NRPM: Standards for Privacy of Individually Identifiable Health Information. b. Whistleblowers.


In Section § 164.518(c)(4), we would address the issue of disclosures by employees or others of protected health information in whistleblower cases. We would clarify that under the proposed rule, a covered entity would not be held in violation because a member of their workforce or a person associated with a business partner of the covered entity discloses protected health information that such person believes is evidence of a civil or criminal violation, and the disclosure is: (1) made to relevant oversight agencies and law enforcement or (2) made to an attorney to allow the attorney to determine whether a violation of criminal or civil law has occurred or to assess the remedies or actions at law that may be available to the person disclosing the information.

Allegations of civil and criminal wrongdoing come from a variety of sources. Sometimes an individual not otherwise involved in law enforcement uncovers evidence of wrongdoing, and wishes to bring that evidence to the attention of appropriate authorities. Persons with access to protected health information sometimes discover evidence of billing fraud or similar violations; important evidence of unlawful activities may be available to employees of covered entities, such as billing clerks or nurses.

Some whistleblower activities can be accomplished without individually identifiable health information. There are, however, instances in which only identifiable information will suffice to demonstrate that an allegation of wrongdoing merits the investment of legal or investigatory resources. A billing clerk who suspects that a hospital has engaged in fraudulent billing practices may need to use billing records for a set of specific cases to demonstrate the basis of his suspicion to an oversight agency.

The persons who find such evidence are likely to be employees of the suspect entity. Congress and the states have recognized the importance of whistleblowing activities by acting to protect whistleblowers from retaliation. Federal statutes that include protections for whistleblowers who contact appropriate authorities include the Clear Air Act, the Federal Water Pollution Control Act, the Toxic substances control Act, and the Safe Drinking Water Act. Congress also passed the Whistleblower Protection Act, to protect federal employees who complain about improper personnel practices at federal agencies. At least eleven states have passed whistleblower protection laws that protect both private and public employees who provide evidence of wrongdoing to the appropriate authorities, and many more states have laws that provide such protections only for public employees.

The qui tam provisions of the Federal False Claims Act go further, and provide a mechanism for the individual to prosecute a case against a person who has allegedly defrauded the government. Like traditional whistleblower actions, qui tam actions were created by the Congress to further the public interest in effective government. Qui tam suits are an important way that individuals can protect the public interest, by investing their own time and resources to help reduce fraud. And, also like whistleblower actions, the individual may need protected health information to convince an attorney that a viable qui tam case exists.

We would note that this section would not apply to information requested by oversight agencies, law enforcement officials, or attorneys, even prior to initiation of an investigation or law suit. It would apply only to a disclosure initiated by a member of an entity’s workforce or a person associated with one of its business partners.

We are concerned that a person, in the guise of “whistleblowing,” might, maliciously or otherwise, disclose protected health information without any actual basis to believe that there has been a violation of the law. We are concerned, however, with adding qualifying language that may restrict such disclosures and, therefore, impede the pursuit of law violators. We seek comments regarding whether this provision should include any limitations (e.g., a requirement that only the minimum amount of information necessary for these purposes can be disclosed).