Indiana University Health officials released a statement Friday that one of its physicians did not violate privacy laws when she shared a story with the IndyStar about an abortion on a 10-year-old Ohio boy.
“As part of IU Health’s commitment to patient privacy and compliance with privacy laws, IU Health routinely initiates comments, including news stories about Dr. Caitlin Bernard,” IU Health officials said in an email. “IU Health conducted an investigation with the full cooperation of Dr. Bernard and other members of the IU Health team. IU Health’s investigation found Dr. Bernard to be in compliance with privacy laws.”
Earlier this week Indiana Attorney General Todd Rokita questioned whether Bernard, a gynecologist, violated HIPAA rules, without testifying. The Health Insurance Portability and Accountability Act passed in 1996 aims to protect the privacy of patient information and violations of the law can lead to settlement.
Bernard provided the media with the girl’s age and where she lives. The abortion report released Thursday that Bernard submitted to the Indiana Department of Health in accordance with state law confirmed the doctor’s report.
Dr. Caitlin Bernard of Indiana reported on the abortion of a 10-year-old girl in Ohio.
Experts in HIPAA compliance say the rule exists to prevent the release of personally identifiable information. The question is where to go to get more information, said John F. Howard, director of the HIPAA Privacy Program at the University of Arizona, speaking clearly about the law and not these specific situations.
“Usually the trick here is to let you know when health information will be available,” Howard said in an email. “The best rule of thumb is that if the information can be linked back to the person, and the past, present or future medical treatment of the person, it is known.”
While the law lists various identifiers that must be removed, such as name, date of birth, and address, there is a final “catch all” category that includes any identifier, he added. The group requires providers to ensure that the information is not personal to the patient.
Contact IndyStar reporter Shari Rudavsky at email@example.com. Follow him on Facebook and at Twitter: @srudavsky.