Aegis Compliance & Ethics Center, LLP
Oregon Supreme Court Decides Pivotal HIPAA Issue
On October 19, 2017, the Oregon Supreme Court issued an opinion in Oregon Health Science University vs. Oregonian Publishing Company, LLC. The case pitted Oregon Health Science University (“OHSU”), a public corporation and HIPAA covered entity against The Oregonian, a newspaper.
The Oregonian sought to obtain copies of certain records from OHSU under the Oregon Public Records Law (“OPRL”). As a public/state entity, OHSU (like other Oregon public entities and agencies) is subject to the OPRL. By analogy, the OPRL (and other state/open record laws), is like the federal Freedom of Information Act (“FOIA”). Such state and federal laws are intended to ensure open/public access to records maintained by state-sponsored or supported agencies. However, public access to records maintained by federal/state agencies is not unfettered. There are exceptions/exemptions intended to safeguard the privacy of certain information collected by federal and state agencies; thereby, balancing the need for public transparency with safeguarding personal and confidential information.
Under Oregon law, if you intend to sue OHSU (or any other public entity) for a tort, you are required to file a tort claim notice. The notice requires the identification of certain claim-specific information. Tort claim notices could be filed against OHSU (a public health and research university) by any number of individuals, including patients and students, for tort injuries those individuals are alleged to have suffered.
Deviation from Tort Claim Notices
In this case, The Oregonian did not seek copies of the actual tort claims notices but rather claimant information derived from those notices, including the claimant’s name and the claimant’s attorney’s name. OHSU objected. OHSU argued that the disclosure of such information would result in the unauthorized disclosure of patient and student information otherwise protected from disclosure by federal (HIPAA, FERPA) and state law. The Oregonian persisted and won the early rounds of the fight. The Multnomath County, Oregon District Attorney sided with The Oregonian. OHSU appealed. The Circuit Court also sided with The Oregonian. OHSU appealed again. Finally, the Court of Appeals sided with OHSU. This time, The Oregonian appealed to the Oregon Supreme Court for final resolution of the dispute.
The Oregon Supreme Court did not resolve the issue regarding The Oregonian’s request for information derived from student tort claim notices (it remanded the case to the Circuit Court for further development of that issue); however, it did finally resolve the issue regarding the requested information derived from tort claim notices filed by patients. The critical issue came down to whether disclosure of the requested information was “required” by the OPRL and, therefore, a “permitted” disclosure under the HIPAA Privacy Rule (45 CFR 164.512(a)). The Court concluded that the requested information was not required to be disclosed under the OPRL and, in fact, was exempt from disclosure under the OPRL and other Oregon state laws. As such, OHSU was not permitted to disclose the information under HIPAA without patient authorization.
Importance of HIPAA
The case illustrates the continued importance of HIPAA covered entities (and business associates) ensuring that they are diligent in their efforts to safeguard protected health information and not disclose such information unless there is a credible basis to do so under the HIPAA Privacy Rule.