Releasing Information

I was recently stuck in court dealing with a case that should have been dismissed long ago. The prosecutor thought my client wasn’t complying with the terms of a mental health diversion program, but I had personally verified that he was in compliance less than a day before. To satisfy the state and avoid reinstatement of the charges, I just needed to get some up-to-date written proof.

My first step was to try to call my client’s mental health case manager. One person told me the case manager was on vacation, and another told me he was in court. They accidentally hung up on me twice. Eventually, I got through to a lady who seemed to be able to help me. I explained to her that all I needed was something saying that my client was complying with his mental health case plan as ordered. Providing that kind of documention is part of what the organization does, so it should have been easy, right?

I wouldn’t be blogging about this is if the answer was “yes.” Her response was to ask me for an “ROI.” It’s a “release of information” form, which is necessary because someone has to provide written authorization in order to have their mental health records released in a lot of situations. Welcome to the age of HIPAA. Even if you’ve previously gotten authorization, it probably won’t count. Forms expire, circumstances change, and everybody loves extra paperwork. Here’s roughly how my conversation with her went:

ME: I am a lawyer. My client needs updated written proof of compliance to get his criminal case dismissed. Here is my client…
CLIENT: Hi, please tell them how I’m doing. I don’t want to go to jail.
ME: Did you hear that?
THEM: Yes, but I need the release in writing.
ME: Can’t you just fax him something saying he’s been doing a good job?
THEM: Our policy requires a written release.
ME: But he’s asking you to send him a letter detailing his own progress.
THEM: We need a release.
ME: But it’s his own information, and you’ll be sending it to him at a court’s fax number.
THEM: We still need a release.
ME: You need a written release to release my client’s own information to himself?
THEM: We don’t have a release.
ME: Isn’t he the one who has to sign the release?
THEM: We can’t give out information without a release.
ME: But you’ll just be giving the information to him.
THEM: We must have a release.

The prosecutor had called as well. He couldn’t get in touch with his three primary contacts in the company, and when he did get through to someone, they first told him my client had a completely different case manager (who was actually the head of the entire division and seemed to have no clue who my client was) then decided the actual case manager was on vacation. They wouldn’t tell him anything else because he didn’t have a release. Apparently, he was angry enough to say something along the lines of “what do you mean you can’t tell me? I’m the government!” I would have loved to have heard that.

I asked them to fax me a blank ROI form so I could fax it back, thinking they understood the urgency of the matter. I realized I was wrong when they took their sweet time faxing me the authorization form. On top of that, when I finally got it, they had no idea whether my client or his permanent guardians were supposed to authorize release, and they weren’t sure if there was a limit on who could receive the information, how the information could be used, or how long the release would be valid.

The completed ROI I faxed back to them was a very amusing document. I had my client and both of his guardians sign in the spots authorizing release, and I designated myself and the judge as the recipients of the information in question. The release was to be valid until the case was dismissed. I still don’t know if I did it the way they wanted, but in the end, they gave me what my client needed: a very basic letter saying he was doing what he was supposed to do. The case was dismissed after roughly three hours.

At no point in all of this did it ever matter who really had authority or what was or was not required by law. What mattered was what a group of employees believed was the agency’s policy based on some training they received back in the day. HIPAA is so complex that a lot of attorneys, myself included, aren’t completely familiar with all the ins and outs. Honestly, I’m still not sure if someone could have gotten into trouble had they faxed the letter to my client, who would’ve in turn provided it to the court.

All of this was exacerbated by the fact that most people hate dealing with lawyers. That’s not entirely unreasonable, as there are a lot of sneaky, manipulative lawyers out there. When I was trying to figure out why they would not release to my client his own information, the conversation probably would have gone better if I told her I was from Nigeria and needed her to give me my client’s bank account numbers so I could transfer some lottery winnings.

People aren’t necessarily being irrational when they worry about inadvertently disclosing too much information. I bet a lot more people get fired for being too helpful and open than get fired for refusing to give out information. I can understand why disclosure rules exist, but does it really make sense to be so worried about someone’s privacy that we’re willing to hurt that person in order to protect it? What harm could faxing my client his own information have done? For the HIPAA experts out there, is it really prohibited?