The truth about HIPAA: Does the federal health information privacy law protect Trump?

Within one day, President Donald Trump announced his COVID diagnosis and was admitted to Walter Reed National Military Medical Center for treatment. The flurry of events was stunning, confusing and triggered many questions. What was his prognosis? When was he last tested for COVID-19? What is his viral load?

The answers were elusive.

Picture the scene on Oct. 5. White House physician Dr. Sean Conley, flanked by other members of Trump’s medical team, met with reporters outside the hospital. But Conley would not disclose the results of the president’s lung scans and other vital information, invoking a federal law he said allows him to selectively provide intel on the president’s health.

“There are HIPAA rules and regulations that restrict me in sharing certain things for his safety and his own health,” he told the reporters.

The law he’s referring to, HIPAA, is the Health Insurance Portability and Accountability Act of 1996, which includes privacy protections designed to shield personal health information from disclosure without a patient’s consent.

Because this is likely to remain an issue, we decided to take a look. In what cases does HIPAA restrict the sharing of information — and is the president covered by it?

Experts agreed that he is, but several noted there are exceptions to its protections — stirring debate over the airwaves and on Twitter regarding what information about the president’s health should be released.

Explaining the Protections

HIPAA and the rules for its implementation apply to medical providers — such as doctors, dentists, pharmacists, hospitals — and most health plans that either provide or pay for medical care.

In some cases, the law permits the sharing of medical information without specific consent, such as when needed for treatment purposes or billing. Examples include doctors or hospitals sharing information with other physicians or facilities involved in the patient’s care, or information shared about tests, drugs or other medical care so bills can be sent to patients.

Other than that, without specific patient consent, the law is clear.

“The default rule under HIPAA is that health care providers may not disclose a patient’s health information. Period,” said Joy Pritts, a consultant in Washington, D.C., and a former privacy official in the Obama administration.

The experts we consulted all agreed that Trump’s doctors are bound by HIPAA. Since he is their patient, they cannot share his medical information without his consent.

Patients can allow some information to be released while demanding that other bits be withheld.

That may be why the public has been given only select details about Trump’s COVID-19 status, such as when Conley discussed the president’s blood pressure reading but not the results of his lung scans.

Trump “can pick and choose what he wants to disclose,” Pritts said.

So it is up to Trump to give his doctors the green light to report to the public on his condition.

“HIPAA does not prevent the president of the United States from authorizing the disclosure of all publicly relevant information,” said Lawrence Gostin, a professor of global health law at Georgetown University. “He can share it if he wanted to and he can tell his doctors to share it.”

Elizabeth Gray, a teaching assistant professor of health policy and management at George Washington University, said that because Conley shared some medically private information with the American public, there must have been a conversation between the president and his doctors about what was OK to include in their press briefings.

“He would have had to have given his authorization,” said Gray. In other words, Trump OK’d the details his doctors mentioned, but when follow-up questions were asked, she said, HIPAA was “a shield” because “the president hadn’t authorized the release of anything else.”

Still, beyond HIPAA, other factors could lead to less-than-complete disclosure of the president’s health.

For starters, Trump is the commander in chief, and his personal physician is a member of the military.

“If your commander in chief says, ‘I’m giving you a command — forget about HIPAA,’” said Thomas Miller, a resident fellow with the American Enterprise Institute.

Pritts and others also said the president’s physician may not be covered by HIPAA if his care is provided by the White House medical unit, which does not bill for its services or involve health insurance.

But, “whether covered by HIPAA or not, a physician has an ethical obligation to maintain patient confidentiality,” Pritts said.

And Leaks?

It’s also important to note that HIPAA applies only to health care professionals and related entities working within that sphere.

So, when Sean Spicer, former White House press secretary, tweeted on Oct. 5 that a journalist had violated HIPAA (he misspelled it as “HIPPA”) by reporting that a member of the White House press shop had COVID-19, he was wrong, said the experts.

“Journalists are not bound by HIPAA,” said Gostin.

Gray likened HIPAA in that way to a door.

“Behind that door is health care information. Hypothetically, only doctors have access to that information, and HIPAA prevents health care providers from unlocking that door,” she said. “But, once the info gets out of that door, then HIPAA no longer applies.”

And the information is likely to come out — sooner or later, said Miller. “Leaking will take care of most reporting and disclosure” about the president’s health, he said.

The Exceptions

Within HIPAA are a couple of exceptions identifying when health information can be disclosed without the authorization of the patient.

For example, the law does allow for disclosure if it “is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.”

Might that apply here, given that Trump took a ride around Walter Reed in a government SUV with Secret Service agents, or returned to a White House filled with other employees?

Jonathan Turley, a professor of public interest law at George Washington University Law School, said he doesn’t think the public health exemption would apply in this case.

“If a patient is contagious and noncompliant, doctors can make disclosure in the interest of public health,” Turley wrote in an email. “However, the team of doctors stated that they felt that it was appropriate to send President Trump back to the White House to continue to recover.”

Moreover, Turley noted that nothing was withheld that would have qualified for this exception. “The world knows that the president is COVID-positive and still likely contagious,” he wrote. “It is unclear what further information would do in order to put the world on notice.”

Some experts, however, expressed a different view. They argued that the details of when the president last tested positive would provide insight into who may have been exposed and how long he should be considered infectious and asked to isolate. Even so, the law’s public health exemption is usually interpreted to mean such information would be shared only with state and local health officials.

There are two HIPAA exceptions that apply specifically to the president, said Gray.

“They could make that disclosure to people who need to know, to the Secret Service or the vice president, but it is essentially only to protect [the president],” said Gray. “There is also an armed forces exception, but disclosures are in regards to carrying out a military mission, which doesn’t apply here.”

What about national security?

Miller, at AEI, said concerns about national security could be among the reasons for more disclosure, such as questioning a president’s ability to carry out duties. But HIPAA wasn’t designed to address this point.

Some argue that because the president is not just an average citizen, he should waive his right to medical privacy.

“The president is not just an individual; the president is the chief executive,” said Charles Stevenson, an adjunct lecturer on American foreign policy at Johns Hopkins University. “The president loses a lot of privacy because our political system, our governmental system demands it. The president always has to be available to the military and that means the state of his health is a matter of national security.”

Historical precedent

Trump is one in a long line of presidents who have not been completely transparent in sharing their medical information.

“There’s a pretty strong tradition of these things being obscured,” said John Barry, an adjunct faculty member at the Tulane University School of Public Health and Tropical Medicine. And no federal law requires a president to provide this information.

One of the most notable examples is President Woodrow Wilson, said Barry.

Wilson likely caught the so-called Spanish influenza in 1919, which was kept secret. Later that year, he had a severe stroke that disabled him, the gravity of which was also hidden from the public.

President John F. Kennedy used painkillers and other medications while in office, which wasn’t made public until years after his death.

And when President Ronald Reagan was shot in 1981, he was much closer to death than his White House spokesperson described to the public. There were also questions about Reagan’s mental acuity while in his final years in office. He was diagnosed with Alzheimer’s disease five years after his final term.

Why would White Houses want to obscure health information of presidents?

“Every White House wants the public to think the president is healthy, strong and capable of leading the country,” said Barry. “That’s consistent across parties and presidencies.”

Kaiser Health News (KHN) is a national health policy news service. It is an editorially independent program of the Henry J. Kaiser Family Foundation which is not affiliated with Kaiser Permanente.