# Are Ebola patients exempt from HIPAA? **URL:** \ **Category:** Factual Questions\ **Created:** [October 26, 2014, 3:19pm UTC](https://boards.straightdope.com/t/are-ebola-patients-exempt-from-hipaa/702575 "2014-10-26T15:19:12Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![boffking](https://avatars.discourse-cdn.com/v4/letter/b/858c86/32.png) [@boffking](https://boards.straightdope.com/u/boffking)\ **Post date:** [October 26, 2014, 3:19pm UTC](https://boards.straightdope.com/t/are-ebola-patients-exempt-from-hipaa/702575/1 "2014-10-26T15:19:12Z")
For the few Ebola cases in the USA, there has been up to the minute news coverage of the patient’s condition. Doesn’t this violate a whole bunch of federal laws? I know that keeping medical data secure and confidential is an industry unto itself. ---
**Author:** ![Revtim](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/revtim/32/1042_2.png) [@Revtim](https://boards.straightdope.com/u/Revtim)\ **Post date:** [October 26, 2014, 3:25pm UTC](https://boards.straightdope.com/t/are-ebola-patients-exempt-from-hipaa/702575/2 "2014-10-26T15:25:29Z")
Good question. I wonder if the patients have voluntarily given up their privacy rights for some reason. ---
**Author:** ![Rachellelogram](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/rachellelogram/32/8689_2.png) [@Rachellelogram](https://boards.straightdope.com/u/Rachellelogram)\ **Post date:** [October 26, 2014, 4:50pm UTC](https://boards.straightdope.com/t/are-ebola-patients-exempt-from-hipaa/702575/3 "2014-10-26T16:50:00Z")
[http://www.poynter.org/latest-news/mediawire/275445/journalists-struggle-to-balance-reporting-on-ebola-with-hipaa/](http://www.poynter.org/latest-news/mediawire/275445/journalists-struggle-to-balance-reporting-on-ebola-with-hipaa/) Relevant excerpt: > [@](#): > > the Rule permits covered entities to disclose protected health information without authorization for specified public health purposes. Journalists are not covered entities, though. Maybe the CDC or local medical personnel need to be more tight-lipped about these things. But it’s possible the patients involved just signed away their rights. To make money, or to get their 15 minutes, or in pursuit of the greater good, or out of plain ignorance that they could refuse to do so. ---
**Author:** ![susan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/susan/32/17537_2.png) [@susan](https://boards.straightdope.com/u/susan)\ **Post date:** [October 26, 2014, 10:09pm UTC](https://boards.straightdope.com/t/are-ebola-patients-exempt-from-hipaa/702575/4 "2014-10-26T22:09:00Z")
Or desire to be helpful to the public. ---
**Author:** ![MandaJo](https://avatars.discourse-cdn.com/v4/letter/m/ac91a4/32.png) [@MandaJo](https://boards.straightdope.com/u/MandaJo)\ **Post date:** [October 26, 2014, 10:30pm UTC](https://boards.straightdope.com/t/are-ebola-patients-exempt-from-hipaa/702575/5 "2014-10-26T22:30:28Z")
I thought HIPPA applied to healthcare providers, not other people. So the sources the journalists use may well have been in violation, but the reporters are not. ---
**Author:** ![Red\_Stilettos](https://avatars.discourse-cdn.com/v4/letter/r/fbc32d/32.png) [@Red\_Stilettos](https://boards.straightdope.com/u/Red_Stilettos)\ **Post date:** [October 27, 2014, 12:05am UTC](https://boards.straightdope.com/t/are-ebola-patients-exempt-from-hipaa/702575/6 "2014-10-27T00:05:53Z")
> [@MandaJo](#): > > I thought HIPPA applied to healthcare providers, not other people. So the sources the journalists use may well have been in violation, but the reporters are not. Yep, this is a big part of the answer. People who learn this information as part of providing medical care (and that includes public health agencies) cannot disclose private health information (PHI). But journalists, friends, family, and coworkers have no such restrictions and that’s where many of the names came from. Also, I feel confident that several of the patient did give consent to have their names and health status disclosed. Any time you hear a medical person refer to someone by name, they are either violating HIPAA or the person has given consent. Just going by the patients at Emory, Kent Brantley gave permission to use his name, so the doctors referred to him by name in press conferences. Nancy Writebol did not give this permission, so the doctors always referred to her as “the patient” even though her name was known in the press. The third patient also remained “the patient” because he has chosen to remain anonymous. ---
**Author:** ![RivkahChaya](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/rivkahchaya/32/8919_2.png) [@RivkahChaya](https://boards.straightdope.com/u/RivkahChaya)\ **Post date:** [October 27, 2014, 12:16am UTC](https://boards.straightdope.com/t/are-ebola-patients-exempt-from-hipaa/702575/7 "2014-10-27T00:16:21Z")
When there is a public health situation that is important to the public, it’s permissib;le to give the information as long as the patient’s name is protected. Because protecting the patient’s name is very difficult, the default is to keep all information confidential, period, but Ebola information is an exception where the public does have a need to know. ---
**Author:** ![grude](https://avatars.discourse-cdn.com/v4/letter/g/e47774/32.png) [@grude](https://boards.straightdope.com/u/grude)\ **Post date:** [October 27, 2014, 4:30am UTC](https://boards.straightdope.com/t/are-ebola-patients-exempt-from-hipaa/702575/8 "2014-10-27T04:30:20Z")
HIPPA is sort of a joke, it seems super serious on paper but in reality it is often ignored. I remember my mom sending me for her paper prescriptions, me just walking in to a doctor’s office where my mom had NOT called in or authorized anything. “Yes sir?” “Uh hi I am Grude’s mom’s son” “Oh ok she sent you to get her prescriptions, here you go!” \*Me mentally going er HIPPA?! I can remember a ton of other situations that let me know HIPPA is a total joke. ---
**Author:** ![Boyo\_Jim](https://avatars.discourse-cdn.com/v4/letter/b/87869e/32.png) [@Boyo\_Jim](https://boards.straightdope.com/u/Boyo_Jim)\ **Post date:** [October 27, 2014, 4:49am UTC](https://boards.straightdope.com/t/are-ebola-patients-exempt-from-hipaa/702575/9 "2014-10-27T04:49:14Z")
> [@RivkahChaya](#): > > When there is a public health situation that is important to the public, it’s permissib;le to give the information as long as the patient’s name is protected. Because protecting the patient’s name is very difficult, the default is to keep all information confidential, period, but Ebola information is an exception where the public does have a need to know. No, it is no exception at all. A disease has no rights to privacy, but people do. If health care workers are releasing patient names they are in violation unless the patient has waived their rights. But there are so many other ways that the information could get out. Police reports, airline rosters, family, friends, neighbors, … ---
**Author:** ![Qadgop\_the\_Mercotan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/qadgop_the_mercotan/32/83_2.png) [@Qadgop\_the\_Mercotan](https://boards.straightdope.com/u/Qadgop_the_Mercotan)\ **Post date:** [October 27, 2014, 1:26pm UTC](https://boards.straightdope.com/t/are-ebola-patients-exempt-from-hipaa/702575/10 "2014-10-27T13:26:33Z")
Kudos to the OP for spelling **HIPAA** right! Otherwise, I think **Boyo Jim** is probably correct as to how the info gets out most of the time. ---
**Author:** ![WhyNot](https://avatars.discourse-cdn.com/v4/letter/w/c77e96/32.png) [@WhyNot](https://boards.straightdope.com/u/WhyNot)\ **Post date:** [October 28, 2014, 3:27am UTC](https://boards.straightdope.com/t/are-ebola-patients-exempt-from-hipaa/702575/11 "2014-10-28T03:27:56Z")
I’m sure that - as they have been mostly healthcare professionals - the victims whose names have been in the press gave explicit permission for their personal health information to be shared. They probably know their rights under HIPAA pretty well, given their line of work. And while the public may have a right to information about location, movements and date of contagiousness, they never have a right to names, addresses, or other personally identifiable [PHI or PII](http://idash.ucsd.edu/phi-and-pii-definition-and-data-elements). ---
**Author:** ![robert\_columbia](https://avatars.discourse-cdn.com/v4/letter/r/e79b87/32.png) [@robert\_columbia](https://boards.straightdope.com/u/robert_columbia)\ **Post date:** [October 28, 2014, 3:42am UTC](https://boards.straightdope.com/t/are-ebola-patients-exempt-from-hipaa/702575/12 "2014-10-28T03:42:54Z")
> [@Boyo\_Jim](#): > > No, it is no exception at all. A disease has no rights to privacy, but people do. If health care workers are releasing patient names they are in violation unless the patient has waived their rights… If I get Ebola, how much can I expect heath care workers to offer me to grant them permission to release my name? $50,000? $100,000? $1M? More? No specific cash payment but a guarantee of lifetime free care? ---
**Author:** ![GrumpyBunny](https://avatars.discourse-cdn.com/v4/letter/g/bc8723/32.png) [@GrumpyBunny](https://boards.straightdope.com/u/GrumpyBunny)\ **Post date:** [October 28, 2014, 9:41am UTC](https://boards.straightdope.com/t/are-ebola-patients-exempt-from-hipaa/702575/13 "2014-10-28T09:41:48Z")
> [@grude](#): > > HIPPA is sort of a joke, it seems super serious on paper but in reality it is often ignored. > > I remember my mom sending me for her paper prescriptions, me just walking in to a doctor’s office where my mom had NOT called in or authorized anything. > > “Yes sir?” > > “Uh hi I am Grude’s mom’s son” > > “Oh ok she sent you to get her prescriptions, here you go!” > > \*Me mentally going er HIPPA?! > > I can remember a ton of other situations that let me know HIPPA is a total joke. That’s not a HIPAA violation. You said who the patient was, not the pharmacist. ---
**Author:** ![robert\_columbia](https://avatars.discourse-cdn.com/v4/letter/r/e79b87/32.png) [@robert\_columbia](https://boards.straightdope.com/u/robert_columbia)\ **Post date:** [October 28, 2014, 2:11pm UTC](https://boards.straightdope.com/t/are-ebola-patients-exempt-from-hipaa/702575/15 "2014-10-28T14:11:58Z")
> [@grude](#): > > HIPPA is sort of a joke, it seems super serious on paper but in reality it is often ignored. > > I remember my mom sending me for her paper prescriptions, me just walking in to a doctor’s office where my mom had NOT called in or authorized anything…“Uh hi I am Grude’s mom’s son” > > “Oh ok she sent you to get her prescriptions, here you go!” > … > [@GrumpyBunny](#): > > That’s not a HIPAA violation. You said who the patient was, not the pharmacist. I’m not convinced that it’s not a HIPAA concern. True, Grude was the one who mentioned the patient first, but the pharmacist revealed what the prescriptions were for (drug name, dosage, physician name, etc.), since that information goes on the bottle. Did you just say that you were there to pick up her prescriptions, or did you read off every prescription to the pharmacist before they confirmed that they had a matching one? If you didn’t, that could represent a security hole. How did the pharmacist not know that you weren’t really estranged from your mother and trying to discover what she was taking in order to do Something Nefarious ™ with that knowledge, like blackmail her or use it in a smear campaign? “Don’t vote for my mom, she takes glorpholine, which can cause brief episodes of psychosis and is also made from the bodies of dead kittens!” ---
**Author:** ![robert\_columbia](https://avatars.discourse-cdn.com/v4/letter/r/e79b87/32.png) [@robert\_columbia](https://boards.straightdope.com/u/robert_columbia)\ **Post date:** [October 28, 2014, 2:13pm UTC](https://boards.straightdope.com/t/are-ebola-patients-exempt-from-hipaa/702575/16 "2014-10-28T14:13:40Z")
> [@Taajsgpm](#): > > I think the publicpanic and the seriousness of a pandemic outweigh… Publicpanic is a bigproblem in the modernworld. I guess we can hope that newresearch and betterhygiene can help build a world that is free of deadlydisease. ---
**Author:** ![WhyNot](https://avatars.discourse-cdn.com/v4/letter/w/c77e96/32.png) [@WhyNot](https://boards.straightdope.com/u/WhyNot)\ **Post date:** [October 28, 2014, 2:19pm UTC](https://boards.straightdope.com/t/are-ebola-patients-exempt-from-hipaa/702575/17 "2014-10-28T14:19:25Z")
> [@robert\_columbia](#): > > I’m not convinced that it’s not a HIPAA concern. True, Grude was the one who mentioned the patient first, but the pharmacist revealed what the prescriptions were for (drug name, dosage, physician name, etc.), since that information goes on the bottle. Did you just say that you were there to pick up her prescriptions, or did you read off every prescription to the pharmacist before they confirmed that they had a matching one? If you didn’t, that could represent a security hole. How did the pharmacist not know that you weren’t really estranged from your mother and trying to discover what she was taking in order to do Something Nefarious ™ with that knowledge, like blackmail her or use it in a smear campaign? “Don’t vote for my mom, she takes glorpholine, which can cause brief episodes of psychosis and is also made from the bodies of dead kittens!” I don’t think it’s a HIPAA violation. HIPAA allows for professional judgement more than most people think, and people who are obviously part of the patient care team (like someone who picks up prescriptions for the patient) are allowed the release of the information they need to provide that care without written consent, or even explicit verbal consent. HIPAA doesn’t require us to get it _right_, just to take measures to protect personal health information. He knew the right doctor’s office to go to, the receptionist knew someone was going to pick up her prescriptions that day, he provided her name…it’s reasonable to assume he was part of her patient care team. I might have asked for her birthdate or address to have 2 identifiers confirmed, but that’s out of an abundance of caution. (And also wouldn’t thwart the hypothetical nefarious son.) ---
**Author:** ![bordelond](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bordelond/32/150_2.png) [@bordelond](https://boards.straightdope.com/u/bordelond)\ **Post date:** [October 28, 2014, 2:39pm UTC](https://boards.straightdope.com/t/are-ebola-patients-exempt-from-hipaa/702575/18 "2014-10-28T14:39:33Z")
> [@robert\_columbia](#): > > If I get Ebola, how much can I expect heath care workers to offer me to grant them permission to release my name? $50,000? $100,000? $1M? More? No specific cash payment but a guarantee of lifetime free care? A news organization may make such an offer, but I can’t imagine a health-care provider doing so. Maybe a huge health insurer or a drug manufacturer. Brantly, Pham, and Vinson (and eventually Spencer) should be happy to have their names public, though. Brantly has already made at least one compensated television (_Dateline_, IIRC). All of them will have many media opportunities available to them over the coming years. ---
**Author:** ![Inigo\_Montoya](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/inigo_montoya/32/124_2.png) [@Inigo\_Montoya](https://boards.straightdope.com/u/Inigo_Montoya)\ **Post date:** [October 28, 2014, 4:29pm UTC](https://boards.straightdope.com/t/are-ebola-patients-exempt-from-hipaa/702575/19 "2014-10-28T16:29:36Z")
> [@robert\_columbia](#): > > Publicpanic is a bigproblem in the modernworld. I guess we can hope that newresearch and betterhygiene can help build a world that is free of deadlydisease. Is it wrong that I miss studying German for the grammar?