HIPAA an affront to sunshine

Today marks the start of Sunshine Week -- and it's not related to the valley's ridiculously good seven-day weather forecast.

Journalists and public-sector watchdogs use Sunshine Week to champion transparency in government and citizen access to the meetings and records we pay for. It's a great time to evaluate whether governments truly value keeping the public's business public, or whether they're looking for excuses to limit open, honest deliberation and citizen input, discourage scrutiny and keep government records secret.

The fight to keep government in the sunlight never ends. It seems hardly a week goes by that someone in government isn't denying the press and the public access to some record.

One such recent example: the city of Henderson's refusal to release a recording of last month's 911 call from the home of former Councilwoman Kathleen Vermillion.

The call was made by her daughter after an apparent suicide attempt by Vermillion. The former councilwoman is the subject of criminal investigations into allegations that she misused private donations and tax dollars given to the Nevada Partnership for Homeless Youth, the charity she co-founded, as well as allegations that she tried to extort her former boyfriend, Clark County Commissioner Steve Sisolak.

Media requests for 911 recordings have been routine for years. Emergency dispatchers are public employees. The calls are routed to public lines using public equipment. The dispatchers notify public emergency responders. The opportunity to listen to them provides the public with assurances that their tax dollars are providing adequate training and efficient responses.

The city of Henderson, however, concluded that because the recording contained confidential medical information, and because the city considers itself a health care provider, the call was subject to the privacy guidelines of the federal Health Insurance Portability and Accountability Act and therefore was confidential. The city provided the time of the call and response-time information, and nothing else.

"The release of the content of the 911 tape, containing private medical information, serves no genuine public interest," city spokeswoman Kathleen Richards wrote.

Nevada's public records law describes the public's interest: Records are presumed to be public, the law must be "construed liberally," and any "exemption, exception or balancing of interests which limits or restricts access to public books and records by members of the public must be construed narrowly."

That's not what happened in this case. The justifications for withholding the recording were construed liberally, and both the state public records law and HIPAA were construed narrowly.

On March 2, Henderson City Attorney Josh Reid provided his first detailed explanation of his reasoning behind keeping the 911 call confidential. In an email, he wrote:

"With respect to health related 911 calls, the City has acted as a 'covered entity' under HIPAA for some time, and we have a HIPAA section in our Department of Finance to deal with medical billing for our EMT services. I am told that the Henderson Fire Department had not released 911 tapes for some time. There is a two part test under the HIPAA Privacy Rule to determine whether you are a covered entity. First, the organization must fall under one of the following categories: (1) A 'health plan'; (2) A 'healthcare clearinghouse;' or (3) A 'health care provider' that engages in certain electronic transactions. 'Health care providers' are any person or entity that furnishes or provides health care to patients. Second, health care providers must engage in certain types of electronic transactions in order to trigger the 'health care provider' definition of a 'covered entity' under the Privacy Rule. Under this 'electronic transactions' part of the definition, an organization must transmit health information electronically in its performance of a 'covered transaction.' One example of a covered transaction is electronic billing for health care services.

"The dispatch service within a covered entity may serve as the front-end receiver of patient information. For example, the dispatch agency receives pertinent patient information including patient location and physical condition; and transmits that information to crewmembers responsible for direct treatment of the patient. The identifiable patient information received by the dispatch service is considered 'Private Health Information' protected under the Privacy Rule, received on behalf of the covered entity (the ambulance service). Simply because the information is received before the initiation of treatment does not change the fact that the information received by the dispatch portion of the covered entity is PHI subject to the protections of the Privacy Rule. If the ambulance service has not declared itself a covered entity, then the dispatch service, as a department of the covered entity, is a covered entity.

"It is well accepted that EMT's and their related call centers are health care providers. The City owns and operates both the 911 call center and the EMT services provided in the City, and the City handles the billing for these services internally. Accordingly, because: (1) Our dispatchers and the EMT's are both employed by the City; (2) The EMT's and 911 call center provides health care; (3) The City bills people for their service, and; (4) the City distributes medical information electronically for billing purposes, the privacy protections under HIPAA apply to the 911 call made. Accordingly, we cannot release these tapes unless we get written authorization from the person protected under HIPAA. I asked Vermillion if she was willing to release the 911 tape and she declined."

During debate leading to the passage of HIPAA in 1996, the prospect that the bill would allow local governments to keep public safety records secret never came up. Nonetheless, government officials everywhere have seized the opportunity to cite HIPAA in denying journalists access to critical information related to accidents, crimes and natural disasters. The prospect of getting Congress to revisit yet another unintended consequence of sweeping federal regulation: zero.

The secrecy surrounding Vermillion's 911 call is another reminder that if government has a chance to deny you access to public information, authorities will use it almost every time.

Long live sunshine.

Glenn Cook (gcook@reviewjournal.com) is a Review-Journal editorial writer.