Under the Health Insurance Portability and Accountability Act of 1996, commonly called HIPAA, businesses like Metro Ambulance of Meridian cannot disclose the name of a patient or even the hospital to which he or she has been taken, not even to the police.
The law states, once a patient enters the ambulance, the ambulance service must apply all the required privacy and security protections created by the law. This even applies to close family, until they can show their relationship to the patient.
"If we identify where a patient goes to the caller who already knows the name, then we've identified the location and basically said this is where the subject is at," said Johnny Williamson, operations manager for Metro. "And under the HIPAA law, that is a violation."
Williamson said if the media requested information about people hurt in a traffic accident, Metro could only tell the number of injured transported to a healthcare facility.
Ken Purvis, compliance officer for Rush Foundation Hospital, said when someone calls to check on a patient, the staff could only say the person is "guarded", "good" or some other one word response.
The patient, not the hospital, makes the decision as to what information may or may not be released.
"When they're admitted they are asked to sign some forms that will permit the release of information," said Purvis. "Or they can choose not to release information. And if they ask not to release information then we have to abide by their wishes."
Inquiries by the clergy or health officials are an exception to the law. The media and the general public are not.