HIPAA be Damned

We can be pretty informal in my office. Sometimes patients would rather sit by the front desk and chitchat with the office staff instead of going back to the waiting room, lovely though it is, and read magazines.

One of those regulars was in the other day. As she sat there filling us in on the latest goings-on with her grandchildren, the next patient walked in. As it happened, she was another lovely lady who preferred the company of the staff to the more comfortable chairs in the waiting room, so she also perched next to the check-in counter and joined the conversation.

After a few minutes of this informal give-and-take among us all, I found myself feeling ever so slightly rude. I realized it was my home training asserting itself, as I heard my mother's voice in my ear saying, "Introduce them."

So I did: "Mary, Jane; Jane, Mary."

First names only, of course. Including their last names would make them uniquely identifiable. This would constitute "Protected Health Information," which needs to be zealously guarded from inadvertent disclosure. That's what HIPAA says.

The first lady had been looking carefully at the second, but now she said, "What's your last name?"

I had to bite my tongue not to scream, "NOOOOOOOO!! HIPAA says you can't tell her that. It's Protected Health Information!"

But of course there's nothing in HIPAA that says a patient can't tell another patient her last name. They ended up exchanging not just current last names, but also maiden names -- and discovered they had gone to high school together fifty years ago. They caught each other up on their families: one was widowed; both had grandchildren. They laughed and had a lovely visit, foreshortened by me, party pooper that I had to be, to actually provide, yanno, medical care to them.

The take-home message is that privacy is the patient's. They are the ones who can choose what to do with it, including breaching it to reconnect with an old friend. It was a lovely encounter to witness, and the hell with HIPAA.