HIPAA Compliance Strategies

When Faith and HIPAA Collide: Entities Struggle to Accommodate Personal Beliefs

Reprinted from the June 2005 issue of REPORT ON PATIENT PRIVACY, the industry's most practical source of news on HIPAA patient privacy provisions.

Hu Hu Kam Memorial, built on the Gila River Indian reservation in Arizona, has seen its share of prayer circles, incense burnings and other rituals performed by the tribes it serves. So when the medicine man first appeared in the hospital's emergency room, no one gave him a second glance.

But this time was different. The medicine man approached the admitting clerk and requested to see a female tribal elder, whom he said had just been brought in to the 12-bed hospital.

The clerk had to act quickly. "She knew the medicine man, she knew the patient was in that culture, and she knew it was paramount that a medicine man be there right away," says Frank Ruelas, compliance and privacy officer for Gila River Health Care Corp., the hospital's parent company.

Although there was no previous record indicating the patient's wishes on this topic — this was her first admission — the clerk felt sure the woman would have wanted the medicine man to attend to her, so she allowed the visit. That was HIPAA violation number two in this incident; the first had occurred when a different employee spread word of the woman's arrival to the outside community.

And in the center of it all was privacy officer Ruelas, a Catholic who hails from East Los Angeles and admits he can "spot a priest from 10 miles away." But a medicine man? Before coming to Gila River, "I thought those existed only in the movies," Ruelas admits.

As Ruelas and other covered entities (CEs) in rural communities and elsewhere are discovering, their patients and employees often hold strong religious and spiritual beliefs that may appear to conflict with the privacy rule. As such, their policies and procedures need to bend to embrace these beliefs as much as possible.

They say an understanding of these beliefs and clear communication with staff and patients about potential conflicts can help prevent violations and weed out workers who are likely to be repeat violators.

But these compliance officers are also firm and united on this point: When violations of the law do occur, action must be taken, regardless of the personal beliefs that are held.

Medicine Men Became Recognized as Clergy

In the Native American culture, a medicine man is akin to a member of the clergy. Each tribe has one, and they have specialized training to administer to the spirit of the believer. The employee who disclosed the information about the female elder "did try to justify her actions," Ruelas says.

"Her motive was for spiritual reasons. She felt duty bound to alert whomever she could," he says. "This person knew that the way they shared the information was wrong. She had gone through training; she was well aware of the policies for disclosing information. She felt because of this person's status in the community, that the community needed to be alerted when one of their own was seriously ill."

But "the fact remained that the person who leaked that information was not authorized to, and we had to enforce that policy," says Ruelas. And the clerk probably should have checked with Ruelas before she let the medicine man see the patient, he adds.

Gila River Corp. has about 700 employees, 20 physicians and 50 nonphysician providers spread among its three clinic sites and hospital. As a health care provider, Gila River has made a commitment to honoring the beliefs and traditions of its patients and staff. Some, like prayer circles, are especially important to Native Americans when they have medical problems.

Yet, prior to this incident, Ruelas' policies and procedures did not identify medicine men and faith healers, as they are sometimes called, as recognized spiritual or religious leaders. He knew that had to change.

But he didn't know much about them, so Ruelas began to inquire as he also investigated the violations. Ruelas was invited to meet with the tribal governing council and was introduced to all the medicine men in the community. He then decided to add medicine men and faith healers to his list of approved clergy, which gives them all of the rights allowed under the privacy rule, such as access to patients who have not opted out of hospital directories.

When a patient in Gila River's care is transferred to another facility, policies also call for informing the receiving facility or physician of the medicine man's designation as a member of the clergy.

After he had learned as much as he could, Ruelas decided not to fire the first employee, who had a spotless 12-year-record with Gila. She was given retraining, had to write a statement explaining her actions, and was placed under close supervision for six months to ensure no more violations occurred. None did.

Ruelas reviewed the incident with the ER clerk, focusing on how it could be handled differently in the future. But he took no disciplinary action against her, saying she was the "middle person who had to make a snap decision." The information had already been disclosed, and she was probably honoring the wishes of the patient, Ruelas reasoned.

"I had to make sure we were very clear that we were respectful of their beliefs, and the need to help one another, but we all agreed that we needed to follow the law, and that took precedence," he says.

The Church and OCR View 'Sin' Differently

While Ruelas struggled to integrate spiritual beliefs into his compliance efforts, another privacy officer has contended with the actions of employees who hold strong religious convictions.

Shortly after the privacy rule went into effect, Judy Thompson, then the administrator of a small medical clinic in rural Washington State, learned that a medical assistant at her clinic had leaked protected health information to a member of his evangelical church. He said later that he did this so the congregants would begin to pray for the patient.

"He saw that the victim had been to the clinic and been treated for a certain medical condition that you could get by engaging in a behavior the church believed was a sin," Thompson says. "They pray for your spiritual health, after you have done something that results in a physical ailment. It has to do with sin, the burden of sin. They believe that all physical consequences are the result of sin."

But what resulted was disastrous for the patient. Once the employee put the word out, a prayer chain was begun, and "several hundred people" learned of the man's condition, which was then brought to the attention of the church's governing council.

The council voted to subject the man to "verbal stoning." "The person is made to walk a gauntlet, and people say very bad things to them," Thompson says. Then the man was "de-churched," or excommunicated.

In a two-to-three month period, the man "lost his job, all social contacts, everything," she says. "From my perspective, I believe this person's life was ruined. He left the community."

The episode didn't end well for the employee, either: Thompson fired him.

When Thompson confronted the employee, he said "of course" he had leaked the information, because, he said, "this person needs to be prayed for."

Adds Thompson: "He said he didn't think he had done anything wrong, and he would do the same thing if the circumstances were similar. He said he was doing God's work, which is a higher authority than HIPAA. He said if he was disciplined for his action, he would suffer with Jesus and call an attorney claiming that his employer was violating his right to practice his religion."

She used the incident to review privacy procedures with her staff, whom she reminded must not release information inappropriately, even if the patient is someone they know or believe could benefit from religious support.

"I am a highly spiritual person, and I have my own spiritual path that is critical and core to my being,"

Thompson says, "and I believe in the positive effects of prayer and meditation. But if people want to bring a prayer community into their well-being, that should come from the individual."

Thompson has since moved from the area; she now oversees privacy and security compliance, as well as quality assurance, for Cedar River Clinics, which operates in Tacoma and in two other Washington state locations. As far as Thompson knows, the former employee never made good on this threat to sue.

'Inner' Conflicts Exist at All CEs

Compliance officers "may not be thinking about this stuff. Rural communities are different; everyone knows everybody and can be related to everybody," according to Thompson.

This problem is more acute in a small community, but undoubtedly is an issue at almost every entity, she says. Ruelas agrees. "As difficult as it is for John Q. Public to follow a policy, it is even more difficult for someone in an environment where they know that person or may be related to them. There is an inner conflict that they face," he says.

Thompson has lingering concerns about the issue of religion, and urges CEs to explore how well they are addressing possible breaches by "well-intentioned" employees.

"I think we have people within our institutions who have access to information and don't understand the law, and believe they should be able to use that information [in ways that may be outside their job duties]," she says. "What kind of policing do we have? What are we doing to meet the 'minimum necessary' rule?"

She notes that churches where she currently lives routinely print names of the sick and deceased in a newsletter. "I am hoping that information is self-revealed" or disclosed by a family member, says Thompson.

Ruelas agrees that some of the lessons he learned can be universally applied, and that is vital for understanding the nuances of beliefs among the people CEs serve.

"One thing that I took away from this whole experience was that compliance officers have to acknowledge that they don't have all the answers — and they don't have all the questions," says Ruelas. "They need to seek out information. Oftentimes compliance officers are not willing to say 'I have a question.'"

"It was quite a painful experience for us all," he says. "But we learned that we will protect people's privacy, and we were able to build a relationship with the community."

Advertise With AIS

Privacy

Site Map