HIPAA does not trump open records law regarding public emergency response information

• A Mississippi municipality must release emergency response records because HIPAA allows disclosure of an individual’s health information when mandated by open records law, the state’s attorney general ruled.

Feb. 10, 2005 — Police and fire departments in Hattiesburg, Miss., will soon resume releasing information about injured victims of crimes, fires and other emergency situations, the city attorney announced in January, almost two months after the state attorney general’s office told him that the city is legally obligated to respond to such records requests.

City Attorney Charles Lawrence had argued that emergency responders were prohibited from releasing information by the Health Insurance Portability and Accountability Act, a federal law prohibiting health care providers from sharing individuals’ health information without their consent.

The city’s fire and police departments first invoked HIPAA in 2004 to withhold emergency response addresses from local journalists. When reporters said that the addresses were public records, Lawrence asked the Mississippi attorney general to clarify the fire and police departments’ position that HIPAA justified the secrecy.

Assistant Attorney General Heather P. Wagner wrote in a November letter that regardless of whether the police and fire departments were health care providers subject to HIPAA’s secrecy rules, a matter she did not determine, a federal HIPAA regulation provides that requirements of state open records laws such as the Mississippi Public Records Act supercede the rule’s privacy guarantee for individually identifiable health records.

Although Wagner’s letter was unpublished and focused on HIPAA’s applicability to Hattiesburg, media lawyer Leonard Van Slyke is optimistic about the impact the letter could have on other Mississippi communities. “I think other jurisdictions around the state will have a difficult time not looking upon it as precedential,” he said. “If a similar problem crops up other places, we’ll be furnishing them a copy of the letter I’m sure.”

Since HIPAA’s rules guaranteeing privacy of health information went into effect in April 2003, Texas and Kentucky attorney generals have adopted similar positions on the interplay between the federal rules and state open records law.

— RL

© 2005 The Reporters Committee for Freedom of the Press

Return to: RCFP Home; News Page