The Researcher, the Reporter, and the Employer's Broad Authorization
At a 480-bed teaching hospital, three requests land on the same Tuesday. (1) A cardiologist with an IRB-approved protocol for a rare arrhythmia asks the privacy office for a roster of 214 patients - name, MRN, date of birth, and ZIP code - so her coordinator can call them about enrollment; she says the IRB will approve the recruitment component next month. (2) A television reporter calls asking whether a well-known local athlete seen in the emergency department 'is a patient there.' (3) A warehouse employer faxes a request for 'all records regarding [employee], including any treatment, drug screens, and mental health notes,' with a signed employee authorization attached that expires in 2027 and authorizes release of 'any and all records.' The employee was injured at work; the employer says it needs the information for its workers' compensation claim.
1. Can the privacy office release the 214-patient roster and let the coordinator begin calling? Explain your reasoning and alternatives.
Read the worked answer
Two separate questions: may the privacy office hand over a roster, and may a coordinator call patients?
- Reviewing records to prepare a protocol may be done under a preparatory-to-research representation, but that representation does not cover copying or removing PHI from the covered entity, and it certainly does not cover contacting patients.
- Recruitment contact is a research activity. It requires patient authorization, or an IRB waiver of authorization (a partial waiver limited to recruitment is common), or a treating-provider approach in which the care team makes first contact before any PHI reaches the researcher.
Recommendation: do not release the roster now. Ask the IRB for a waiver or partial waiver for recruitment; failing that, have treating clinicians send a study letter with a clear opt-out. Document the IRB determination in the protocol file. Separately, challenge the data elements: ZIP plus DOB plus dates is a re-identification risk, and minimum necessary applies inside research too. Name and MRN may suffice for a coordinator working from a clinic list.
2. How should the hospital respond to the reporter, and what operational steps follow?
Read the worked answer
Answer without answering. The hospital may confirm directory information - presence and a general condition - only if the patient is in the facility directory and has not opted out, and only in response to a request by name. ED presentation, imaging, and any clinical detail beyond the directory are off limits. 'I can't confirm or deny whether anyone is a patient' is a correct and complete answer; 'no comment' invites interpretation.
Follow-up:
- Route all media calls to one trained spokesperson. Front-desk, security, and ED staff must not improvise.
- Check the directory status and flag the chart if the patient has opted out.
- Remind staff that confirming the athlete's presence, posting about it, or permitting photography in the ED is a disclosure with no treatment, payment, or operations purpose.
- Log the inquiry. If any staff member did confirm something, that is a privacy incident to investigate even if the reporter never airs it.
3. The employer has a signed authorization. What may the hospital release, and what must happen first?
Read the worked answer
A signed authorization is necessary but not sufficient. Test the form against the required elements and against what the employer actually needs.
Problems with this request:
- 'Any and all records' is not a specific description of the information to be used or disclosed.
- Drug screens and mental health notes need separate, specific authorization; psychotherapy notes need their own authorization; substance use disorder records from a Part 2 program need Part 2 consent.
- Confirm the form contains the revocation statement and the redisclosure statement - many legacy forms omit both.
- Minimum necessary still applies. Disclose what the workers' compensation claim requires, not the full chart.
Action: do not send the chart. Send only records relevant to the claimed injury, or only what state workers' compensation law actually requires, and request a narrowed authorization for the sensitive categories. If the statute independently mandates a report to the carrier, disclose only what the statute requires and record the legal basis in the disclosure log.