Hospital, Attorney General, at Odds Over Records Access

A criminal and public health investigation in New Hampshire involving a former hospital worker who allegedly infected dozens of patients with Hepatitis C is turning into a patient a privacy debate.

New Hampshire’ attorney general next week plans to file a motion to expedite the scheduling of a court hearing on whether Exeter Hospital must turn over additional patient records as the state investigates the case. Earlier, the hospital asked a court to provide guidance on whether turning over more records is appropriate under state and federal privacy laws.

The state alleges that former Exeter Hospital medical technician David Kwiatkowski, who has Hepatitis C, stole anesthetic drugs from the hospital and then contaminated syringes that were subsequently used on patients. He was charged with federal drug crimes (see: The Case for Background Screening).

So far, 32 patients who were treated at the hospital during the time Kwiatkoswki worked there have tested positive for Hepitatis C. The New Hampshire Department of Public Health Services, which is conducting the investigation, has contacted more than 6,000 Exeter Hospital patients about getting tested for the disease because they had surgical procedures at the facility during the time Kwiatkowski worked there.

Judicial Guidance

In late August, the hospital filed a request in New Hampshire Superior Court in Merrimack County asking for judicial guidance regarding the state public health department’s demand for “broad access” to health records of Exeter Hospital patients.

Anne Edwards, an assistant state attorney general, said that up until the time Exeter Hospital filed the court action, the hospital had been cooperative in turning over patient records to investigators looking to identify additional patients who should be tested for Hepatitis C. However, around the time the hospital filed the court action, the hospital suddenly refused to turn over any more records, she claims. “They gave no reason,” she says. “To determine the extent of the [Hepatitis C] situation, we need access [to more records].”

Exeter Hospital issued a statement on August 29 explaining that it had patient privacy concerns about the public health department’s request for broad access to the hospital’s medical records systems as part of its investigation. The statement noted the hospital was seeking court guidance.

“These records contain confidential and private health information on all of our patients, and access to this information is restricted by both state and federal law,” the hospital statement says. “The DPHS’ current request extends beyond what we believe we are allowed to provide in accordance with patient privacy laws. While we must act with extreme caution in granting access to private medical records without an individual’s advance consent, we understand the DPHS may need to gather specific information from a small subset of those records to help with its investigation.”

The statement notes that the hospital hopes to find a way to provide state investigators with limited access to that subset of records “to provide them with what they need without violating our patients’ legal rights.”

Ann D’Arcy James, Exeter Hospital privacy officer, would not elaborate on the situation, other than to say that state public health officials wanted “broad access to all patient records.” An Exeter Hospital spokeswoman would not comment on the number of patient records requested by or released to public health or criminal investigators so far.

Prosecutor’s View

Edwards, the assistant attorney general, says that before the hospital’s refusal to turn over additional patient records, state investigators had access to electronic and paper medical records of “a number of patients.” She declined to say how many records were made available.

Regarding Exeter Hospital’s concern about providing “broad access” to patient records systems to investigators, Edwards points out that individual patient privacy rights are sometimes trumped by other circumstances. “Clearly, there are exceptions to HIPAA involving public health needs and criminal investigations,” she says.

n the meantime, Exeter Hospital’s statement says, “Our intent is to obtain judicial guidance for both the DPHS and Exeter Hospital in this challenging intersection between individual privacy and the DPHS’ desire to examine confidential patient medical records.”

Robert Belfort, a partner at the law firm Manatt, Phelps & Phillips, says “HIPAA tells health providers you can’t disclose information without patient consent, but has a laundry list of exceptions, including public health efforts to control disease and illness.” In addition, he thinks it’s possible that New Hampshire state privacy laws also could be a factor in Exeter Hospital’s decision to seek guidance from a state court in the matter.

“Sometimes state laws are more restrictive than HIPAA, and the hospital could be thinking it’s released enough information for the investigation,” he says, acknowledging that he’s not familiar with all the details of the Exeter Hospital case. “The hospital could feel that it’s now doing its duty to protect patient privacy.”

By Marianne Kolbasuk McGee, September 7, 2012.