Does the President have HIPAA Rights

One of my students asked me this week if President Trump has HIPAA rights. It is an understandable question, given the barrage of briefings, questions shouted by reporters, and repeated corrections by the President’s personal physician in front of Walter Reed hospital.

Donald Trump has the same HIPAA rights as anyone in this country, but do we have a right to know details about our President’s health?

The first question provides an opportunity to remind everyone of the four individual rights we gained in the 1996 federal legislation; the second an excuse to tell stories about past Presidents.

The Rights We All Have Under HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) is a massive law passed by Congress to address several different issues, including the portability of your insurance when you leave a job (for which it is named), detecting and preventing fraudulent and abusive billing by providers, modernizing how health information is created, stored and shared in the developing digital world, and protecting the privacy of that information. That last-mentioned portion of the law- the Privacy Rule– is how the law is best known.

The Privacy Rule established four new federal rights for every person in this country:

1. The right to obtain a copy of your medical record
2. The right to limit disclosures of your information
3. The right to amend your record
4. The right to get an accounting of everyone who has seen or accessed your information.

Although it’s been 24 years, many people (including providers) do not understand these fundamental rights concerning our Protected Health Information (PHI).

Here are summaries of all four:

1. The right to obtain a copy of your medical record

You can get a copy of your medical record from any provider at any time: your doctor, your hospital, your clinic, your dentist. That is true, regardless of whether the record is on paper or is electronic/digital. (Please note there are special rules for records created by a mental health care practitioner, which I will not be addressing.)

If someone wants to deny you a copy, they must provide you with a reason in writing. Most reasons won’t pass HIPAA scrutiny, so you can use that letter to turn your provider into the “HIPAA police” if you so choose.

By the way- this new federal right wasn’t such a big deal even in 1996- every states’ law already allowed you a copy. Even so, we got a sparkly new federal right on top of our state right (remember that the primary jurisdiction over health care remains with the states- see Fontenotes No. 91).

2. The right to limit disclosures of your information

HIPAA allows us to limit who your providers can share your PHI with, as long as that request is reasonable.

It is good to know that under both HIPAA and state law, no one is going to hand your record over to someone else without your written permission (unless you are a child or have a legal guardian due to dementia or other circumstance). The “sharing” in this context usually refers to oral communication. For example, if you were undergoing emergency surgery- who could the nursing staff and surgeon tell about your condition?

If a patient wants to set a limit, she notifies her providers in writing. Her physicians, hospital, nurses, and everyone else participating in her care are then obligated to abide by her request. For example, a woman who does not want her gynecologist to share any information with her husband has the right to make that limitation binding. All she must do is document that restriction in her doctor’s office.

The way everyone enforces HIPAA is not, however, what was originally intended; the inverse situation became the norm.

Instead of waiting for someone to make a request, every patient is now asked, “who can we share your information with?” This has led to a list attached to every patient – most undoubtedly including brothers and best friends and all sorts of people who you wouldn’t mind knowing more about you if something happens- you just forgot to list their name.

The problem with this now-standard practice is it adds a burden to providers who have to manage those requests, particularly when many people don’t really care. I certainly don’t. I always write “No Restrictions” in large block letters on the forms. This drives most offices crazy- which is half the fun.

Another important thing to clarify about this second right involves the word “reasonable.” Specifically, it is not reasonable to limit sharing your information with other providers involved in your care. In the early days of HIPAA, the government clarified you do not have that right. Your providers share information about your condition, treatment, and history to give you safe and effective care. If you write on the form that they can’t share your PHI, it is a meaningless request.

It gets even more interesting if you write your employer down as a restriction. If your employer is self-insured (as so many large employers are), they have a right to your PHI so they can process your health care claims and needs. HIPAA limits how your boss can use your PHI, but your record could wind up in your HR department, regardless of your wishes. For more on that, see Fontenotes No. 54.

It’s probably obvious- but you can’t prohibit your providers from sharing your records and personal information with your health care insurance company either. A curious twist was added in 2013: “you can also ask your health care provider or pharmacy not to tell your health insurance company about care you receive or drugs you take, if you pay for the care or drugs in full and the provider or pharmacy does not need to get paid by your insurance company.” [quote]

One more thing! You can’t limit government entities (state or federal) from getting access to your health information. That is pretty definitively true- if you want to know more, see Fontenotes No. 68.

3. The right to amend your record

If you ever want to (not many people do), you can amend your medical record. Whether it is on paper or digital- you can add to it.

This means you can correct information (“it was my right eye- not my left”), dispute statements in your chart (“I am not obese!”), or add information that you want future providers to know (“I told them I was taking the medication they say they didn’t know about.”). You can even say, “This is the worst physician I have ever had.” Pretty much anything goes (no vulgar language, please!)

Please note, though, that this right allows your additions, but does not allow you to destroy any part of the record or make deletions. This is why in the time of paper records, it was recommended that people shouldn’t ever be left alone to review/amend their records- you didn’t want them ripping out a page or absconding with a picture of their purulent rash! With digital records, this is less of a concern- any changes are easily discovered- and rectified- through audit trails & recovery options.

4. The right to get an accounting of everyone who has seen or accessed your information.

This fourth new federal right was eviscerated immediately after passage of the law by 12+ exceptions, including any disclosure in the name of treatment, payment, operations, law enforcement, disaster release- there is even an exception that any disclosure when you were present doesn’t have to be included in your accounting.

All these exceptions were a great help to the paper-dependent physician offices of 1996, but as the medical world has become more digital, complying with a request for a full list of disclosures is as easy as pushing a button.

One current, frequent utilization of this right is to ask for an accounting of everyone who looks at your electronic health care record if you are hospitalized (the PIN someone uses to sign into the chart will identify them by name.) Who is on the list? Your nurses and physicians, of course- but also your neighbor who works in another part of the hospital entirely? She is busted! (and most likely now unemployed).

Speaking of “busted,” there is no Private Right of Action under HIPAA, meaning you can’t sue under this federal law. You can, however, turn offenders into the federal government (specifically, the Office of Civil Rights at HHS) and sue your providers (and your nosy neighbor) under state law. In 2013 your State Attorney General also became part of the “HIPAA Police” team I joked about earlier.

Phew! That concludes our rapid review of our HIPAA rights. If you want more information, there are extensive resources for the public available from CMS, including a short Summary “Your Health Information Privacy Rights” available here.)

Getting Back (Finally!) to the President’s Health

There is no question Donald Trump, the individual, has a right to keep his medical information private. But that does not mean we don’t have the right to know the condition of our President. His health has a direct bearing on our national security, our economy, and our election just weeks away.

HIPAA rights are personal rights- each of us has the four rights I just explained, and each of us can waive any of those rights when we want to.

When you decide to run for a public office, you usually waive your right of medical privacy as part of pursuing the job (not necessarily for the school board, but certainly as President!). Candidates waive their right of privacy when they provide a copy of their medical records to the press and public. That is a tradition that predates state privacy laws as well as HIPAA.

Is Donald Trump The First President Not to Give Full Disclosure of His Medical Condition?

There is no way of knowing for sure because if we never knew something, we wouldn’t know we were never told. However- there are some great examples of secrecy (and public backlash) from several past presidents:

My favorite is President Grover Cleveland, who hid from the American public that he had a tumor in his mouth. Its removal left a hole 2.5 inches long and an inch wide in his upper palate- a gap conveniently hidden post-operatively by his magnificent mustache. The best part of the story, however, is the operation occurred on a moving private yacht in Long Island Sound! For a riveting account of the surgery and all it entailed, I highly recommend “The President is a Sick Man” by Matthew Algeo.

President Kennedy never disclosed the extent of his back issues or his problems with Addison’s disease. The public was certainly not aware of the number of medications he took daily, including “painkillers, antianxiety agents, stimulants and sleeping pills, as well as hormones to keep him alive, with extra doses in times of stress.” [quote]

Access to President Woodrow Wilson was guarded fiercely by his wife after his stroke in 1919, leaving some to question who was running the country for several months (and possibly the remainder of his term, which ended in 1921).

Even when the President’s risk is obvious to the public, information can be scarce in the first critical hours. This is true even for family members, as Ronald and Nancy Reagan’s daughter Patti Davis discussed in her October 4th opinion piece, “Presidents don’t get privacy. My father understood that — even when he was shot.” She also recounts how that perceived public relations fumble led to her parents perhaps over-sharing President Regan’s colon when he had surgery for cancer four years later.

President James Madison may have had a seizure disorder, and doctors misled the public when President Dwight Eisenhower had a heart attack in 1955. There are other great examples in history, as described here by the History Channel.

These examples are offered not as an excuse for President Trump- but as cautionary tales from previous administrations. Each of the instances mentioned above (if discovered at the time) resulted in public- and political backlash.

That is what we are witnessing now with President Trump and his Coronavirus-19 illness.

Why is the President’s Physician Delivering Political News?

In the end, the question is not if HIPAA rights apply to Donald Trump- but why are reporters yelling questions to his physician knowing he can’t fully answer?

The spectacle of watching Dr. Sean Conley, President Trump’s personal physician, deliver updates in front of Walter Reed hospital (with a silent, masked phalanx of unidentified doctors) was maddening for all of us.

We are asking a physician to provide a political update.

Speaking of which, we could have asked for a complete report from Chief of Staff Mark Meadows as he was sitting on the sidelines rubbing his head. Any non-medical person from the Trump Administration could answer questions about President Trump’s health without conflict- HIPAA doesn’t apply to them.

Obfuscation is perfectly understandable from the perspective of a provider. Dr. Conley cites HIPAA as the reason he can give some information about the President’s health, but not answer other questions. He clarifies that he can only divulge the information his patient is allowing him to release.

The President’s condition has significance beyond his personal wellbeing or prognosis. Of course, we all want to hear from his physician– but that is only productive if Donald Trump permits his medical providers to speak freely.

Assuming President Trump is never going to lift the restriction on his providers, let Dr. Conley go back to treating his patient. Stop putting someone in front of us who is legally, professionally, and ethically bound to protect Donald Trump’s wishes.

Give us a spokesperson who can answer our questions. Stop wasting our precious time.

Want to Know More?

1. Whenever the subject of medical disclosure and political candidates arises, I think of Senator Paul Tsongas of Massachusetts, who ran in the Democratic primaries in 1992 against Bill Clinton. Tsongas was my candidate. He was a survivor of non-Hodgkin’s lymphoma and made that ordeal part of his pitch to be President; he and his physicians reassured the public he had been cancer-free since 1986. But in April, after winning nine primaries, the public learned that Mr. Tsongas had been treated for a reoccurrence of lymphoma in 1987.

His campaign was over.

Mr. Tsongas returned to New England, where he joined former Senator Warren Rudman in starting the Concord Coalition– a nonprofit focused on the budget deficit and other national economic issues.

He died on January 18, 1997, from complications of his lymphoma. He was 55 years old.

Mr. Tsongas died two days before President Clinton’s second inauguration. Had he been successful in his quest to become president, Paul Tsongas would have died in office.

You can learn more about Mr. Tsongas from his New York Times obituary. For those of you who remember the era, you can see many familiar faces from footage of his funeral here.

2. HIPAA gives parents access to their children’s medical records (in most cases). To learn more, go here, and contact your state government to what rights you have as a parent under your state law.

----------------------------------------------------------------------------------------------------------

Sarah Fontenot, J.D., B.S.N., C.S.P, and Adjunct Professor, Trinity University is a popular speaker who brings clarity to health care legal and policy issues. Her twice-monthly newsletter "Fontenotes" provides clear information about today's healthcare system. Click here to subscribe.