Given that no fire department wants to be notified that they have committed a HIPAA privacy violation by an individual or a governmental official, I am providing this article to offer some guidance and tips to firefighters on what they may need to be aware of to avoid any issues regarding distribution of protected health information (“PHI”) and/or visits from regulating entities.
Understanding HIPAA and Its Importance
One of the most significant protections that HIPAA provides is the right to patient privacy. Based on established national standards, this part of the HIPAA Privacy Rule dictates and enforces how medical and personal health records may or may not be shared among organizations and healthcare providers who transmit records electronically.¹
It is important for a fire department and its firefighters to understand that they are considered a health care provider or covered entity if their department provides EMS services and conducts electronic transactions such as billing for medical services—at which point HIPAA applies.
Protected Health Information (PHI) and Electronic PHI (ePHI)
Information being protected can be referred to as either: Protected Health Information (“PHI”), which means individually identifiable health information; or, Electronic PHI (“ePHI”), which is Individually identifiable health information in electronic form.² HIPAA-covered entities such as fire departments “must comply with three regulatory subparts, aptly named the Security Rule, the Breach Notification Rule and the Privacy Rule.”³
Key HIPAA Rules for Fire Departments
The HIPAA Security Rule
The Security Rule requires covered entities to perform a risk assessment to determine where PHI may exist and the necessary steps to protect it. Risk assessments often lead entities to recognize that PHI exists in places that they might not have realized, such as on memory devices that are built into photocopiers, in National Fire Incident Reporting System (NFIRS) fire reports, on medical monitoring equipment, and on devices that are used to take mechanism-of-injury photos. The covered entity must develop a risk-management solution for each identified risk to protect the PHI. One inevitable solution involves training personnel on HIPAA compliance.⁴
The HIPAA Breach Notification Rule
The loss, theft, or unpermitted access to PHI on an unencrypted device, such as a laptop, a tablet computer, or memory storage, triggers the Breach Notification Rule. The loss of a laptop and failure to report can trigger substantial civil penalties.⁵ Mandatory notifications must be made to those whose PHI was on the unencrypted device and to HHS. The news media must be notified if 500 or more people are affected. Huge fines may be levied. Fire and EMS organizations can avoid this easily by ensuring that all PHI-containing devices are encrypted.⁶
Common HIPAA Compliance Challenges for Fire Departments
Video Ride-Along Confidentiality
Departments should also be aware of video ride-along that captures PHI. In 2018, the HHS Office of Civil Rights issued $1 million in fines to three Boston-area hospitals that participated in an ABC TV show, “Boston Med.” The hospitals allowed patients to be filmed without first obtaining their consent. This precedent raises grave concerns about reporters and others who film on fire and EMS ride-alongs. To be clear, the First Amendment prohibits a department from stopping reporters or citizens from filming firefighters doing their jobs in public places. However, allowing anyone to accompany firefighters into non-public places and capture PHI could result in a HIPAA violation.⁷
Business Associate Agreements
It is key to ensure the department has the correct business associate agreements in place. HIPAA requires covered entities to have written agreements with third parties that may access PHI. Some of the more common entities with which fire departments and EMS providers share information include cloud-based PCR providers and EMS billing services.
The Minimum Necessary Rule
The goal for a fire department or firefighter is to provide the minimal amount of PHI necessary to complete their job. This is called the Minimum Necessary Rule, and the basic guideline is a disclosure of Protected Health Information as needed to perform a job-related task and to limit unnecessary access by others. When working with a hospital or law enforcement personnel, disclosing health information as needed is appropriate. Suppose legal counsel or other individuals are involved, like an ex-spouse. In that case, if possible, acting cautiously and ensuring appropriate court documents or disclosures are in place is always appropriate. Also, an individual is entitled to request a copy of their PHI, as well as to all disclosures that have been made regarding their PHI. It should be noted that the PHI of a deceased individual can be protected for up to 50 years.
Potential HIPAA Violations and Consequences
There is a potential for violations when a firefighter discloses, intentionally or unintentionally, PHI to an unauthorized person, it can result in monetary fines and severe penalties, mainly if done purposely, such as up to ten years in prison. This could be as innocuous as talking to a nosy neighbor and providing too much information, accidentally giving identifying information at a party about an unusual case or losing a phone or laptop that a stranger then accesses, or as deliberate as taking a picture of someone in their home and posting it on social media or selling information about a public figure to a newspaper for personal gain.
Best Practices for HIPAA Compliance
Designating HIPAA Privacy and Security Officers
To handle these types of issues, the Security Rule requires covered entities to have a plan in place for a designated person(s) to serve as their HIPAA privacy and security officers and document the designation in writing for reasonably anticipated security breaches.⁸ A good example would be a ransomware attack or a complaint after an individual becomes the subject of a social media post made by a neighbor based on information provided by a firefighter after/or during a call.
Providing Notice of Privacy Practices (NPP)
A fire department should provide a Notice of Privacy Practice (“NPP”), either online if the department has a website, or via a paper copy to every individual that uses their services. The Notice should have specific language and identify the privacy or compliance officer an individual should contact and how a complaint can be made to the HHS. In addition, each firefighter or employee should also be aware of who the designated privacy or compliance officer is to be able to alert them to any issues and be able to direct any questions to the appropriate person.
Finally, be aware of the hot-button topics that are presently at issue in the community. If you act cautiously, you will likely be able to avoid any privacy issues with individuals or regulating entities. I hope this article is helpful, and I also thank you for your provision of care and services as a citizen of the State of Utah.
Citations
¹ See Id.
² Id.
³ See Fire Law: HIPAA Update: 7 Points Fire Departments and EMS Providers Must Know, by Curt Varone, December 2023.
⁴ See Id.
⁵ See Avoiding HIPAA Penalties: A Checklist for Covered Entities by Kim Stanger of Holland & Hart, May 29, 2024.
⁶ See Fire Law: HIPAA Update: 7 Points Fire Departments and EMS Providers Must Know.
⁷ See Id.
⁸ See Avoiding HIPAA Penalties: A Checklist for Covered Entities.