Forbidden fruit of the HIPAA tree

August 27, 2009 10:01 AM

[HIPAA filter]: When dropping off our child at daycare (a small, home daycare), my spouse - a pediatrician - ran into a patient who is not vaccinated. I know you're not a lawyer; I know you're not our lawyer - what are our options?

The daycare is full of our friends, and their children. Our child is vaccinated (according to the recommended schedule), and not truly our primary concern in this - it's the children of our friends who are too young to have received their vaccinations yet. Additionally, we plan to have another child soon and wouldn't want someone else's unvaccinated kid putting ours at risk.

The best course of action I can conceive is to (A) review our contract and see if it says anything about required vaccinations, and (B) talk to our daycare provider about what her requirements are for new kids (can they be admitted without a vaccination record? what are the requirements that go along with her license, etc).

But the problem remains - if this child is admitted regardless of their lack of vaccinations, what course of action can we take? Obviously, we can remove our child (assuming we could even find another provider), but what do we do with the forbidden knowledge? How do we warn/protect our friends' children from this possible risk if we're not allowed to share this information?

Extended details: we are in Colorado.

posted by anonymous to health & fitness (22 answers total)

You're allowed to say to your friends: "We strongly suspect that not all of the kids at this daycare are vaccinated. Here are the associated risks. Would you like to join us in talking to the daycare provider about this?" The identified knowledge is protected, but the general knowledge is not. If you provide no identifying information, and if the group of kids exceeds three sets (yours, your friend's, his patients), then you've done nothing wrong. As a matter of legal protection for yourselves, however, your actions in not identifying the patients may not protect you. If your daycare provider moves to make sure all kids are vaccinated, your husband's patients may reasonably assume that your husband spilled the beans.
posted by OmieWise at 10:13 AM on August 27, 2009

How do we warn/protect our friends' children from this possible risk if we're not allowed to share this information?

"We took Johnny out of the X Daycare after learning from the provider that she did not require vaccination records of new enrollees. I wanted to share this information with you because of my concern that your underage-for-vaccination child might be in daily contact with a child who was potentially a vector for life-threatening childhood illnesses like measles and whooping cough."

Or, if you don't take Johnny out of the X Daycare, the same thing applies, except for the "Johnny's been vaccinated, because he's old enough, but we're very worried that your underage-for-vaccinationg child" etc.
posted by Sidhedevil at 10:15 AM on August 27, 2009

In my state (California), even the home daycare providers have to keep vaccination records. I'd talk to your DCP and ask, in a general sense, what the vaccination status is of the kids there. Maybe she can't say which kids are or aren't on the vaccine schedule but can say if there's a kid who isn't getting vaccinated?

I'd be worried too, for what it's worth.
posted by otherwordlyglow at 10:16 AM on August 27, 2009

If the daycare provider is not complying with relevant regulatory requirements you could always tip off the regulator anonymously. Trouble is that it doesn't sound like you've got an abundance of providers to choose from so that may backfire in terms of even less facilities.
posted by koahiatamadl at 10:17 AM on August 27, 2009

perhaps... and this is a big perhaps, if you made absolutely sure you did not identify the non vaccinated child, or do/said anything that indicated how you know the information, you could say something like, "Hey, friend X, because of privacy concerns I can't tell you how I know this, but I do know that there is a child at our day care provider who I strongly believe is not vaccinated. I can't answer any question, nor can I tell you what to do with this information but I thought I'd let you know".

other than that, yeah check into what the provider's policies are, check what the State guidelines are for day-care providers
posted by edgeways at 10:19 AM on August 27, 2009

I'd find out what your state requires first, and then talk to your daycare provider, politely, about whether or not they are in compliance with the state. If they are, no problem, and you can pull your kid out if you want to, and tell people exactly why. If they aren't, I'm assuming they'd address it pretty fast.
posted by roomthreeseventeen at 10:19 AM on August 27, 2009

Is the child care regulated? Do child care regs in CO require vaccination? Talk to the child care provider. This is one reason regulated child care is a good thing.

I reserve particular scorn for parents who choose not to vaccinate their kids. Vaccination is a community responsibility. Every child assumes a tiny bit of risk so that all children can be safer. Families who don't vaccinate are taking advantage of families who do. They get the benefit and avoid the risk. This makes then anti-social, irresponsible and selfish.

Okay, but the risk is still not huge; it's likely that herd immunity will protect all of them. Your husband may not violate patient confidentiality, but might be able to report un-vaccinated kids to the child care regulatory group, and still be legal.

IANA health care professional or lawyer.
posted by theora55 at 10:24 AM on August 27, 2009 [1 favorite]

Have you considered that the risk of this unvaccinated child becoming a vector for some vaccinatable disease is probably about the same in our society (given the rate of vaccination) as if this child were vaccinated? All vaccination programs work on the basis of "herd immunity' at some level. I say this as a parent who had his children vaccinated.

It sounds like you are more concerned about the idea of this child not being vaccinated than the actual risk. Maybe you should research what the actual risk is before you do anything. Talk to your pediatrician and ask them whether one child not being vaccinated poses a serious risk to the younger children.
posted by geos at 10:29 AM on August 27, 2009

Here's a link to Colorado immunization and exemption information. Here you will find a link to Colorado daycare licensing information.

You do not indicate if the daycare is licensed or not.

If they are a licensed facility, they likely have and are following established vaccination/exemption guidelines. You can click the second link above to verify their license and view any online inspection reports. Contract or not, there are guidelines they must have you all follow one way or the other.

If you only know of their vax status for them as a patient, and likely even if other than as a patient, AFAIK, you have no basis to discuss it either with the provider directly or others with children in the provider's care.

While the youngest children are in a not-yet vaccinated state, this window is quite small, yes? Vaxes that aren't started at birth are given starting at two months and it is unlikely there is a two-week old baby in the facility, yes?

In general, I think you can open a conversation with the parents of the too-young child to have them confirm with the provider that all older children are not permitted to mingle extensively with the too-young children, and that a lot of handwashing, etc is used in general - not necessarily in regards to vaccinatable communicable diseases.

If they are an unlicensed facility, HIPPA still applies, but unlicensed also might mean uninsured. :(

I'm trying to think if an anonymous call to the county licensing (or state, I didn't read my links a lot) asking these questions might be in order. I've called (anonymously) to ask for an inspection on a daycare I toured that had several unsafe health violations going on.

My daycares over the years always got a heads up when the inspector was coming through (or were given X amount of time to update their records) and gave us a week or two to get our paperwork updated if needed. A call to licensing in an anonymous fashion questioning if the children are all vaccinated won't do anything from what I can guess, but if you're concerned that attendees health paperwork might not be in order (you don't state if you know if they have the exemption filed properly if at all) they can at least get that checked. But that would likely just annoy everyone, unless the director volunteered too much information that the board was verifying everyone's vax information or exemptions.

What I do know of HIPPA and general vax information and school attendance from my personal experiences, parents in Florida who choose to not vaccinate fully or at all are also agreeing that the children may be required to be removed from school or daycare during certain types of outbreaks of communicable, vaccinatable diseases.

The private, licensed, daycare (no public funding, large, center-based) has rules for all students about "when to send and keep children home" that are applied equally to vaccinated and non-vaccinated children in addition to following Health Dept guidelines and Daycare Licensing Guidelines (and corporate guidelines).

While it is an open-ish facility, the infants and early walkers (below the 1 year age, but not much above it) are kept in fully enclosed rooms and not allowed to mingle with the older children much, if at all (sometimes I'll come in as the center is just opening and not fully staffed and a head-holder but non-crawler will be on their own blanket with an admiring older child cooing or stroking the child's shirt or head (never face or hands) gently).

The public school system and health department intimated that I hadn't thought my personal vaccination decisions through and tried to imply that it would be a lot more trouble to keep my child(ren) home in case of an outbreak.

However, in our state, someone other than a cranky secretary has guidelines that determine when and if a non- or under-vaccinated child should stay home for both general illness (same as vaxed kids) and special quarantine circumstances. These decisions are rendered by public health officials who have defined guidelines of determining that the children be removed from public/private facilities.

In my ten+ years of researching and living in my state, there has been no call in my area schools for any sort of medical shut down or quarantine of non- or under-vaccinated children for vaccine-available diseases. YMMV.

posted by tilde at 10:32 AM on August 27, 2009 [1 favorite]

geos - The posters spouse IS a pediatrician. And the poster is mostly worried about the fact that they might be sending another child to this provider at an age where it will not have had all of its vaccines yet. This child would be at risk from contact with un-vaccinnated children.
posted by otherwordlyglow at 10:33 AM on August 27, 2009

A quick back up of what I'd said: There are birth vaccinations, and vaccinations start then or at two months (my former ped office had a special waiting room for children under 2 months of age). Big time other vaccinations start at around twelve months.

The original poster said her spouse is the pediatrician, and used the word "our" a lot. It sounds as if the medical-school educated pediatrician is also concerned sufficiently about disease vectors to remove their own children to protect their children further from the diseases from which they are already vaccinated against. I disagree except perhaps for the flu, which does seem mighty perky this year. But again, lots of handwashing, discouraging of certain types of sharing, and lots of cleaning can help that, as well as keeping sick kids home, vaxed or not unless this small provider has specific guidelines for caring for sick children (separate rooms, extra adult help).

The socially weasley thing to do might be to start a conversation mocking "chicken pox parties" or something while the non-vaxers and super-young baby parents are both in the room.
posted by tilde at 10:44 AM on August 27, 2009

Are there records or a database that your spouse has access to that shows all children and if they have been vaccinated?

What I am getting at is that perhaps this child used another pediatrician.

Lastly, if your spouse is this child's pediatrician, why doesn't he/she call the parents to schedule an appointment to get them vaccinated?

If the parents just missed the appointment, why not do a follow up and casually drop the hint that your children share the same school and you saw them there and it reminded said spouse that the child hasn't had the proper vaccinations as required by state mandate or something along those lines.

Not being snarky, I just don't understand the dilemma. From the wording of your post it seems that the spouse is the child's pediatrician and is responsible for the medical care of the child, like administering vaccinations...
posted by Gravitus at 10:46 AM on August 27, 2009 [1 favorite]

Didn't your spouse already break HIPAA by telling you? From what I understand, I don't think your spouse can relate a patient's health information. Anyway, here's a guide.

Related to the day care situation - from section 59: "Does HIPAA Allow Uses and Disclosures Without My Approval?

Yes, does it ever. The HIPAA rule allows dozens of different uses and disclosures without any need for patient consent or authorization. The rule permits so many uses and disclosures that it is hard to count them. The rule has about five pages of dense type describing allowable uses and disclosures of health records. "

Perhaps you could twerk it to fall under the 'public health' guidelines, since that is basically what you're worried about. Here's the HHS page on the subject:

"Must a health care provider or other covered entity obtain permission from a patient prior to notifying public health authorities of the occurrence of a reportable disease?

Answer:
No. All States have laws that require providers to report cases of specific diseases to public health officials. The HIPAA Privacy Rule permits disclosures that are required by law. Furthermore, disclosures to public health authorities that are authorized by law to collect or receive information for public health purposes are also permissible under the Privacy Rule. In order to do their job of protecting the health of the public, it is frequently necessary for public health officials to obtain information about the persons affected by a disease. In some cases they may need to contact those affected in order to determine the cause of the disease to allow for actions to prevent further illness.

The Privacy Rule continues to allow for the existing practice of sharing protected health information with public health authorities that are authorized by law to collect or receive such information to aid them in their mission of protecting the health of the public. Examples of such activities include those directed at the reporting of disease or injury, reporting deaths and births, investigating the occurrence and cause of injury and disease, and monitoring adverse outcomes related to food (including dietary supplements), drugs, biological products, and medical devices."

I suppose there would need to be some kind of report sent to public officials, and then the people in question could then be notified of said report. I don't know. I still think the answer is no, and that this falls under HIPAA.
posted by cashman at 11:00 AM on August 27, 2009

Good point, cashman, I forgot that the Ped spouse broke HIPAA; most of the doctors I consult rely heavily on specialized office administrators to keep them from tripping over the intertwined legalities. Of course, who is going to worry unless he or she is caught admitting it (yay anon) and reported for it (now that this record is on the 'net if it can be traced back to her, hopefully not).

So I guess all of my advice on calling licensing might be construed as further violating HIPAA (gah I keep spelling it wrong!). I don't see anything about my posting about "how to further break the law" being against MF's TOS, but if it is, sorry, ignorance of the TOS and all that.

My advice on handwashing, asking the provider about any new rules WRT the new flu shot and potential epidemic, and trying to make the non-vaxer expose herself might also be kind of not-good in furthering violation of HIPAA. But less so than calling in licensing. Sorry again!
posted by tilde at 11:08 AM on August 27, 2009

If your spouse works in any sort of medium-to-large institution, or if his/her clinic is under the oversight of a larger healthcare providing body, there will be at least one person designated within the organization to answer questions about HIPAA compliance. This would be the best person to ask about how to handle the situation, as they can help the physician protect his/her own legal butt, and also protect the institution's legal butt, since both will be on the line if the physician messes this up. It is definitely worth noting, though, that this doctor already messed up by telling his/her spouse about another child's vaccination status.

All that said, HIPAA does allow discussion of some health information, provided that the patient cannot be identified by any of the facts presented. Depending on the number of other kids in the daycare, it might be allowable to tell friends "I suspect that one of the children at the daycare is unvaccinated."

IANAL, IANA-HIPAA-Expert, etc. Have your spouse find the person at his/her institution who is.
posted by vytae at 12:32 PM on August 27, 2009

Step back and remember what HIPAA is designed for: it protects patients against providers disclosing their medical records without their consent. It provides this protection because lots of medical conditions are stigmatized, and many people would not have access to health care for fear of that stigma if the confidentiality of their records was not protected. Also, patients with some conditions face discrimination. A classic example would be that HIPAA and other (criminal) laws prevent a provider from disclosing a patient's HIV positive status.

HIPAA is broadly written to cover not only the disclosure of patient information by name, but also the disclosure of enough information that would allow someone to identify the patient. So, assuming any of your friends know that your husband treats the unvaccinated child, even just saying that you know "somebody" at the daycare is not vaccinated would likely violate HIPAA. (I assume here that your husband treats the child. If he just has access to the child's records, and looked them up to satisfy his own curiosity, he has a larger HIPAA problem).

There is no exception built in to HIPAA to allow disclosure when it is in the interest of the doctor, or the doctor's family, or the doctor's friends. Looking for a clever way around HIPAA so you can still "warn/protect your friends' children from this possible risk" (which suggests that your goal is to get the unvaccinated kid kicked out of day care) is a bad idea, and indicates that your husband really needs some refresher HIPAA training.
posted by A Long and Troublesome Lameness at 1:18 PM on August 27, 2009 [7 favorites]

geos: "All vaccination programs work on the basis of "herd immunity' at some level."

As someone who was severely allergic to the MMR vaccine (a week of vomiting and my arm being swollen to the size of a baseball - when I was a preschooler), and could not get my final booster in 5th grade, herd immunity is not going to make me feel any better if I get measles, mumps, or rubella from someone who chose not to vaccinate their child. Herd immunity is meant to protect people like me, who CAN'T get the vaccine. People who do not vaccinate their children jeopardize herd immunity unnecessarily.
posted by IndigoRain at 1:55 PM on August 27, 2009

IndigoRain: "geos: "All vaccination programs work on the basis of "herd immunity' at some level."

As someone who was severely allergic to the MMR vaccine (a week of vomiting and my arm being swollen to the size of a baseball - when I was a preschooler), and could not get my final booster in 5th grade, herd immunity is not going to make me feel any better if I get measles, mumps, or rubella from someone who chose not to vaccinate their child. Herd immunity is meant to protect people like me, who CAN'T get the vaccine. People who do not vaccinate their children jeopardize herd immunity unnecessarily."

Which very well might be the case with the child in question here. We don't have enough information to know what the deal is with the child or the child's parents. Assume every option is a reasonable one when we are left with so very little information with which to provide advice.

From my perspective, a parent is complaining that a child doesn't have the required shots, information that the parent should have never been aware of. Using that information is probably not a wise decision. (Thinks insider trading scenarios)

This could be an issue where the parents don't have enough money to cover the cost of shots, the parents might object for religious reasons, the kid could be allergic to the vaccinations, etc... The OP might only be getting half of the information from the spouse. It's very possible that the spouse only told the OP the child was not vaccinated, but didn't state why the child wasn't, if the child is indeed a patient of the spouse.
posted by Gravitus at 2:55 PM on August 27, 2009

Ah, HIPAA refresher for him, right!

I spoke to my daycare provider (actually aftercare but she provides daycare services). She'd had questions about vaxes and kids before and her rundown was (she pointed out the husband breaking HIPAA too):

1. A parent can ask and will be answered to the effect that all children in care have the proper vaccination documentation on file, be they fully vaxed, partially vaxed, or unvaxed.

2. A parent can ask and will be answered if there are children present who are not vaccinated, but the children will not be identified in anyway or indicated as singular or plural.

YMMV, this is Florida, they've been in the business about fifteen years.
posted by tilde at 4:21 PM on August 27, 2009

I am not a lawyer, or a doctor. It sounds like you know at least one doctor pretty well, maybe you can ask someone who knows more about this sort of thing than a random poster on the internet.

Good god, I'm glad he's not my pediatrician. You can pull your own child out. You should not disclose medical information about someone to someone else without their express written consent. Was that hard?

Their right to privacy is more important than your right to insist that they get injected with vaccine.
posted by RikiTikiTavi at 4:31 PM on August 27, 2009 [7 favorites]

Guys, ease off. This lady did not say her spouse told her WHICH child he saw, and knows to be unvaccinated, presumably because he is the consulting paediatrician. All he had to say to her is I'm a bit concerned cos one of the children I saw there today I know is not vaccinated.
That said I always assume in any group of daycare kids that there will be at least one of two and I have never let it stop me but obviously ever parent must make that decision for themselves.
posted by Wilder at 8:51 AM on August 28, 2009

Upon reflection, I apologize for my harsh tone. Must have touched a nerve there.
posted by RikiTikiTavi at 7:45 AM on August 29, 2009