Maryland AG Says Patient Photos Trigger HIPAA: Did WMDT & Firefighter Violate HIPAA Laws?

The Maryland Attorney General’s office has issued a memo to EMS providers and personnel stating that photos taken of patients who are identifiable constitutes “individually identifiable health information” under HIPAA, the release of which through any means (including social media) is a violation.

The memo was dated May 30, 2013 and began being circulated to local and regional EMS providers this week. It was issued by Assistant Attorney General Sarah M. Sette.

Quoting from the memo, HIPAA applies to “photographs of patients taken by EMS providers if the patient can be identified, whether directly through their features, or indirectly through unique clothing or a license plate or the nature of the particular injury or motor vehicle crash or event. Similarly, a photograph of a medical record such as EKG, or a unique injury or treatment, might also be susceptible to being linked to a specific patient.

“Accordingly, distributing such a photograph, whether via email, by posting it on Facebook, or through other media, may be an unauthorized disclosure of protected health information and violate HIPAA.”

The memo also discusses the penalties that violators face, including fines of up to $250,000 and 10 years in prison, and the fact that Maryland state law governing medical confidentiality, Health General Article, Sections 4-30 l, et seq., is also applicable and carries fines of up to $250,000, imprisonment, and possible civil liability to the victims.

Here is a copy of the memo. MD EMS Social Media

For those concerned, neither HIPAA nor state medical confidentiality laws prohibit the taking of photos, dash or helmet cam video, or other types of imagery. What is required is that any imagery that shows an identifiable patient must be treated as part of the patient’s confidential medical record.

Publishers Notes: If you click on the link above, MD EMS Social Media you'll find far more details. For example: "including demographic information"

I bring this to light because of what an EMT/Firefighter and WMDT News brought to the public by producing photographs of the interior of a local mans home after he passed. If you can identify the patient/victim by association, your in violation. 

Another format we researched stated the following: This definition includes photographs of patients taken by EMS providers if the patient can be identified, whether directly or indirectly. Health information that neither identifies nor provides a reasonable basis to identify an individual can be shared.

Under HIPAA, information related to a patient’s medical condition is deemed to identify the patient if it contains any of the following identifiers of the individual or of relatives, employers, or household members of the individual:

(A) Names
(B) All geographic subdivisions smaller than a state, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census:

(1) the geographic unit formed by combining all zip codes with the
same three initial digits contains more than 20,000 people; and
(2) the initial three digits of a zip code for all such geographic
units containing 20,000 or fewer people is changed to 000.

Source

GO HERE to view our original article.