A Matter of Privacy

With the aim of protecting the privacy of medical information, the Health Insurance Portability and Accountability Act (HIPAA) takes effect April 14. Will your coaches and athletics trainers be ready to comply?

By David Hill

David Hill is an Assistant Editor at Athletic Management.

Athletic Management, 15.2, February/March 2003, http://www.momentummedia.com/articles/am/am1502/privacy.htm

During a football game last fall, a Hofstra University administrator walked along the Pride bench toward Head Athletic Trainer Rick Zappala. All the administrator wanted to know was how a recently injured player was doing.

“I said, ‘I don’t think I have permission to say. Let me go check,’” Zappala recalls. “He said, ‘What, are you kidding me? Is this a joke?’ I said, ‘No, I’m serious.’”

Serious, indeed. Under Hofstra’s procedure for complying with the federal Health Insurance Portability and Accountability Act (HIPAA), Zappala needed written permission from the injured student-athlete to discuss the injury with anyone outside the sports medical staff.

The medical-information privacy provisions of HIPAA do not fully take effect until April 14, but Hofstra decided not to wait to implement its new policy. The idea was to get all the bugs out before mistakes could subject the university to potential penalties of up to $250,000 and prison terms. As part of that preparation, the sports medicine staff had added a paragraph to its injury-report form where athletes under treatment could authorize the release of medical information to certain other people. Without that authorization: silence.

More recent interpretations of HIPAA have loosened the silent treatment somewhat. But every athletic department must still be aware of, and have a plan for, dealing with this new law. Whether you have no athletic trainers on staff or a large sports medicine team, the implementation of HIPAA will affect how athletic injuries can be discussed.

Key Concepts
Congress passed HIPAA in 1996 to deal with rising health-care costs and the medical industry’s growing use of electronic commerce and the Internet. Among several of its aims is to protect the privacy of people's medical information. Instead of being locked away in filing cabinets, patients’ medical records are increasingly being stored as computer files and flying around the Internet during electronic claims, billing, care authorization, and other administrative tasks. Horror stories abound about misuse and abuse of records; thus, HIPAA has privacy rules forbidding health-care providers, insurers, and claims clearinghouses from selling or otherwise providing medical information to anyone who doesn’t legitimately need it.

Unless the patient specifically authorizes release for a certain purpose, only those involved in treating a patient, insurers deciding whether procedures are covered, public-health officials, and researchers can access a person’s private medical information. And anyone who maintains such records has to set up procedures to ensure they’re kept private. So while the law was clearly written for aims far broader than athletics, it’s easy to see how any endeavor involving sports medicine can be affected.

“They really didn’t anticipate the effect on athletics when they first authored this act,” says Keith Webster, Administrative Head Athletic Trainer at the University of Kentucky and Chair of the National Athletic Trainers’ Association Governmental Affairs Committee.

As a result, exactly how the law affects athletics is not crystal clear, and many athletic departments are struggling with how to interpret it. In December, Webster met with the U.S. Department of Health and Human Services (HHS), the part of the federal government responsible for enforcing the law, and found officials there sympathetic to athletic trainers’ concerns.

“They seem to be willing to give us a little bit more liberal interpretation,” he says. “I think they were trying to help us through it, not intimidate us by holding it over our heads.”

But every school must decide for itself how HIPAA applies in its particular situation. And every school must decide how conservative or liberal it wants to be in interpreting the law.

Who is a Covered Entity?
The defining feature of HIPAA and how it relates to athletics boils down to covered entities. As defined by HHS, organizations or individuals who conduct health-care or health-insurance transactions electronically are covered entities, and thus subject to HIPAA rules. Transactions can be billing, payments, authorization for services, certification of referrals, benefits coordination, eligibility determination, and checking on the status of claims. Covered entities are mainly health-care providers, insurance plans, claims clearinghouses, and certain employers.

Having an athletic trainer on staff at a college, university, or high school does not automatically make the institution a covered entity. If the athletic trainer bills for medical coverage or bills athletes’ insurance plans for outside treatment, however, his or her employer may be a covered entity.

If an athletic trainer does not conduct any electronic transactions, but other employees in the institution do, his or her status becomes a bit murky. “What you have there is what’s known as a hybrid entity,” says Elizabeth Squeglia, a partner in the Columbus, Ohio, law firm of Bricker & Eckler, who has been focusing her practice and speaking regularly on HIPAA, including its athletics implications. “A hybrid entity is an organization with some aspects that are covered entities and some that are not. The classic example would be a major university where the student health clinic, which is owned by the university, is a provider, but the rest of the university—the engineering department, the college of art—are not.

“Under HIPAA, you have the ability to designate yourself as a hybrid entity and to designate what are your covered components—and which individuals are a part of them,” continues Squeglia. “By doing that, you limit the HIPAA requirements to that category of people you’ve defined as your covered health-care components, and the rest of the organization is not subject to it.”

Athletic trainers employed by a covered entity need to ask more questions, Webster says. “I know in this institution, with a medical center that has academic and clinical components, that legal entity is called a hybrid," he says. “On one day I’m a covered entity: I’m an employee of the University of Kentucky, which has components that do electronic transactions. Another day I may be determined to not be a covered entity because I’m not involved with the electronic transactions in our athletic department—even though our doctors are. Lawyers can make a pretty good living on interpreting ways around and abiding by these policies.”

Communicating Treatments
Another issue is relations between covered and non-covered entities who work together. For example, a team physician in a private practice working with a non-covered athletic department will need to communicate with the school's athletic trainers. The physician's disclosure of information about players he or she is treating would be restricted, says Squeglia, but the athletic trainers are not. If the physician discloses information to the athletic trainers do they then become covered entities?

Webster says his committee took these concerns to HHS and had their fears largely resolved. HHS clearly stated that protected health information can be disclosed for treatment purposes, Webster says.

“That allows the physician to call me and say, ‘Okay, Johnny sprained his knee, he needs ice, exercise treatment, et cetera,’ and that’s fine,” Webster explains. “If I’m not a covered entity under the privacy rule, he can still give me that information, and then the HHS enforcement stops at that point, allowing me to discuss this information with a coach.

“The release of the private health information [PHI in HIPAA lingo] for treatment purposes was a key clarification,” Webster continues. “Our receiving the information does not make us covered entities by definition. That was our fear: By us receiving information, we might become covered entities, and have to sit on that information and not disclose it.”

A non-covered entity still has no restrictions on what he or she says, adds Squeglia. “They are free under HIPAA to use or disclose that information however they want,” she says. “HIPAA simply doesn’t cover them.”

However, David Jones, Director of Sports Medicine at Jackson Hospital in Montgomery, Ala., and another member of the NATA Governmental Affairs Committee, is advising the athletic trainers he supervises and other athletic department staff to be careful just the same. If information passed from the physician to the athletic trainer to the coach consists of a bit more than a treatment plan, and it becomes headline news, the physician could be called on it. Mainly to protect the team physician, athletic department staff may want to be careful not to broadcast any athlete’s health information. Or, if an athletic trainer wants to discuss an athlete’s injury with a coach, the two should be careful to keep the conversation private.

“We’ll definitely be educating our athletic trainers on what we are interpreting as being reasonable and just in releasing information to a coach,” says Jones. “And the coach needs to realize that he or she doesn’t need to spread everything out among the entire team, the parent-teacher organization and everyone else, either. Technically it’s all going to boil down to—outside the athletic trainer, the coach, and the athletic director—no one really needs to be saying anything to anybody.”

Sign ’Em Up
While it’s important for athletic departments to understand the nuances of covered entities, some are choosing to bypass the restrictions by asking student-athletes to sign an information-release form. “You simply get a signed authorization from a player that authorizes the treating health-care provider, the physician or whoever it is, to disclose the information to the coach,” Squeglia says. “And with that, it’s permissible.

A HIPAA-release form need not be complicated, but the law does set forth some requirements for it to be valid, Squeglia says. First, it must have an expiration date—no one can talk about a person’s condition forever. How long it can last isn’t specified in the law, but lawyers believe a sport season or for one year is reasonable. Under earlier interpretations, the NATA Governmental Affairs Committee had recommended members get authorizations for each injury, but Webster says HHS officials have since affirmed blanket long-term authorizations.

Second, the authorization should be specific about who may disclose information. “You can name more than one person,” Squeglia says. “You can name the treating physician and the hospital emergency room, but you have to specifically designate by person or at least by who is authorized to disclose the information. You have to state who the information can be disclosed to. Then you have to specifically describe the information.

“So a valid authorization might say, ‘My treating physician, Dr. Mike Smith, is authorized to disclose information regarding any injuries I might receive during the course of the season, as well as my general fitness to play, to my coach or any designated member of the coaching staff.’”

Other required points include a stipulation that the person cannot be denied treatment for refusing to sign, and notice that if the information is disclosed to a non-covered entity, such as a coach, it may no longer be protected under HIPAA, Squeglia says. The form must also explain that the athlete has a right to revoke these authorizations.

However, HHS has also said that schools can require athletes to sign the form in order to be allowed to participate. “What they’re suggesting with athletes is making play contingent on release of information,” explains Webster. “And then if they choose to revoke, they’re choosing not to play.

“It goes back to what we do now,” Webster continues. “In August, we have athletes sign an authorization to release this information, but if they chose to revoke it, then they chose to not be on the team. It can be that basic.”

Culture Change
The task of dealing with HIPAA won’t end with well-written release-of-information authorizations, however. Even at organizations not specifically subject to the privacy rules, discussions about HIPAA have made people aware of other restrictions on releasing student-athletes’ medical information.

For instance, student-athlete medical records are generally covered by the Federal Educational Records Privacy Act (FERPA), which forbids unauthorized release of most student information. In many states, parental-consent laws also govern what medical information about minor student-athletes can be shared. And some state medical-privacy laws are more strict than HIPAA.

Aside from laws, many sports medicine professionals are talking about how handling student-athlete medical information is an ethical issue due for more thoughtful consideration. “In our profession, we may not be as diligent as we could be from a prudent or a common-sense standpoint, so it’s probably a timely thing for us to re-address,” says Webster.

Realizing this may mean changes in culture and operations. For example, athletic trainers at the University of Tennessee used to simply get a verbal okay from student-athletes before discussing injuries with the sports-information staff for forwarding information to the media. But now the authorization is a written part of the medical notes that athletic trainers maintain, and care is taken to be specific about what will be said and to whom, says Jenny Moshak, Head Athletic Trainer for the women’s athletic department.

When a basketball player was hurt in the closing minutes of a tournament game in November, Moshak got the okay from the athlete to give an injury briefing to a radio reporter. But when two print reporters questioned her a few minutes later, Moshak says she asked again.

“A lot of it is heightening the conversation and the communication, and just checking and double-checking, ‘Is this okay?’” says Moshak. “We haven’t been turned down yet by a player. But there’s a trust that a lot of our athletes have with us, and I don’t think we’ve ever broken that trust regarding the media. We’ve reiterated, case-by-case, asking the players, ‘This is what we’re going to tell the media. Is this okay?’”

Prudence is demanded for other reasons. Jones recalls a scene a few years ago in a hospital emergency room where the father of a high school NBA prospect demanded secrecy over the exact nature of his son’s knee injury. “He brought in our orthopedic doctor, the nurse, the ER physician, and me and said, ‘I know what the laws are. And nothing can leave this room. And I don’t want you even telling the high school coach. And if it comes out, I will take you to court on the basis that you hurt this boy’s chances of earning millions of dollars.’

“Here’s a kid that wasn’t even going to be around in another year,” Jones continues, “yet I have a long-term relationship to worry about with an athletic director who was there before this kid was even there, and who’ll be there long after this guy is gone. Still, I couldn’t tell anything to the athletic director.”

Athens (Ohio) High School Athletic Director Pat Murtha says he expects to explain HIPAA rules to parents at the beginning of next season and will include a release for parents to ensure that the coach can be filled in when injuries happen. He and the school’s athletic trainer will also have an in-service explaining HIPAA and other medical-privacy concerns to coaches. “The biggest thing is educating the coaches, the kids, and the parents,” Murtha says.

Zappala sees more mundane issues. For instance, athletes’ files should be in locked drawers in rooms with controlled access. “The days of having notes out on the table when you’re doing treatment are over,” he says. “And you can’t have the athletes reading other athletes’ files because it’s personal information. You also have to recognize the difference between a football player coming in while a field hockey athlete is being treated and asking, ‘How’s your knee,’ and the football player asking the athletic trainer, ‘How’s her knee?’”

For Zappala, it all points out that a person’s private health information should be respected and handled for the precious commodity it is. “Whether we’re determined to be a covered entity or not, we’re all going to adjust what we do to protect the confidentiality of medical and health information regarding our athletes,” Zappala says. “That doesn’t mean that it can’t be released, just that we’re going to need their permission to release it. It’s not that hard, but you need to set up procedures to allow that to happen. We will live and learn, and then it will just become another part of our job.”

Educating Athletes
Before asking student-athletes to sign a HIPAA-release form, you must educate them about what they are authorizing. At Hofstra University, Head Athletic Trainer Rick Zappala has found it equally important to clearly outline with athletes the pros and cons of not signing release authorization forms. He feels many overlook the cons, which can be serious.

For one thing, details of injuries and the nuances of prognoses are easily lost if sports medicine professionals are cut out of the communications loop. “I’ve had athletes walk out of the doctor’s clinic and go see their coaches,” Zappala says. “Then the coach comes to see me and says, ‘The athlete just came to see me and said the doctor said this is what they have.’ And I respond, ‘Well, I was in the room, and I didn’t hear the doctor tell them that.’ And many times, that misinformation also goes to the media.”

Athletes with aspirations for the next level of play may want the seriousness of their conditions withheld. But Zappala points out that in many cases, openness about injuries can be in an athlete’s long-term best interest. “We had an individual that did not perform up to most people’s expectations this year, and the truth is that there was a series of injuries that affected this person’s performance,” he says. “The athlete did not want that information released, so it appeared that the athlete was having a lousy year, when in reality he was fighting through injury.”

In addition, athletic trainers can clear up misperceptions about an injury before rumors spread. For instance, a “knee injury” may often be interpreted as a torn ACL when the condition may be found less serious after tests that can’t be done on the sidelines. “If I report an injury, I always say that we’re scheduling an MRI and there will be a follow-up appointment afterward where we will confirm the potential diagnosis,” Zappala says.

Openness can also help athletes in other ways, Zappala says. “It’s certainly not for me to tell someone that they should release information or not release information,” Zappala says. “But you’ve got to let them know what the pros and cons are, and let them make the decision.”