EHR Access Required in Hepatitis Case

A New Hampshire hospital must provide the state's department of public health with broad access to electronic health records as an investigation into a Hepatitis C outbreak continues, a court has ruled.

See Also: OnDemand | Driving Security, Privacy, & Compliance Goals by Accelerating HITRUST Certification

The Merrimack County Superior Court issued an order that affirms the authority of the state's Department of Health and Human Services to require Exeter Hospital to provide access to its medical records database as the department continues its investigation (see: Investigation Prompts Privacy Dispute.)

The state investigation, launched in May, has alleged that David Kwiatkowski, a former Exeter Hospital worker who has Hepatitis C, infected at least 32 patients with contaminated syringes. A criminal investigation is also under way (see: The Case for Background Screening.) Kwiatkowski, a medical technician, was charged with federal drug crimes.

Exeter Hospital in August filed a court motion seeking guidance on whether it was appropriate under state and federal privacy laws for the hospital to continue giving the state health department broad access to patient records.

In its Nov. 1 ruling, the court determined that Exeter Hospital's "duty to protect patients' privacy must give way to DHHS' interest in investigating communicable disease outbreaks."

Exeter Hospital in a statement says it supports the court's decision. "We remain confident that seeking judicial guidance was the right thing to do on behalf of our patients," the statement notes. "This is a complicated matter which requires a delicate balance between the state's rights and the legal and moral requirements hospitals have to protect patient privacy."

A hospital spokeswoman declined further comment on the case.

Disease Investigation

DHHS launched a communicable disease investigation in May 2012 after the hospital reported a cluster of recently diagnosed Hepatitis C cases at its hospital, according to court documents. Initially, the hospital provided DHHS open access to its electronic medical record data for its investigation. In its investigation of patient records, DHHS used software from the Centers for Disease Control and Prevention to create a database that could be used for analysis on EHR data extracted by investigators. DHHS also used additional software to collect data on patients that had died of hepatitis C, the court order states.

Members of the DHHS investigation team in early August signed an end-user security agreement with the hospital giving each investigator a username and password for access to Exeter's EHR system "as allowed by privacy and security policies and as allowed by law," the court order notes. Under the agreement, the hospital could audit each investigator's use of the EHR system after their review.

During its investigation, after DHHS determined that the outbreak was linked to a Exeter Hospital worker, the hospital began requesting that DHHS provide it with information related to facts learned during its investigation. DHHS maintained that it could not share information learned during the investigation. In late August, Exeter Hospital refused further medical record access to DHSS, contending it was protecting patient privacy and was seeking court guidance.

DHHS in its argument to the court said it was only obtaining "the minimum information" necessary to conduct its investigation and that state laws do not prohibit access to records for a communicable disease investigation.

Court Backs Investigators

In its ruling, the court agreed. State law "explicitly bestows the responsibility of conducting outbreak investigations while simultaneously protecting certain health information to the trained professionals of the DHHS," the court order states.

The court also noted that DHHS provided a detailed explanation of how its professional investigators are protecting patient privacy while conducting the investigation. The court says the state health department has "demonstrated that this is a professional, regulated and lawful investigation into a potentially serious health threat."

In a statement, Anne Edwards, New Hampshire associate attorney general says, "The court ruled that the state's outstanding requests for information from Exeter Hospital regarding the hepatitis C outbreak are lawful and appropriate. The court rejected all of Exeter Hospital's arguments to the contrary."