Patient information guidelines

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) mandated regulations that govern privacy, security and administrative simplification standards for healthcare information. The final Privacy Rule became effective in April 2001, and all hospitals must be compliant by April 14, 2003. HIPAA requires major changes in how healthcare organizations manage all health information, including patient records.

The HIPAA Privacy Rule sets forth minimum standards, mandated by federal law, which hospitals must follow with regard to the release of patient information. State law and individual hospital policies may be more restrictive than what is required in the HIPAA guidelines. In such instances, the more restrictive policy takes precedence.

Among other things, the HIPAA privacy regulations restrict the information that healthcare providers may include in a facility directory and release to the public, including news media. Directory information is limited to four elements, and patients have the option of further restricting release of the directory information. The directory elements are:

• Name (information can be confirmed only to those who ask about the patient[s] by name)
• Condition (using terms defined within this document)
• Location within the hospital (providers are permitted but not required to release)
• Religion (available only to clergy, upon request)

Please note: The HIPAA Privacy Rule requires that all patients be given the opportunity to opt out of the patient directory. If a patient chooses to opt out, no information can be released about that patient. Unless a patient has exercised the opt-out provision, directory information about a patient (excluding the religious affiliation information) can be shared with any person, including members of the news media, who inquires about the patient by name.

No matter how a person arrives at the hospital, the conditions surrounding his/her illness or injuries, or how important or well known he or she may be, HIPAA requires the hospital to ensure privacy. Previously, hospitals in Colorado provided specific information to the media when a patient had been involved in a matter of public record. This distinction is no longer possible. Unless authorized in writing by the patient or a patient's representative, the hospital is limited to providing only the facility directory information, as previously stated.

It is the responsibility of news personnel to determine what constitutes news. However, it is the moral and legal responsibility of hospitals to ensure proper and safe care of all patients, to protect the patient's right to privacy and the confidential nature of hospital medical records, and to abide by federal and state privacy laws, including HIPAA.

Within the limits of their mutual capabilities and responsibilities, hospitals and news media organizations have a joint interest in working together to see that news is reported accurately and promptly.

A hospital's first responsibility is the health and welfare of the patient. The patient has specific legal rights to privacy. The patient's medical information by law is private and confidential. Medical information is subject to release only with the permission and written authorization of the patient or patient's legal representative or as required by law.

Unless the patient opts out, directory information will be released to the media, providing the request includes the patient's name. Directory information may be delayed or unavailable for a patient who is unconscious or in an emergency situation.

The hospital spokesperson may not speculate on how, why or what caused the patient's injury or illness, but may offer a one-word patient condition while the individual is a patient in the facility. Hospitals generally use the following definitions of patient condition: 

• Good: Vital signs (such as pulse, temperature and blood pressure) are stable and within normal limits. Patient is conscious and comfortable. The outlook for recovery is good or excellent.
• Fair: Vital signs are stable and within normal limits. Patient is conscious but may be uncomfortable or may have minor complications. Outlook is favorable.
• Serious: Vital signs may be unstable or not within normal limits. Patient is acutely ill and may be unconscious. Outlook is questionable.
• Critical: Vital signs are unstable or not within normal limits. There are major complications. Patient may be unconscious. Outlook is unfavorable.
• Dead: Confirmation will be withheld until the next of kin has been notified or after a reasonable time has passed. A hospital may not disclose information regarding the date, time or cause of death. Information regarding cause of death comes from the coroner in most cases. In Colorado, death certificates are not public record.

The hospital spokesperson may indicate that a patient has been treated and released or treated and transferred.

Please note: Stable is not a condition nor should it be used with critical condition, as by definition critical indicates "vital signs are unstable and not within normal limits."

Each hospital has a designated person on duty to handle media inquiries at all times, either at the hospital or on-call. The spokesperson has the authority to release information to representatives of the news media, as outlined in this document.

Media representatives and photographers MUST contact the hospital spokesperson for access to the hospital. Hospitals require that a hospital representative accompany news personnel at all times within the facility.

All interviews with patients must be coordinated through the hospital public relations department. Written authorization from the patient is needed to obtain medical information beyond directory information, including photographs or interviews. If the patient is a minor, written authorization must be obtained from a parent or legal guardian.

Please note: Hospitals may deny the media access to a patient if it is determined that the presence of photographers or reporters would aggravate the patient's condition or interfere with appropriate clinical care.

The following guidelines are provided to ensure that all state and federal laws pertaining to the release of medical information to the news media are followed. Hospitals, physicians, patients and members of the news media shall adhere to these guidelines.

Although hospitals are viewed as public service institutions, medical information is not open public record. Hospitals have an ethical and legal obligation to keep medical information private and confidential, and medical records are not subject to Open Records Law. Federal and Colorado laws require hospitals to protect the confidentiality of medical information. (C.R.S. 18-4-412, C.R.S. 24-72-204 and C.R.S. 25-1-121.) Additional Release of Information Guidelines for Police, Fire and EMS professionals are published by the Emergency Services Public Information Officers of Colorado.

• Hospital employees and physicians should be familiar with the hospital's media policy.
• The hospital should identify authorized spokespeople to respond to media inquiries at all times, including evenings, weekends and holidays. Hospital operators should be educated regarding proper procedure and will direct media to the appropriate spokesperson.
• Hospital spokespeople will be accessible and will respond as rapidly as possible or advise of delays.
• Hospital spokespeople will present media requests objectively to patients and their families.
• The hospital spokesperson should work in conjunction with the appropriate caregiver prior to scheduling media interviews.
• When reporters request information beyond directory information, photographs of or interviews with a patient, the hospital must obtain written authorization from the patient (or the patient's guardian in the case of a minor).
• An authorized member of the hospital staff will attend all news media interviews and meetings with members of the news media on hospital premises.
• When requests for interviews and photographs may be detrimental to the patient's well-being or may be disruptive to the welfare of other patients, the hospital may limit or prohibit the admission of media. If appropriate based on condition of the patient, the hospital will attempt to accommodate media in an alternative location.
• In certain circumstances, pool coverage may be the most appropriate alternative. Because pool coverage may create time and technical problems for all media outlets, all major broadcast stations and newspapers should be notified before pool coverage is arranged, whenever possible.
• After a patient is discharged, the hospital is no longer in a position to disclose information concerning that patient. All inquiries should be directed to the patient's immediate family or designated spokesperson.

• Physicians should cooperate with the hospital spokesperson and be familiar with hospital media policies consistent with safeguarding the life and health of the patient and respecting the confidential nature of the doctor-patient relationship.
• Physicians should not speculate on prognosis; however, information concerning the nature of the injuries or illness, degree of seriousness and current condition may be made available, if the patient has granted written authorization.
• The attending physician's name may be released to the news media only with the physician's consent. However, the attending physician's name cannot be released to the news media when the physician's specialty would relay inappropriate detail as to the nature of the patient's illness/injury (e.g., knowing that the physician is a psychiatrist may imply that the patient has emotional problems).
• An individual physician in private practice may call a news conference, a reporter or an editor to announce a new or innovative procedure. However, the physician must coordinate with the hospital spokesperson if a news conference is to be conducted in the hospital or if a news release involves a patient in the hospital. The physician should include contact information and expect to receive requests for follow-up information from the media after personally initiating release of news.

• Reporters have the responsibility to respect a patient's physical, mental and emotional rights to privacy and to cooperate with health and medical authorities who are required by law to ensure those rights.
• Editors and reporters are expected to be familiar with Colorado state laws and federal laws, particularly the HIPAA Privacy Rule, concerning the unauthorized use of medical information.
• Prior to contacting patients or visiting a hospital or other healthcare setting, reporters must contact and coordinate with the hospital spokesperson, even if invited by a patient and/or patient's family.
• Reporters, photographers and television crews must be accompanied by authorized hospital personnel while in a hospital or healthcare facility for the purpose of developing a story or conducting a formal interview, even if invited by a patient or his/her family. The hospital will make every effort to accommodate interview or meeting requests, if authorized and scheduled in advance for a reasonable time of day.
• Reporters, photographers and television crews should minimize their time with patients in order not to interfere with patient care.
• Reporters, photographers and television crews should realize that at any time hospital personnel may request the interview be terminated or relocated based on the health or comfort of the patient or other nearby patients.
• In instances where a patient is being photographed in his/her room (as in the case of a feature or human interest story or interview), news photographers should not include any other patients in the picture or video, unless they also have signed an authorization form agreeing to such publicity, as their hospitalization is a private matter.
• Media should comply with a request to withhold the name of the hospital or healthcare facility in order to ensure the safety of the patient and/or staff (i.e., in the case of acts of violence).
• Reporters should recognize that medical condition is determined by hospital medical personnel, not police or fire/rescue authorities at the scene of an accident, injury or crime, unless the person is declared dead at the scene.
• In the interest of accuracy, news media personnel should request hospital information from authorized sources. When information regarding the institution, its patients or personnel is received from sources other than the designated spokesperson, the reporter has the responsibility of verifying its accuracy
• Reporters should recognize that the practice of medicine and patient care come first for medical personnel and that they may be called away during an interview if on duty or on call.
• The hospital will not provide directory information for an emergency or unconscious patient until every attempt has been made to notify next-of-kin.
• Reporters should notify the public relations department or hospital administration if concerns arise regarding timely access to information about patient condition requests.

All news media should be given equal access to the release of general information. However, if a reporter, through his or her own initiative, obtains an exclusive story concerning a hospital, physician or patient, the right to that exclusive should be respected. In the sense of fairness, the hospital will not take the initiative in giving that story to another news agency. If, however, the hospital spokesperson is approached regarding the same story by another media outlet, he/she is obligated to release the information to that media outlet as well, within the limitations of the privacy regulations. If a family or patient specifically requests that a particular media outlet be given exclusivity to a story, that request will be honored by the hospital.

• Patients have the right to initiate their own contact with the media. Reporters must contact the appropriate hospital personnel before coming or calling into the hospital. The physician, nurse and/or hospital spokesperson may limit the reporter's access to the patient in order to protect the patient's well-being, the welfare of other patients, or the functions of the hospital.
• Aside from directory information, information about patients cannot be released without the patient's written authorization.
• When information beyond directory information has been requested and the patient is conscious, competent and can communicate with the doctor or nurse in charge, it may only be released with written authorization of the patient. If it is not possible to communicate with the patient, the next of kin may give written authorization. In the case of minors or incompetent persons, a parent or guardian may provide written authorization for the release of information.
• If a patient specifically requests that the admission not be included in the facility directory, the hospital is legally obligated to honor such a request.
• If a patient does choose to cooperate with requests for media interviews, all interviews must be coordinated through the hospital public relations department, following the guidelines outlined throughout this document.

Confidentiality of medical information is not surrendered without patient authorization. The HIPAA Privacy Rule does not make an exception for patients involved in matters of public record, famous persons, public figures or for items of unusual news interest. When public interest exists, the hospital should be prepared to respond to media requests for information according to these guidelines.

The Colorado Department of Public Health and Environment (CDPHE) has set forth explicit regulations for the reporting of specific epidemic and communicable diseases (6 C.C.R. § 1009-1). The reporting is done in the strictest confidence, and the information should remain confidential. Media inquiries on epidemic and communicable diseases may be directed to the CDPHE. Hospital personnel cannot release information about individual patients hospitalized with possible or confirmed communicable diseases. Information about patients is restricted to directory information.

The HIPAA Privacy Rule does not make provisions for releasing patient information to the public in the case of mass casualty events. It does allow the hospital to provide limited information to an authorized agency (i.e., law enforcement or Red Cross) for disaster relief for the purpose of notifying family members or significant others of the individuals' locations and general conditions.

In extraordinary situations, such as disasters, the public may benefit from the release of general information when specific information is not yet releasable. For example, a spokesperson may say, "The facility is treating four individuals as a result of the explosion." The hospital spokesperson may state the number of patients who have been brought to the facility by gender or by age group (adults, children, teenagers, etc.). This type of general information may help reduce undue anxiety.

• Colorado Health and Hospital Association: 720-489-1630
• United States Department of Health and Human Services