Medical reports released without written consent

[sleepyhead_2]

Although I am new to this site, I have learned so much from you seasoned veterans and newbies who give of your time and knowledge so that others can profit. Because of this site I have known appropriate questions to ask of my insurance company, the prospective DMEs, and have been able to intelligently and successfully convince my physician of my needs. What I am about to post may or may not be new to this forum, but I would appreciate any and all takes on the situation.

In 2004, I had a sleep study at a local hospital on the referral of my physician. I never saw the script, don’t know how it was handled but I was sent to a DME who sold me a brick which blows air and an ill fitting mask. I didn’t know I had options…you all have heard the drill. This time I have tried to equip myself with knowledge and have been calling different DME’s to ascertain those willing to work with me. My Doctor is aware of this and our arrangement is once I find one I want to work with he will write a specific script.

However, during this process I located a DME in my town which is affiliated with the local hospital (not the hospital in a nearby town which administered my sleep study in 2004). As this DME has a respiratory therapist, I made an appointment to visit with him and indicated I would be bringing in my sleep study and if it worked out would see that they received my prescription. My appointment with this DME is scheduled for 1/5/12. I did give them my name, my Doctor’s name and location of the sleep study.

I called the hospital which administered the study in 2004 to get my report and was told the only way it would be released to me was for me to drive the 30 miles in to fill out a request and sign an authorization allowing the hospital to release the study to me. I did this, but because the info was archived it took the most of 7 days, whereupon I drove back to pick it up.

Yesterday I received a call from the ‘sweet’ lady at the local DME where I have the January appointment with the respiratory therapist and was told all was “set”. She had received my sleep study report and had faxed a prescription to my Doctor and was just waiting for him to ok it so that when I came in next week I could go home with my equipment. I think I must have gone slightly ballistic. I asked her who authorized the release of information and was told she was just trying to help me out so it had been requested and my dr contacted.

Because my Doctor belongs to a specific group I am able to email him (in 500 characters or less). I emailed to him the DME had an unauthorized copy of my report and that I hadn’t been in to see them yet and to please not issue a script to them. His nurse called me to see if the script matched what I was looking for and I explained the situation to her.

It boggles my mind how, had the “sweet” lady not called, nor my doctor’s nurse to verify, I would be stuck again with a brick which blows air. All control completely taken from me.

My next call was to the sleep study hospital wanting to know how it is they would release my medical information without consent. I have thus far spoken to three different people from this hospital and at the last conversation was told that the issue would be handed over to someone in their hospital’s ‘compliance department’ and that it may take 30-60 days before they get back to me, but I should at that time receive something in writing.

What upsets me most of all is that this DME didn’t try to sneak something in, but openly requested and received medical information and didn’t mind telling me about it. I cannot help but think this is standard operational procedure from most DME’s and hospitals. Am I out of line to think this is criminal? I was a teacher in the public school system for 30 years and especially during the last 10-15 years privacy laws have been increasingly instituted and strictly enforced. How very skewed it is when it takes me 7 days to receive my own study but a DME can receive the same in less than 24 hours without consent.

I think the DME was wrong to request information without proper written consent, but I truly hold the hospital liable for violating my trust in releasing information without proper authorization from me or my Doctor.

What I am asking of anyone who may shed some light is this: Is my indignation even justified? If so, I am not willing to simply phone in a complaint regarding this as I have done thus far. My intention is to put my complaint in writing, firstly to the hospital who held my records and released them, but to whom, who’s at the top? Then I am wondering if there is a State overseeing board or agency which might be interested in how information/privacy is mishandled by hospitals on the state level… would anyone know which board this might be or how I would find out? And lastly, is there any sort of Federal agency which oversees hospital regulations pertaining to privacy issues?

I would appreciate any and all input even to tell me to go soak my head and cool off. Thanks for taking your time to read this…I hope it makes sense.

[LSAT]

In your request you must have given the hospital the name of the DME or they would not have known where to send the records.
I understand your anger, but the only place that got the records was where you were going to send them anyway. I would forget it and consentrate on getting the proper equipment from the DME.

[sleepyhead_2]

The hospital received a request from the DME and filled that request.

[sleepyhead_2]

Thank you, LSAT, for your response. I agree, my primary concern is to get the appropriate equipment.

[GumbyCT]

I think the DME was wrong to request information without proper written consent, but I truly hold the hospital liable for violating my trust in releasing information without proper authorization from me or my Doctor.

First make sure your doc didn't authorize this or that one of the forms you signed didn't authorize it when you took the sleep study.

What I am asking of anyone who may shed some light is this: Is my indignation even justified? If so, I am not willing to simply phone in a complaint regarding this as I have done thus far. My intention is to put my complaint in writing, firstly to the hospital who held my records and released them, but to whom, who’s at the top? Then I am wondering if there is a State overseeing board or agency which might be interested in how information/privacy is mishandled by hospitals on the state level… would anyone know which board this might be or how I would find out? And lastly, is there any sort of Federal agency which oversees hospital regulations pertaining to privacy issues?

I doubt that you will get far w/o a written complaint and even then it will be washed over.

I have posted HIPAA complaint links here before, I don't have immediate recall of that info. They are the federal level on this. A search (HIPAA complaint) will bring up that info.

IF you are so inclined you could contact you congress person also. Keeping in mind that untreated OSA also causes mood swings like you will see here on this forum.

I don't blame you for being upset but do get all the facts first. Is this a small town? any clues for us?

[Slinky]

As I am understanding it we are talking about the 2004 sleep study results?

The DME amd respiratory therapist you have the appointment with is affiliated w/the hospital where you just had a current sleep study?

The sleep study report you intended to supply this respiratory therapist is the 2004 results report? Why? Since it is the current sleep study results you would want your script based on.

Did you just want to have the RT discuss and compare the two sleep study results?

WHICH sleep study report are you upset that this DME provider has received?

[GumbyCT]

Here's the link
viewtopic.php?f=1&t=57985&p=545640&hili ... nt#p545640

Question: Is this your 2nd try at cpap? What happened the other times? and where is that equip?

[RocketGirl]

For whatever it might be worth, I would be utterly furious if my sleep study records were handled like that. What others are saying is true though, you need to be sure that you didn't sign some sort of release at the hospital that would have allowed them to send the records to the DME upon their request. But it also sounds like you were pretty clear with the DME that you wanted to meet with them before proceeding.

If I'm understanding you correctly, it also sounds like the prescription the DME just sent to the doctor for authorization was for a non-data-capable machine, which is certainly not what you wanted.

Only you can decide whether you feel there's enough of a question to pursue this, but if you decide to pursue it, hospitals are supposed to have a designated HIPAA Officer that you should contact. At the federal level, HIPAA violationsare handled through the Office of Civil Rights in the Dept of Health and Human Services - there are regional offices listed, to whom you actually send the complaint, depending upon what state you are in.

[NachtWürger]

It would be interesting to me to know what damage sleepyhead_2 suffered by having her sleep study (probably a one page summary with recommendations) released to a DME. What damage would justify the time and expense of the involvement of a Federal bureaucracy in a country of 300+ million people?

Never mind the prescription for an appropriate machine. That is a separate issue and she should fight to get a suitable data machine. Don't settle for anything less.

Just curious.

[chunkyfrog]

Now that you have the info, you can flat-out REFUSE to accept or sign anything until you can get a machine that offers all you need. Beware of the 'Advance Beneficiary Agreement' or whatever they call it. This says you agree to pay additional charges, and it is how they get around the 'no balance billing' agreement with your insurance.
DO NOT SIGN ANYTHING unless you read (and agree with) it thoroughly.

[Emilia]

The OP hasn't mentioned anything about a second sleep study. The 2004 study is the one to which she is referring. I agree, if the OP has not been using a machine in the last 7.5 years, that study is probably obsolete at this point and a new one should be ordered for more accurate data on which to base a Dx and Rx.

[cowlypso]

They did nothing wrong, if I am understanding you correctly.

If you contacted the DME and said that you wanted to use them, you therefore entered into a healthcare provider relationship with them.

HIPAA does dictate who your protected health information can be shared with, but this sharing falls within those bounds. Specifically, HIPAA allows for sharing "for your treatment and care coordination".

This allows your various healthcare providers to share information that is necessary for coordination of care. It is this allowance that makes it possible for you to call your doctor for a refill of a prescription, and then the doctor faxes it in to the pharmacy.

When you contacted the DME, said that you would be their patient, and then gave them the names of your doctor and the hospital you had your sleep study at, you gave your consent for the sharing of your records for coordination of care.

Now, if you had just been calling around to various DMEs in the "shopping" stage, and all you had given them was your name and phone number or something, and then they hunted down your doctors and records, that would be different. But you established a relationship with them and freely gave them that information, so they went ahead with coordination of your care.

Also, the DME cannot write a prescription for the doctor and then ask that the doctor approves it. What probably happened was that the DME has a standard order form that they sent to the doctor for him to fill out. These forms contain all the information the DME needs in order to bill your insurance company. I ran into this when I got a nebulizer. The doctor wrote out the prescription for the nebulizer, and I got it, but then the DME needed more information. They sent me a form that I had to take to the doctor and get filled out in order for the billing to be completed.

[cowlypso]

A few more thoughts...

I think maybe where you're getting confused is that the DME was able to get your records easier than you could. This is also typical. For you as a patient to get your medical records, you need to prove that you are indeed who you say you are. Usually this involves signing a form and perhaps showing your drivers license. Otherwise, I could call up the records department, give them your name, tell them I moved and give them my address, and they'd mail your records right to me.

But you've already signed the form that allows the health care provider to share information with others. Every time you go to a new doctor or provider, you sign that HIPAA waiver form. It states that you allow the health care provider to share information as allowed by law, including with your insurance company and for coordination of care. So yes, you did give your written consent, in 2004, when you signed that form.

[Mary Z]

Medical professionals exchange information from your medical record. This is different from releasing it to someone totally not involved with your treatment in a specific situation. I doubt you would have been stuck with a brick because you would not have accepted one. I would be happy the situation was handled so efficiently. There is a clause in the privacy form you signed that allows your doctor to exchange information directly related to your care and the specific situation. I know my DME communicates with my doc ( pulse ox results the latest) because the doctor ordered the test. I think the complaint and inquiry you already made are sufficient, writing and further complaining is pointless. Frankly I think you're mad because you had to drive and fill out a ROI to get your records. This is standard procedure (though it can sometimes be accomplished by mail with a written request for the specific information with dates and a copy of your ID). This is to prevent them from giving your records to your nosey somebody. You can talk or write to the manager of the unit and ask for a notation in your chart that no information be released to any medical professional without your express consent. I think this would be overkill. Did you suffer any damages because of this? Nothing happened that you couldn't change.
If not I think it's much ado about nothing.

[teknomom]

Sleepyhead_2, I interviewed several DMEs before choosing one and I did NOT authorize them to have access to my medical records. I understand your anger and would have felt the same if one of them had assumed that I was their patient without my authorization. I have the right to shop around for any other product without handing out personal, private information. DME shopping should be the same. I hope you can put it behind you after letting them know of your displeasure. Good luck with your therapy!