Suicide Attempt Due to a Misunderstood HIPAA Notice

To the Editor: The federally mandated Health Insurance Portability and Accountability Act (HIPAA) went into effect in April 2003 with the intent of providing standards for protection of patients’ privacy. Attention has been given to the administrative burden that these requirements have placed upon health care providers and health care systems (1, 2). However, little focus has been placed on the potential negative impact that these new regulations will have on patients. We report a case in which HIPAA privacy notification was judged as a significant factor in precipitating a serious suicide attempt by an elderly woman due to a misunderstanding of the meaning of notification.

Legislative bodies need to be aware of the potential unanticipated negative impact of new laws. This case provides an example of such; others may follow. Patients with active medical, cognitive, or psychiatric illnesses may be more vulnerable to misinterpretation. Language in our patient’s notice indicating who may have access to—and potential disclosure of—her protected health information may have contributed to her misunderstanding. Misinterpretation may also be related to the source of the notification (i.e., hospital, physician’s office, or insurance company). In addition to patient confusion over the meaning of these new regulations, there is a potential for decreased communication between medical providers and families in the care of patients resulting from misunderstanding and fear of noncompliance with these complex regulations in a medical system already stressed by economic and regulatory pressures that are not conducive to effective communication. Ongoing evaluation of adverse events related to HIPAA notification should be part of future revisions of the act.