Monroeville official says UPMC, town broke health privacy law
Share with others:
Monroeville's assistant police chief has filed a complaint alleging that his own municipality, UPMC and the department's former chief breached a federal privacy law governing release of medical information.
While a branch of the U.S. Department of Health and Human Services has been asked to look into a specific incident, a larger issue is the question of who should receive potentially sensitive emergency data.
And on a local level, Monroeville is navigating the thorny instance of one of its own acting as a whistle-blower.
The complaint, filed in August by Assistant Chief Steven Pascarella, claims that information about ambulance dispatches was being sent not only to paramedics but also to his old boss, George Polnar, although he was not an active first responder, and was then forwarded by Mr. Polnar to a third party.
Mr. Polnar retired in January 2010 and is now manager of security and parking at UPMC East in Monroeville. He is also a former volunteer firefighter and paramedic for the municipality.
The assistant chief is seeking a determination of whether there was a violation of the Health Insurance Portability and Accountability Act or HIPAA, which restricts release of certain patient information by health plans, health care providers and health care clearinghouses. Violations of the privacy law can result in fines and/or imprisonment.
Monroeville solicitor Bruce Dice says there's no violation.
"Who thinks it is a violation? So far the vote is the assistant chief. And he's practicing law without a license. I don't see it," Mr. Dice said. "The only lessons learned out of this mountain out of a molehill is we're taking names off this list that don't have any reason to be on there anymore. This isn't a big deal."
According to the complaint, on Aug. 21 Mr. Polnar contacted a friend about a medical emergency in her neighborhood.
"Polnar forwarded an e-mail to a friend containing an EMS response to her neighbor's ... home," the complaint said. "Though the email did not contain the name, the age sex address information was enough for her to identify" the patient.
The friend Mr. Polnar contacted is police secretary Linda Moy. She declined comment.
Mr. Polnar acknowledged that since retirement he has continued to receive email alerts multiple times a day on his personal cell phone about ambulance calls dispatched by the municipal 911 center, which also covers Pitcairn, Wilmerding and a paramedic unit stationed at Forbes Regional Hospital.
He said he recalled texting Ms. Moy only about a fire on her street, Oak Pointe Drive, after listening to a police scanner.
"You know what happened was I heard that on the scanner, and I texted her. See how things get blown out of proportion?" Mr. Polnar said. "It has nothing to do with my pager."
But a review of the text message that is the subject of the federal complaint shows it was sent from Mr. Polnar's cell phone number Aug. 21 at 8:51 a.m. and contained an address, age of patient and specific information about the medical situation. Ms. Moy received it at 8:57 a.m.
Following the complaint, Monroeville reconfigured its paging system and eliminated five to 10 people from the list of recipients, including Mr. Polnar and other retirees. There is no written policy governing who is on the list.
Mr. Polnar's name "just never came off" after he retired, Mr. Dice said. The list was updated "because it seems like the prudent thing to do."
Steven Henderson, the man who requested the ambulance, recently said he did not think Mr. Polnar or anyone else who is not a first responder should have received details of his call.
"I don't think they should have been told about it," Mr. Henderson, 56, of Oak Pointe Drive, said. "The police chief was here to see me Saturday, [Oct. 6]. ... He didn't think that was right and that he was going to do an internal investigation about it."
Mr. Dice said police Chief Kenneth "Doug" Cole visited Mr. Henderson in response to questions raised by the Pittsburgh Post-Gazette -- "because he's investigating what you're reporting."
"I did not apologize," the chief said. "I did go over there to interview them and tell them exactly what data was sent out."
Mr. Polnar said he had been receiving dispatch information since he was police chief. He also said he is considered a fire department "life member" because he spent at least 15 years on duty.
Brian Reed, chief of one of Monroeville's five fire companies, said he does not think Mr. Polnar should have been getting dispatches since he was effectively a civilian.
"In my opinion, he shouldn't have been receiving that data," Chief Reed said.
Assistant Chief Pascarella said Mr. Polnar was on a small email distribution list that received ambulance dispatch information and "bypassed" the normal channels by which paramedics are paged.
It was not clear how, when or why that list was created. The assistant chief refused to identify the others on the list.
In an August memo to Chief Cole, who is also in charge of the dispatch center, Assistant Chief Pascarella wrote that he was "extremely concerned that the municipality may be open to liability if we do not make every effort to monitor the dissemination of this information and correct any known errors."
The federal complaint states Monroeville's dispatch system sends emails to emergency responders. "Specific medical information" is included and sometimes past medical history, the complaint states.
"The problem is it also contains what's called 'EMD' -- emergency medical dispatch, which is a software they run for medical calls, where they're collecting medical information, medication, past medical histories," the assistant chief said.
Chief Cole said initially the EMD data was restricted for a week but it was then restored because of a determination that it was compliant with the federal privacy law.
"Should we be a little bit tighter? The solicitor's already said we're going to watch who we're putting on this list," the chief said. "We're going to make conscientious decisions about who we should put on it."
UPMC declined comment.
First Published October 18, 2012 6:30 am