HIPAA, Case Reports, and the 'Small Cell' Problem



Thrilling case study: emergency doc cracked chest to save 42 y/o woman in cardiac tamponade after ablation therapy. http://bit.ly/umnydc
Details about the case are quite specific, and the case report heralds from a town in Minnesota. It describes, in very specific detail, the management of a patient who presented to the emergency room in shock from cardiac tamponade after a catheter ablation procedure for right ventricular outflow tract tachycardia.

Is this unique case report Health Insurance Portability and Accountability Act (HIPAA)-compliant?

I would say, according to our current definition of HIPAA's requirements for de-identification of "personal health information," such a case report is not HIPAA-compliant. Nor could such a case be mentioned on a blog for that matter, even though it presents important information for people dealing with these patients.

There is an important quality-of-care role in telling clinical case-report stories. Specific case reports can bring important specific clinical details to the attention of the medical community. For instance, if doctors had not been willing to describe several cases of pulmonary vein stenosis or two cases of esophageal perforation in a major medical journal years ago, how many more people might have been injured as a result?

Yet HIPAA stipulates that there are "18 little rules" that doctors must follow when they report important clinical cases, and often it is the specific clinical scenario that highlights the case's importance. But since all patient care is local, a doctor's location therefore implies a patient's location at a certain time.  As a result, specific patient case reports more often than not expose HIPAA's: "small cell problem:"
The "small cell" problem violates HIPAA, and HIPAA means business: millions of dollars of "business" that gets released in press releases from the Department of Health and Human Services when they catch their prey.

But doctors should not be afraid of publishing case reports, especially since there are good reasons for them clinically. Further, when doctors make good-faith efforts to conceal patient's personal information in those reports, they should not be subject to threats of HIPAA's "small cell" problem. Simply put: the "small cell" problem is HIPAA's, not the doctors'. Extending the definition of personal health information as defined by HIPAA to include "any other unique identifying characteristic" about a patient's case limits doctors' ability to improve care to our patients while greatly increasing our legal culpability for that effort.