On April 14, 2003 new federal privacy regulations went into effect, which dramatically changes how health care providers and health plans use and disclose patient medical records. The new regulations were developed by the Department of Health and Human Services ("HHS") pursuant to the Health Insurance Portability and Accountability Act ("HIPAA") passed by Congress in 1996. The HIPAA Regulations establish uniform national standards governing the confidentiality of patient medical records which has historically been governed by state law. Because HHS may impose penalties against health care providers for non-compliance, including civil monetary penalties up to $250,000 per incident and possibly jail time in the most egregious cases, the media will likely find it more difficult to receive medical information than in the past.

Unless authorized by law or the patient, health care providers may only use and disclose patient medical records for treatment, payment, or health care operations (administrative and management purposes). Media requests for information are not specifically authorized by law nor do they fall within the definition of treatment, payment or health care operations. Therefore, in most cases reporters will need a signed authorization before receiving patient medical information.

In some instances the media can receive confirmation that the patient is present in the facility and the patient's general condition. HIPAA does allow providers to maintain a patient directory with information regarding the patient's location in the facility and general condition information. However, patients have the right to opt out of the directory and individuals requesting directory information must ask for the individual by name.

Although reporters will now find it more difficult to obtain medical information, reporters themselves are not subject to the HIPAA Regulations and may find other avenues of obtaining the information. HIPAA applies only to "covered entities" which include all health plans, all health care clearinghouses and health care providers who submit information electronically in connection with certain covered transactions. Once medical information is disclosed to non-covered entities, HIPAA no longer applies. Therefore, reporters may find other sources of medical information, such as family members or law enforcement. In addition, only covered entities are subject to HIPAA's penalties. Therefore, if a health care provider wrongly discloses information to a non-covered entity, the health care provider is subject to penalties but not the recipient of the information.

Finally, reporters should be prepared for providers who are more protective of information than even HIPAA requires. HIPAA establishes a "floor" for patient confidentiality; however, health care providers can be more protective of a patient's medical information. For example, even if HIPAA allows providers to disclose the patient's general condition if maintained in a directory, some providers may decide not to disclose this information other than to a patient's next of kin or other family members.