us, their children were seen by mental health 

professionals but they were released without information to the parent, seemingly because 

the doctor detected no imminent threat. Language, including regulations issued in regard 

to the NICS background check system, do not say "serious and imminent" threat, but only 

"serious threat." Knowing that IDPAA serves only as a floor for privacy laws (added onto 

by state laws, etc.), do you believe there would be a negative effect of removing the 

imminent requirement? 

The requirement of an imminent threat appears in the HIPAA Privacy Rule, 45 C.F.R. § 

164.5120)(1 )(i)(A), which indicates when it is permissible for a covered entity to breach 

confidentiality and disclose PHI "to avert a serious threat to health or safety." HHS should 

amend the Privacy Rule to remove "imminent" from the regulation, because imminence is such a 

high standard that mental health providers might believe that even a deeply troubled and 

dangerous person did not expressly indicate that he or she was planning to take imminent action 

to harm themselves or others. Removing the "imminent" threat language in the Privacy Rule, 

however, would not resolve the underlying problem of inconsistent standards. 

Interestingly, the Tarasoff decision does not use the word "imminent" to describe the type 

ofthreat giving rise to a mental health provider's duty to warn, but many state laws enacted after 

Tarasoffuse this language. According to the National Conference of State Legislatures, 17 states 

and the District of Columbia require that, to establish a duty to warn, a threat must be 

"imminent" or "immediate." The other states either do not limit the duty to warn based on the 

imminence of the threat or do not recognize any duty to warn. 

Professional codes of eth ics do not require that a threat be imminent before mental health 

information should or may be disclosed. The American Medical Association (AMA) Code of 

Medical Ethics, § 5.05, which applies to all physicians and not merely psychiatrists, provides: 

"When a patient threatens to inflict serious physical harm to another person or to himself or 

herself and there is a reasonable probability that the patient may carry out the threat, the 

physician should take reasonable precautions for the protection of the intended victim, which 

5 
137 


82190.091

Written testimony of Mark A. Rothstein 

may include notification oflaw enforcement authorities." Thus, according to the AMA, 

whenever there is a serious threat, a physician should take action. By contrast, the codes of ethics 

of mental health specialists are less proscriptive and stringent; they address only disclosure of 

mental health information and they make disclosure permissive. The American Psychological 

Association's Ethical Principles of Psychologists and Code of Conduct § 4.05(b)(3) provides that 

disclosure of confidential information is permitted to "protect the client/patient, psychologist, or 

others from harm." Similarly, the American Psychiatric Association's Principles of Medical 

Ethics, § 4, pI. 8, provides: "When, in the clinical judgment of the treating psychiatrist, the risk 

of danger is deemed to be significant, the psychiatrist may reveal confidential information 

disclosed by the patient." 

Amending the Privacy Rule to remove the imminent threat requirement would permit a 

wider range of disclosures, but it would not establish a duty to warn. It also would create a 

conflict between the amended Privacy Rule and 17 state laws. This situation further illustrates 

the importance of developing a uniform, national standard, as described in the answer to 

Chairman Murphy's question. 

The Honorable Bruce Braley 

L What have we learned from experiences as we move forward and try to create a 

balanced system that is protecting the public and rights of the patients to get the best 

possible treatment, when obviously we have been failing them? What can we do about 

that? 

Public policy on mental health treatment needs to pursue the following three objectives: 

(1) provide prompt, high quality, comprehensive, and continuing mental health treatment for all 

who need it; (2) maintain the confidentiality of mental health information disclosed within 

treatment, because without confidentiality many individuals needing mental health treatment will 

be deterred from seeking it; and (3) in the unusual situation where a mental health patient 

constitutes a serious threat to self or others, the mental health professional should understand it is 

not only permissible to breach confidentiality, but there is an affirmative duty to warn in 

accordance with a clearly articulated, well understood, reasonable, uniform, national standard. 

6 
138 


82190.092

Written testimony of Mark A. Rothstein 

The Honorable G.K. Bntterfield 

1. Can you please describe how the new program of public and health care provider 

education and outreach suggested by the National Committee on Vital and Health Statistics 

could improve patient awareness of their rights to privacy? 

First, in the interest offul! disclosure, I was a member of the National Committee on 

Vital and Health Statistics (NCVHS) in 2002 when the recommendation for greater education 

and outreach was first made to the Secretary ofHHS. I supported the committee 

recommendations then, and I believe the recommendations are even more important now. 

The HIPAA Privacy Rule has become largely irrelevant for a large percentage of patients. 

Under the Privacy Rule, patient consent is not required for uses and disclosures of PHI for 

treatment, payment, or health care operations. Instead, notice is required. Covered entities are 

required to provide individuals with a Notice of Privacy Practices, 45 C.F.R. § 164.520(a), and 

health care providers with a direct treatment relationship must make a good faith effort to obtain 

the individual's acknowledgement of receipt of the notice, 45 C.F.R. § 164.S20(c)(2)(ii). In 

practice, the HIP AA notices are so long and detailed that patients typically do not read them if 

they are given them; sometimes individuals are asked to sign an acknowledgement that they 

received the notice when they never were given one, and in other instances they are asked to sign 

a statement saying they declined the offer of a notice. 

The current system of only sometimes providing patients with a Notice of Privacy 

Practices -- and having patients who receive them rarely read and understand them -- may do 

more harm than good by making it seem as if the HIPAA Privacy Rule is a meaningless 

paperwork requirement with little or no value to the individual patient. The typical patient's 

unenlightening initial encounter with the Privacy Rule could be easily changed by requiring 

covered entities to provide patients with a one-page, clearly written summary of patient rights 

under the Privacy Rule, including such items as the right to view their health record, the right to 

copy their health record at no cost, the right to request restrictions on disclosures of their PHI, 

the right to opt-out of a hospital's directory, the right to file a complaint with the Office for Civil 

Rights, etc. Although these rights are now included in the detailed Notice of Privacy Practices, 

they are largely inaccessible to patients because of all the other provisions in the Notice of 

Privacy Practices. Patient rights are meaningless if patients do not know oftheir existence. 

7 
139 


82190.093

Written testimony of Mark A. Rothstein 

The Privacy Rule was not intended to be merely a set of regulations for disclosures of 

PHI in the payment chain ofthe health care industry. By default, it has become the nation's only 

broadly applicable health privacy law, and that means HHS has a significant responsibility to the 

public. This responsibility includes making a greater commitment to provide high quality public 

and professional education, such as producing on-line tutorials and training materials for health 

professionals and consumer-oriented health privacy materials in a variety of media. HHS also 

should establish a robust research program to assess the strengths, weaknesses, and effects of the 

Privacy Rule, which can be used to guide further amendments and clarifications. In 2003, the 

NCVHS recommended that HHS establish a program to conduct ongoing research on the Privacy 

Rule. (National Committee on Vital and Health Statistics, Letter to Secretary Tommy G. 

Thompson, June 25, 2003, www.ncvhs.hhs.gov/030625l3h) Ten years later, when the nation's 

health care system is undergoing major changes, it is hard to understand why there has been no 

systematic effort to study the effects of the health privacy law applicable to the overwhelming 

majority of health care providers and patients in the nation. 

8 
140 


82190.094

:vlay 

0,.. Richard Martini 

Dear 

Thank you for appearing hefore the Suhcolll1niHec on Oversight and Invcstigations on Friday. 

/\pril 26. 2013, !e:itil~' at the entitled, --noes HlpAA Heir or! tinder Patient Care and Public 

Safely'!" 

ThanK 

Suh;.:ommiuct:, 

again fijI' Y'ow' time 

headng record remains 

for the rcezwd, which are 

as follows: ( I ) the name of the 

complete lex! of the question you are addressing in 

!ext 

respond 10 these qlle:itions by the dl'se of 

c·mailed the Clerk ill Word 

Clcrk, 

WaSllil1g1nn. f),C 205!), 

preparing and delivering bclon: the 

Sincerely, 

Subcommittee on Oversight and Invesligations 

Diana Dencttc. Ranking Member. Suhcommittee on Oversight and Jm;c,W"BlJotls 

A!tachmciit 
141 


82190.095

UNIVERSITY OF UTAH 

HEALTH CARE 

May 28,2013 

Brittany Havens 

Legislative Clerk 

Committee on Energy and Commerce 

2125 Rayburn House Office Building 

Washington, D. C. 20515 

RE: Subcommittee on Oversight and Investigations 

Hearing "Does HIPAA Help or Hinder Patient Care and Public Safety?" 

Questions 

Ms. Havens: 

I included responses to the questions posed by Congressman Murphy and hope his concerns are 

adequately addressed in the content. Please let him know it is an honor and a pleasure to assist him in 

this process, and I am available should he have any additional questions or opportunities where I can be 

of service. 

1. Why do you think there are so many misconceptions about HIPAA? Do you think more training 

would help dispel the myths that many health workers have about the law? Whose 

responsibility is it to dispel these myths and clarify the privacy rule? 

The misconceptions about HIPAA are a product of the methods chosen by organizations to 

disseminate and enforce the regulations. The United States government makes information 

available to the public on websites and through a variety of announcements, but it is large 

health care programs that interpret the material and work to apply it to routine practice. The 

individual clinician, whether in solo, group, or medical center based practices, frequently 

receives information about HIPAA through this filter. The intent of the regulations is well 

understood and supported by most if not all clinicians. However, the administration in local 

medical organizations tends to focus on the consequences of non-compliance, in part because 

of the substantial fines that can be imposed and the adverse publicity that results when 

violations are discovered. As a result, education programs tend to convey a message that HIPAA 

not only contains guidelines that are essential for patient privacy and confidentiality, but also 

that non-compliance risks substantial penalties forthe organization and, both directly and 

indirectly, for the individual involved. The sense in efforts at communication and monitoring is 

"if we're in trouble, you're in trouble." As a result, clinicians see HIPAA as being imposed on 

them by large and powerful forces, with little or no opportunity for them to provide feedback or 

suggestions for change. There is minimal investment in carefully reviewing or critiquing the 

content for local or national organizations, and misconceptions of the law easily develop. 

The solution is not simply more training for more individuals, but a different approach to 

training, one that works to apply the law to a variety of clinical situations and conveys a message 

that enforcement is a work in progress. Physicians and a variety of medical professionals and 

organizations should continue to provide feedback through local HHS agencies on clinical 
142 


82190.096

situations where the law adversely affects the best interests of the patient. Information can be 

shared in writing, through formal meetings, through the creation of webinars, and through a 

variety of electronic media. Clinicians can also enable families and caregivers who feel excluded 

by provisions of the law and less able to care and support loved ones to have a voice in the 

process. Although each patient's story is somewhat unique, there can be common threads that 

convey a powerful message on the potential risks and consequences of the law. Encouraging 

this dialogue enhances the skills of the clinician and educates government agencies on the 

practical application of HIPAA. It also empowers people to make necessary change. 

2. Do you have any thoughts on how well HHS has communicated with the health profession? Do 

you think HHS needs to dialogue more with doctors and professional associations? What would 

this dialogue look like. 

Responsibility begins with the Federal Government and HHS conveying a sense of greater 

openness and collaboration around the content and enforcement of HIPAA. It is then up to 

professional organizations in medicine, hospital administration, and clinical care to respond and 

encourage members to participate. These efforts can be national, local, or based within the 

operation of each clinical practice. The individual providing care can best advocate for the 

patient and the family, and shares an obligation to work in their best interests. 

The focus of communication by HHS is on an understanding of the law, why it is important, and 

how it will be applied. A great deal of information is available on government websites and in a 

variety of publications. However, the federal government has abdicated much of the 

responsibility for education to local patient care organizations, frequently university-based or 

corporate-based health care programs with large staffs who are at the greatest risk for a HIPAA 

violation. At times the intent of the law is lost in the need to conform to expectations for fear 

of consequences. HHS should have a more direct line to those individuals caring for debilitated 

and challenging patients and struggling to comply with HIPAA regulations. This should be an 

active and evolving process with HHS constantly reviewing the content and application of the 

law and recognizing that, as in health care, there is still much to learn. 

Sincerely, 

lJ<::\"cJAVl4kCv1~<D 

D. Richard Martini, M.D. 

Chief - Division of Behavioral Health 

Department of Pediatrics 

Chair - Department of Psychiatry and Behavioral Health 

Medical Director - Behavioral Health Services 

Primary Children's Medical Center 

Professor of Pediatrics and Psychiatry 

University of Utah School of Medicine 

Department of Psychiatry and Behavioral Health - Primary Children's Medical Center 

Division of Behavioral Health 

100 N Mario Capecchi Dr 

Salt Lake City, Utah 84113 

Pediatric Behavioral Health 

Outpatient Clinic 

675 E 500 S, Suite 300 

Salt Lak.e City, Utah 84012 

Wasatch Canyons Campus 

5770 S 1500 W. Bldg. 

Salt Lake City, Utah 84123 
143 


82190.097

Ms, Deven :'>1cGraw 

Director Grthe Ilcalth Privacy Project 

Center Ihr Ix:mocracy and Technology 

16341 Street. \I,W, #1100 

Washington. D,C, 20006 

Dear Ms, McGraw: 

'VIal' 13,2013 

Thank you for appearing bclore the Subcommittee on Oversight and Investigations on Friday, 

i\pril26, 2013. to testil\, at the hearing entitled, "Does HIPAi\ lIelp or Hinder Patient Care and Public 

Sakt)''!'' 

Pursuant to the Rules of the COllllllittee on Energy and Commerce, the hearing record remains 

oren Illr ten business days to pemlit 'VIembers to submit additional questions for the record. which arc 

attached. The lormat of your responses to these questions should b<' as Ihllow;;: (I) the name of the 

:'>1cmbcr whose question you are addressing, (2) the complete text of the question you are addressing in 

hold, and (3) your answcr to that question in plain text. 

ro fllcilit3lc the printing of till' hearing record, please respond to these questions by thc close of 

business on Tuesday, 'VIal' 28. 2013, Your respunses should bc e-mailed to the Legislative Clerk in Word 

lortna! at hritlanv.havens«<'mail.house,gov and mailed to Brittany Havens, Legislative Clerk, 

Committee on Energy and Commerce. 2125 Rayburn House Office Building, Washington, J),c' 10515, 

Thank you again for your time and effort preparing and delivering testimony before the 

Subcommittee. 

Sincerely, 

rim \1urphy 

Chairman 

Subcommittee on Oversight and Investigations 

cc: Diana DeGettc. Ranking Member, Subcommittee on Oversight and Investigations 

Alwcilmcnt 
144 


82190.098

May 28,2013 

Responses to Questions on the Record 

Hearing of April 26, 2013, entitled: 

"Does HIPAA Help or Hinder Patient Care and Public Safety" 

Subcommittee on Oversight and Investigations, Committee on Energy & Commerce 

Thank you again for the opportunity to testify at the hearing. I offer the following 

responses to questions for the record asked of me by Chairman Murphy and 

Representative Butterfield: 

The Honorable Tim Murphy 

1. You have said that HIPAA has been "badly mangled." What can be done to clarify 

the law? Do we need new legislative language? Do we need some clarification from 

the Office for Civil Rights? More public education? Please share with us your specific 

recommendations. 

The HIPAA Privacy Rule provides an important set of "guardrails" with respect to how 

health care providers and health plans can access and disclose sensitive a patient's 

identifiable health information. However, the Rule also recognizes that routine access 

and sharing of health data is critical to patient care and public health. Consequently, 

the Rule expressly permits the sharing of patient data - without constraints - for a 

number of important purposes, including treatment, for public health reporting, and for 

certain law enforcement purposes. 

As I pointed out in both my written and oral testimony, the HIPAA Privacy Rule allows 

HIPAA covered entities (e.g., health care providers and health plans) to use or share 

information to avert a serious threat to health or safety. 1 In addition, the Rule also 

1 Specifically, a covered entity may, "consistent with applicable law and standards of ethical conduct, use 

or disclose protected health information if [it], in good faith, believes the use or disclosure is necessary to 

prevent or lessen a serious and imminent threat to the health or safety of a person or the public; and [the 

use or disclosure] is to a person or persons reasonably able to prevent or lessen the threat, including the 

target of the threat." 45 C.F.R. 5120). Entities are expressly presumed to be acting in good faith if they 

are acting based on actual knowiedge "or in reliance on a credible representation by a person with 

apparent knowledge or authority." 45 C.F.R. 5120)(4). On January 15, 2013, the HHS Office for Civil 

Rights issued a two-page, to-the-point letter to hea~h care providers alerting them to this exception, in the 

hope of dispelling widespread myths that HIPAA does not permit such disclosures. 

http://www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/righttoaccessmemo.pdf. 
145 


82190.099

allows covered entities to share a patient's information with someone who is involved in 

that patient's care or who is paying for that care - such as a family member, relative or 

close personal friend - unless the patient has objected to such sharing. 2 

However, we know from the testimony shared by family members at the hearing, and I 

know anecdotally from my own experience, both as a patient and as the Director of the 

Health Privacy Project, that covered entities too often interpret HIPAA to prohibit sharing 

of patient information, even in circumstances where the regulations clearly allow such 

sharing. 

At the hearing, I used the term "badly mangled" to describe this over-interpretation of 

HIPAA. 

The regulators (at the federal level, the Office for Civil Rights; at the state level, a state 

Attorney General) have no authority to penalize such over-interpretation, even though it 

frequently has real consequences for patients and their families. The Privacy Rule 

expressly allows entities to share patient information in these circumstances, but it does 

not require them to do so. 

The HHS Office for Civil Rights has issued guidance on the provisions regarding 

sharing with family members, and that guidance is more clear and with less "legalese" 

than the regulatory texta However, I do not think most providers or patients know this 

guidance exists. In addition, the guidance could be more comprehensive, and cover 

"frequently asked questions" and offer responses to specific factual scenarios, so 

entities have a more clear picture of what they can - and cannot - do under the law. At 

the hearing, Leon Rodriguez, the Director of the Office for Civil Rights, addressed a 

number of questions about an entity's ability to disclose information to family members 

in the event of a patient's "incapacity." The details he offered were more 

comprehensive than anything that I have seen in previous guidance on that aspect of 

the Rule. Those details should be part of more comprehensive information about the 

Rule that is more easily accessible and broadly disseminated to the provider and patient 

community. 

I suggest that the Office for Civil Rights develop and more broadly disseminate 

guidance on both of these provisions. With respect to the provisions permitting 

disclosures to family members, the Office should work with provider and patient 

and family organizations both respect to developing the content of this guidance 

and in ensuring it is broadly disseminated. 

Here's another idea: The Office could establish a mechanism for gathering and 

affirmatively responding to complaints about over-interpretation of the HIPAA Privacy 

Rule. Such over-interpretations are not violations of HIPAA, but the Office could 

nevertheless be part of the solution through timely advice to entities of disclosures that 

are permitted. The Office also could routinely blog about such complaints -and the 

245 C.F.R. 510(b). 

3 htlp:llwww.hhs.gov/ocr/privacy/hipaa/underslanding/coveredentities/provider ffg.pdf. 
146 


82190.100

proper interpretation of HIPAA in the circumstances in question - in a way that does not 

reveal the name of the entity in question as another mechanism for educating the 

public. 

These suggestions do not require legislative action. 

2. In your written statement you referenced a 2007 poll showing that 17 percent, or one 

in six adults, say they withhold information from their health providers due to worries 

about how the medical data may be disclosed. Are you aware of any studies that ask 

this question specifically with regard to the sharing of personal mental health 

information? 

The statistic from my written statement is from general survey data, and you are correct 

that it does not focus on mental health information. We appreciate the additional time to 

find studies specifically addressing concerns about confidentiality and mental health 

information. Not surprisingly, general surveys of persons with mental health disorders 

are difficult to find (and we suspect confidentiality concerns among this population may 

be a reason why such surveys are so rare). Nevertheless, we were able to locate 

additional research on mental health and the need for confidentiality, and links to that 

additional research are attached to this response. 

As further evidence of a widespread recognition of the need for confidentiality in mental 

health treatment, as of 2002 50 states (including the District of Columbia and excluding 

Arkansas) had specific statutes related to some aspect of mental health privacy.4 Such 

privacy laws are not preempted by HIPAA if they provide stronger protections for mental 

health data. 

The Honorable G.K. Butterfield 

1. Patients' rights to access psychotherapy notes are restricted more than other types 

of health records. Can you please explain what sort of access individuals have to that 

information? What happens if the patient believes the information to be inaccurate? 

As I noted in my written statement, the Privacy Rule provides additional protections for 

psychotherapy notes. The term "psychotherapy notes" is defined as the personal notes 

4 Beckerman, J et al., "Health Information Privacy, Patient Safety, and Health Care Quality: Issues and 

challenges in the Context of Treatment for Mental Health and Substance Abuse," BNA's Hea~h Care 

Policy Report, vol. 16, No.2 (January 14, 2008). This article includes a comprehensive discussion of 

HIPAA's provisions regarding "preemption." 
147 


82190.101

of a mental health professional taken during a counseling or therapy session. 5 Entities 

covered by the Privacy Rule must obtain a specific. formal authorization from the patient 

in order to disclose psychotherapy notes in most circumstances (such notes can be 

used internally to treat the patient).6 

The right of patients under the HIPAA Privacy Rule to access and obtain a copy of their 

health information does not apply to psychotherapy notes.7 The Privacy Rule does 

provide patients with the right to request a correction to information in a provider's 

medical record; however. this right does not extend to information that the patient does 

not have the right to access.B As a result, it is unlikely that many patients would be 

provided with the ability to view their psychotherapy notes. and it would be solely in the 

discretion of the medical professional who created those notes (or the record holding 

institution) with respect to whether any correction would be made. 

Respectfully submitted, 

Deven McGraw 

Director, Health Privacy Project 

5 Psychotherapy notes are "notes recorded (in any medium) by a health care provider who is a mental 

health professional documenting or analyzing the contents of conversation during a private counseling 

session or a group, joint or family counseling session and that are separated from the rest of the 

individual's medical record. The term 'psychotherapy notes' excludes data relating to medication 

prescription and monitoring, counseling session starts and stop times, the modalities and frequencies of 

treatment fumished, results of clinical tests, and any summary of the following items: diagnosis, 

functional status, the treatment plan, symptoms. prognosis, and progress to date: 45 C.F.R. 164.501. 

6 45 C.F.R, 164.508(a)(2}. Such notes may be used by the originator in order to treat the patient; they 

also can be used for training purposes and to defend against a legal action or other proceeding. Id. Of 

note, the U.S. Supreme Court. in a case recognizing psychotherapist-patient privilege in federal rules of 

evidence, acknowledged the critical role that confidentiality of psychotherapy notes plays in mental health 

treatment: "Effective psychotherapy ... depends upon an atmosphere of confidence and trust in which 

the patient is willing to make a frank and complete disclosure of facts, emotions, memories. and fears. 

Because of the sensitive nature of the problems for which individuals consult psychotherapists, disclosure 

of confidential communications made during counseling sessions may cause embarrassment or disgrace. 

For this reason the mere possibility of disclosure may impede development of the corlfidential relationship 

necessary for successful treatment: Jaffree v. Redmond, 518 U.S. 1 (1996). 

7 45 C.F.R. 164.S24(a)(1)(i). 

a 45 CFR 154.526(a)(2)(iii). 
148 


82190.102

Privacy Implications With Respect to Mental Health Treatment 

Confidentiality and Mental Health Treatment of Adolescents 

A critical element in privacy is the confidentiality between a patient and the health care 

provider and even more critically, how perceptions of confidentiality affect willingness to 

seek care or disclose symptoms/thoughts with the mental health professional. 

Professional societies promote confidentiality with adolescent patients, but have also 

recognized the importance of involving parents in serious healthcare events. 

Specifically, the Society for Adolescent Medicine has stated that, "confidential health 

care should be available, especially to encourage adolescents to seek healthcare for 

sensitive concerns ... " , and parental involvement should be encouraged, but not 

mandated. 

(http://www.adolescenthealth.org/AMlTemplate.cfm?Section=Position Papers&Templat 

e-/CM/ContentDisplay.cfm&ContentlD=2597) 

Studies have found that adolescents are more willing to disclose highly personal 

information (including mental health information) to a physician after being given 

assurances of confidentiality. 

(http://jama.jamanetwork. com/article.aspx?articleid=418249) 

(http://jama.jamanetwork. com/article.aspx?articleid=195185) 

Underlining the importance of confidentiality in adolescent healthcare, an anonymous 

survey of 1295 Massachusetts high school students found that 25% reported that they 

would be willing to forgo health care in some situations if their parents might find out. 

(http://jama.jamanetwork.com/article.aspx?articleid=404397) 

Other studies have found Similar results: 

(http://www.ncbi.nlm.nih.gov/pubmed/1 0447039) 

(http://www.ncbi.nlm.nih.gov/pubmed/12169074) 

Other works have shown that there are variances amongst health care providers 

willingness to discuss confidentiality with their adolescent patients or even to provide 

them with such confidentiality. 

(http://pediatrics.aappublications.org/contentl111/2/394.short) 

(http://archpedi.jamanetwork. com/article.aspx?articleid=518355) 

One study found that mental health professionals protect the confidentiality of older 

minor clients (16-18 years of age) to a greater extent than for younger minor clients (11-

15 years of age). 
149 


82190.103

"There are two factors that consistently mitigate decisions to breach 

confidentiality among mental health counselors in private practice and other 

employment settings. The first is age of the minor child, with greater autonomy to 

make individual decisions afforded older clients. The only exceptions were clear 

threats of violence with guns. While most authors agree that minors have similar 

rights to privacy as adults, the age of the minor seems to change counselors' 

prediction of how they would handle those rights." 

(http://www.biomedsearch.com/article/Confidentiality-with-minors-mentalhealth/80553853.html) 

Although not specifically related to mental health care, a survey, of high school 

counselors, found that they were more willing to break confidentiality when risky 

behaviors were "more intense, more frequent and of longer duration" and that there was 

variance with regards to the counselors willingness to break confidentiality when 

suicidal ideation was present. 

(http://schoolcounselor.metapress.com/content!7873732816122842/) 

Finally, ethical studies have found that "paternalism" (i.e. - disclosing adolescent health 

conditions with parents) was justified only in cases where protecting the adolescent's 

life was the central goal. 

(http://www.ncbi.nlm.nih.gov/pubmed/2606747) 

Confidentiality and Mental Health Treatment for Medical Students 

Surveys of depressed medical students have also found that lack of confidentiality is a 

barrier to seeking mental health treatment. 

(http://journals.lww.com/academicmedicine/Abstract/2002/09000IDepressed Medical S 

tudents Use of Mental Health.24.aspx) 

(http://www.jgme.org/doi/abs/10.4300/JGME-D-09-00086.1) 

Stigma and Mental Health Treatment 

Another important policy topic related to the use of mental health services is perceived 

stigma attached with mental health illness, and the consequence for seeking mental 

health treatment can be, " ... negative evaluations and rejection from others." 

(https://wesfiles.wesleyan.edu/courses/PSYC-309-

clwilkinslWeek4/Sibicky. %20Dovidio.1986.pdf) 
150 

Æ 


82190.104

The academic literature has found that stigma can be an important barrier to seeking 

mental health treatment. 

(https:llselfstigma.psych.iastate.edu/sites/selfstigma.psych.iastate.edu/files/self%20stig 

ma%20mediation.pdD 

(http://www.ncbi.nlm.nih.gov/pubmed/15491256) 

Loss of social status was also cited by 62% of employees in one national survey as a 

barrier to seeking treatment. 

(http://www.ibhi.netlemployees-report-mixed-feelings-about-seeking-health-caretreatmen!D 

One scientific study on the topic found that the perceived stigma associated with 

seeking mental health care among university students was inversely associated with 

seeing a need to seek such care (i.e. - students had higher perceived stigma if they felt 

they did not need to seek care while students had lower stigma associated with seeking 

care if they felt they did need it.); while amongst students with probable depressive 

disorders, there was no evidence of perceived stigma effecting use of mental health 

services. 

(http://ps.psychiatrvonline.org/article.aspx?articleID=99261 ) 

Another study from Germany found the following: 

"Contrary to expectations, anticipated discrimination from others was 

unrelated to help-seeking intentions, while personal discriminatory 

attitudes seem to hinder help-seeking." 

(http://link.springer. com/article/1 0.1 007/s00406-009-0870-y) 

And, a study from Australia found: 

"Seeking help from a [general practitioner] for psychological problems was 

predicted by having a positive attitude towards seeking psychological help 

... [cJontrary to expectations, perceived stigma didn't influence help 

seeking." 

(http://link.springer.com/article/10.1 007%2Fs00127 -006-0089-4?LI=true)