UNIVERSITY OF MINNESOTA “Tein Cex Compara aaar SiE orld Katto Mieapolis MN 38455 Chie Health Information Complance Officer and Iietolaamn ede Director, Heath information Privacy & Conplance Ofce Phone 6120265844 ‘pil 28, 2015, Mr lot, ‘Thank you for your letter dateé April 10, 2015, expressing concern about a possible violation of health Information privacy. | am aso In receipt of your letter dated April 16, 2015 to Fairview Research ‘Adminstration regarding the same possible violation. | have completed an investigation of this matter In coordination wth Fairview Heath Services and wanted to share the results with you. Please note that {his letter will seve as the response tothe letter you submited tomy attention as well asthe letter you submitted to Fairview Research Adminstration ‘The incident you identified was related toa news report that ran on May 19, 2014, on KMSP News. In that report, 2 patient identfied as “Robert” spoke with a news reporter, Jeff Ballon, about his involvement in 2 drug study at the University of Minnesota. You ralsed a concern thatthe patient's ‘medical information had been inappropriately shared with Brian Lucas, Director of AKC Communications, in connecton with that story, and that the sharing ofthat information resuited in violations under the Health surance Portability and Accountabilty Act, the Minnesota Health Records ‘Act and University health privacy policy. {sm sure you are aware, the laws you identified are intended to protect patient privacy. As such, those same laws limit the arount of detail | can share with you inthis response, However, {belive ‘can address your cancers in manner that does not dicose any protected health information. ‘The patient in this instance signed an authorzation permiting the release of his recor to Jef Ballon at KIMSP News and permiting the University to discuss those records with Mr. Ballon. After receiving the signed release the Universit forwarded the patient's records to Mr. Balon. Me. Ballon prepared 2 series of questions based on the records and submited those questions to AHC Communications to ‘obtain responses. AHC Comunlations worked with the patient's provider to develop those responses. “Thete are several relevant aipects of the Health Insurance Portablity and Aecountabilty Act and its felated regulations (collectively refered to as HIPAA) applicable to thls particular situation. Fest, the Feleese oF the pation’ revs Wo am hnlvidual wii ie ot subject to HIPAA, namely Me. alto, _Eenerally means any action taken by Me. Ballon with respect to those records isnot subject to HIPAA. When Mr. Ballon developed questions related to the patlent’s condltion, and ultimately shared the patient's information in the media, that information was no longer protected by HIPAA. HIPAA ‘addresses this by requiring that where a release of records requires an authorization, the authorization must include a statement providing that the release of records may result in the redislosure of the records, and that the records may no longer be protected under HIPAA. The authorization signed by the patent inthis instance included sucha statement.Second, the University s designated asa “hybrid entity” under HIPAA. This generally means that parts of the University’s function: are subject to HIPAA, and other parts are not. The components of the University that are subject tc HIPAA are generally the areas providing health care services, as wellas the ‘areas that support the areas providing health eare services and that may require access to heath information and heath eco'ds to provide that support. Under HIPAA, health information and health records may be shared with support areas within the hybrid entity so that they can perform these support funetions {ANC Communications s part ofthe University's hybrid entity. AHC Communications supports areas that provide health care servis, cuch as in the development of storiez and communieations involving Patients, and may require access to health Information and health records to pravde that support. ‘Consequently, the role played by AHC Communications inthis instance fs permissible under HIPAA. Under the Minnesota Heath Records Act, a similar conclusion would be reached. Minnesota law permits the release of health records upon patient authorization, which authorlzation was provided in this instance. Further, the Minnesota Health Records Act does not prohibit the internal sharing of Information between a provider and the entty’s support units as needed to provide that support Consequently, the role played by AHC Communications in this instance is permissible under the ‘Minnesota Health Records Ac. Given that the patient inthis instance signed an authorization to release his records to Mr. Ballon and discuss those records with Mr. Ballon, and given that Mr. Lucas is permitted to access health information and health recor in in connection with his role at AH Communications | ind no violation Cf HIPAA or the Minnesota Health Records Act by Mr. Lucas. Ukewise I find no violation of University health information privacy pelicy by. Lucas You raised an addtional coscern about disclosure of the patient's health information “for use in a television broadcast” by KMS? News “done in order to discredit” the patient. The statements a issue 95 referenced in you letter were made as part of the discussion between the Unversity and Mr. Ballon, Which was authorized by the patients release. The decision about what information to aie publicly was made by Mr. Ballon. However, viewed in the context ofthe entice dialogue between the University and Mr. Ballon, It's clear that those statements were not intended by the University to be aired as part of Mr. Baillon’s media report, but were rather intended to suggest to Mr, Ballon that i was not appropriate to expose a patent nis cgcumstances tothe mela spotlight. | appreciate your concern for heath information privacy and thank you for your report. Should you have any further comments or questions regarding this matter, please feel re to contact me. LF £: Brooks Jackson, Dean, Medial School and Vie President for Heath Sciences Brian Dahlin, Chet information Security Officer os Dai, nformation Privacy Director, Fairview Health Services