Keeping your eyes & mouth wide shut.

On April 14, 2003, the U.S. government ordered all file drawers of patient health records shut and locked. Nurses have been instructed to keep patient medical charts off counters and safely away from view of other patients. In waiting rooms, receptionists no longer will be greeting you by your full name.

If you're in the healthcare business, the government wants you to keep your eyes and mouth shut when it comes to patient health information.

Welcome To The Brave New World Of Medical Data Privacy

Sweeping federal privacy regulations now in force affect almost every aspect of modern healthcare. From individual medical practices to large managed care facilities; from the corner drug store to the largest insurance companies.

It's the Health Insurance Portability and Accountability Act ("HIPAA") and it was introduced by the Clinton administration in 1996. Its aim is nothing short of legally mandating a patient's right to medical privacy.

The law, years in the making and fine tuned by the Bush administration, strictly prohibits disclosure of patient information without their expressed consent. Simply put, healthcare and the companies that do business with them must not disclose any aspect of patient information beyond what is absolutely essential to deliver care.

Tough Criminal & Civil Penalties

To ensure compliance, violators are subject to the kind of criminal penalties that would make even a "three-strike" defendant sit up and take notice. Violators of HIPAA can face up to ten years in state prison and up to $250,000 in fines.

Why the sudden interest in medical privacy? In the last decade, as the power of computer technology and communications advanced, so did the risk and fear of unauthorized access to sensitive patient information. In fact, one of the objectives of HIPAA was to encourage and promote better care by allowing a full and robust electronic exchange of patient information between healthcare providers--so long, of course, that information was kept strictly confidential.

Double Edged Sword

While technology has opened up new possibilities for the rapid exchange of medical information and ideas between providers, it has also made the potential for abuse a very real risk.

The risks come from a variety of sources: from companies that buy and sell patient names for profit without regard to patient privacy, to computer hacks that post names of patients and their diagnosis on to the internet.

Smaller Does Not Mean Safer

Many smaller medical providers have chosen not to make privacy compliance a top priority, thinking government will spend their limited enforcement dollars on the larger medical institutions and insurance groups. Many of these providers are betting they will miss detection by flying under the government's radar screen. Perhaps, but are smaller healthcare companies really prepared to take the risk if they're wrong?

We believe the penalties for noncompliance far outweigh the time and cost of getting into compliance. And regulatory enforcement agents may not be your only source of concern.

Beware Of The Whistle Blower 

It could be a huge mistake to be lulled into a false sense of security. Random compliance audits conducted by regulatory enforcement agents is just one way they can find violators. I believe the vast majority of detections and subsequent convictions will come from (as they often do in tax evasion cases) whistle blowers. People you know and work with--like the disgruntled employee who is on a rampage to get back at you and your company.

Consider this unhappy scenario:

You're the president of Blood-Test, Inc. a thirty-employee health-testing clinic that performs physical examinations for people applying for life insurance. Since your business involves the electronic transmission of protected health information, you will very likely be obligated to comply with HIPAA.

One of your staff terminates a low level employee in your billing department for underperformance. The terminated employee becomes irate and believes he was discriminated against for other reasons. He visits an experienced employment lawyer. The lawyer, after some prodding, discovers that your employee works for a healthcare provider and that he had complained to one of his supervisors that physical examination test results were being sent out with invoices bearing the examinees full name and address - potentially a serious HIPAA violation.

The lawyer gets more details and together with the client, determines that the real reason for termination was retaliation for his open criticism of your companies "privacy-deficient" billing practices.

Your former employee will attempt to cast himself as a whistle blower under the law in an attempt to allege punitive damages against you and your company. However, that might not be your only concern. You could find yourself and your colleagues looking down the barrels of a criminal indictment for noncompliance.

Better Safe Than Sorry

Our advice is straightforward--if you suspect your business might fall under HIPAA privacy regulations, find out immediately.

Remember, medical records are only one aspect of HIPAA's definition of protected health information. The safe approach is to consider that anything your business does or might do with respect to patient information is best assumed protected and therefore must be secured- at least until you can obtain an informed legal opinion to the contrary.

Law firms like ours will help you make that determination and, if necessary, walk you through the process towards implementing an effective compliance program. It's the smart approach, and you will find one of the benefits is that you will work and sleep with improved peace of mind.

Kenneth Drake is the managing partner in the Law Firm of Rushfeldt, Shelley & Drake LLP in Sherman Oaks. The firm has served the legal needs of the Southern California's Healthcare Community for over twenty-two years. Mr. Drake may be reached at [e-mail]