At this month’s meeting of the Jail Oversight Board, new Allegheny County Executive Sara Innamorato’s earlier calls for “productive dialogue” and “an honest answer” to corrections questions ran into a thorny obstacle: HIPAA.
Innamorato made those calls at the board’s January meeting — her first while in office. But on Feb. 1, Judge Susan Evashavik DiLucente said Allegheny County Jail officials invoked the Health Insurance Portability and Accountability Act when board members asked to see reports on lockdowns and use of force last month. That federal law governs the release of protected health information.
“Now what I’m hearing today is that would be a HIPAA violation because maybe only one person broke their leg and then everybody would know who that was, is that correct?” asked DiLucente, the board’s new chair and the president judge of the county’s Court of Common Pleas.
What followed was nearly 10 minutes of back-and-forth on information access between board members and jail officials, with DiLucente calling on Assistant County Solicitor John Bacharach to clear up the confusion. “I wouldn’t want to answer about a specific HIPAA question unless I’d had a chance to look at it carefully and respond,” he said. “… It’s very complicated.”
Board member and County Councilor Bethany Hallam pressed jail officials at the meeting for easier access to information about medical care. She told PublicSource it’s a battle she’s been waging for nearly two years to try to reduce the number of deaths in the jail, which rose during the pandemic.
“Something as simple as preventing death cannot be done if we cannot get the information about people being injured, about people being hospitalized, about the jail working with the courts to release people from custody so they don’t even have to tell us that somebody died,” she said.
The board’s composition is about to shift dramatically in favor of Innamorato and her ally Hallam: Three of the executive’s appointees — Barbara Griffin, Muhammad Ali Nasir, known as MAN-E, and Rob Perkins — were approved by County Council and could join the next meeting, expected to occur on March 7.
“Something as simple as preventing death cannot be done if we cannot get the information about people being injured, about people being hospitalized … ”
Bethany Hallam, County Councilor at large
Will the potential board majority get the open access to jail medical information that Hallam seeks, or run into a legal wall?
According to experts interviewed by PublicSource, HIPAA’s applicability in corrections depends on a variety of legal and administrative factors. As the administration and its board allies continue to seek ways to address concerns about healthcare in the jail, here are key questions about the information it has access to — and the answers available so far.
What is HIPAA?
HIPAA was signed into law by President Bill Clinton in 1996. It created national standards to protect sensitive health information from being disclosed without a patient’s consent or knowledge — a crucial update to the law as electronic health records became standard across the healthcare industry.
The law’s privacy rule makes it illegal for “covered entities” — providers, health plans and clearinghouses — to share a patient’s medical records without their explicit consent, usually via an authorization form. The Office of Civil Rights in the U.S. Department of Health and Human Services enforces the rule by investigating complaints. It can fine a non-compliant institution hundreds of thousands of dollars for repeat violations.
It’s why HIPAA became a kind of bogeyman for covered entities, according to four experts who spoke with PublicSource, three of whom were willing to go on the record. The law is widely misinterpreted and misunderstood, and is sometimes used as an excuse to withhold information.
“I think there is often a layer of fear and anxiety around HIPAA that is not based in the actual regulations and enforcement,” said Hallie Fader-Towe, interim director of behavioral health at the Council of State Governments Justice Center. “The law provides ways to both protect individual privacy and share information as necessary for important goals like coordinating care and conducting analysis for research and policy development.”
Experts said HIPAA is intended to be “a floor, not a ceiling” for health privacy laws. Until recently, Pennsylvania had stricter laws on the books to protect information about mental health and substance use disorders. Both were amended in 2022 to align with HIPAA and other federal regulations, partly because they were “causing uncertainty around information sharing in Pennsylvania,” said Gretchen Frank, a senior policy analyst at the CSG Justice Center.
How does HIPAA apply in corrections?
Jails and other correctional facilities are not automatically considered covered entities under HIPAA unless they define themselves as one, according to a 2010 report by the U.S. Department of Justice and the CSG Justice Center, which was co-authored by Fader-Towe.
She said that description still holds today, though correctional healthcare workers and the records they generate are bound by HIPAA — even if the facility itself is not a covered entity.
The jail considers itself a covered entity, said its spokesperson Jesse Geleynse. Some healthcare staff at the jail are county employees, while others are Allegheny Health Network employees or were placed there by staffing agencies. All must comply with HIPAA, paying special care to records about mental health, HIV/AIDS and substance use disorder, which are afforded greater protection under the law.
And like other jails and prisons around the country, the jail must navigate the privacy considerations for its medication-assisted treatment program for opioid use disorder.
Experts raised questions after PublicSource described the discussion about HIPAA at the board meeting. Joan Kiel, a professor and chairperson of healthcare compliance at Duquesne University, asked the following:
- Who is the jail’s HIPAA compliance officer — a role that every covered entity must fill to comply with the law? That role can be internal or external, with many entities contracting it out.
- Are jail officials and staff trained on HIPAA, which would give them a sense of what they can and can’t share with the board?
- Are people incarcerated at the jail informed of their HIPAA rights, and are they asked to sign an authorization form for release of their protected health information, which is mandated by law?
“Prisoners have rights,” she said, noting that there are some exceptions to confidentiality if it jeopardizes the health and safety of the jail population.
PublicSource shared Kiel’s questions with Geleynse, who said jail Quality Improvement Manager Nora Gillespie is the HIPAA officer, while two other professionals manage privacy for the county. Jail officials don’t consult them before sharing information with the board because “members can view all jail records provided they do so at the jail.”
While the jail does use “release of information forms,” it does not inform the people it holds of their privacy rights because “HIPAA regulations do not require that notices be provided to incarcerated individuals,” Geleynse said. Kiel confirmed that it’s not required, but doing so would be “a more humane gesture.”
Can the Jail Oversight Board access health information?
Hallam often thinks of Gerald Thomas, a 26-year-old man who died of a pulmonary embolism in the jail in 2022. She said he collapsed after repeatedly asking for medical attention — an outcome she wants to understand in a broader context.
“Are sick calls going unnoticed?” she asked. Why are some people hospitalized “over and over again?” Are older people disproportionately dying in the jail? Or are younger people without significant medical histories, like Thomas, the ones who need the most help?
Hallam wants greater access to health information to identify patterns and trends, but said the board has been stymied by jail officials who won’t provide it, invoking HIPAA and safety and security concerns. She said the board is empowered by statute to oversee the health and safety of people in the jail.
Bacharach told the board “the jail doesn’t give individually identifiable information about inmates’ medical conditions to anyone outside of the jail medical staff. I’m not saying there aren’t exceptions, but we’re very careful about that.”
At the meeting, Hallam said the board isn’t asking for identifiable information. Rather, she wants access to de-identified information that can help her provide oversight.
Kiel said if the health information is de-identified and if the board has healthcare oversight, it should have access to that information. The board is “trying to help the inmates” and the county, she added.
Should a trip to the jail be required?
Geleynse told PublicSource the jail has offered policies, reports and other documents to board members for months — as long as they review them at the jail.
“As jail administrators have repeatedly stated, there are safety and security concerns regarding jail operations, and privacy concerns regarding incarcerated individuals’ health information contained in these documents if they leave the building,” he wrote in an email.
And the jail does share de-identified information with the board “when appropriate,” he added, including the “health circumstances and treatment” provided to a person who dies in the jail.
Hallam said that de-identified information is scant and doesn’t shed light on what happened to those who died after being released from custody while in the hospital. She said those deaths aren’t reported to board members.
She also said jail officials are inconsistent when invoking HIPAA: They allow Karen Duffola, the board’s liaison to the jail, to see detailed and even “identifiable” health information at the facility, which she reports to board members via email. It’s a process Hallam doesn’t trust because she believes Duffola has a conflict of interest as a former probation officer and drug court coordinator.
“Why is it that you’re giving it to this person, but not giving it to the board that she is there to represent?” Hallam asked, noting it hasn’t been easy to conduct the inspections that jail officials said they’ve offered. She’s waited long periods of time — often an hour — before being allowed into the jail.
Duffola didn’t respond to an email and phone call on Thursday seeking comment.
What’s next in the debate over access to information?
At the meeting, DiLucente pressed Bacharach for a reason why the board could not view use-of-force reports: How could it be a HIPAA violation?
He said the reports often, if not always, contained medical information. And releasing them posed a safety and security risk.
DiLucente asked if the jail could provide information about the circumstances leading up to use of force instead.
“I don’t know that there’s a specific reason that that would be a problem,” said Bacharach, indicating the jail might provide the information.
Longtime meeting attendees said the president judge had set a striking new tone for the board, compared to the leadership of its previous chair, Judge Elliot Howsie, who often clashed with Hallam.
Jail officials are “so used to people not following up [and] not having to give that level of transparency,” said Tanisha Long, a community organizer for the Abolitionist Law Center. “I’m not even sure they have the processes in place to provide those answers, because they haven’t had to give them before.”
Long said the board’s newly confirmed citizen members could shake things up even more.
Griffin is an attorney who champions pro bono work. Perkins, also an attorney, worked as an assistant public defender. Nasir is an anti-incarceration advocate who was held at the jail as a teen — an experience that he described in an essay for PublicSource.
Hallam is eager for them to join her on the board.
“I think the jail is finally starting to feel the heat and see that we’re not going to let up,” she said.
Venuri Siriwardane is PublicSource’s health and mental health reporter. She can be reached at venuri@publicsource.org or on X, the platform formerly known as Twitter, @venuris.
This story was fact-checked by Rich Lord.
This reporting has been made possible through the Staunton Farm Mental Health Reporting Fellowship and the Jewish Healthcare Foundation.
