Medical Privacy Laws: Do They Apply In Churches?

Churches can end up handling confidential health information about their volunteers, employees, and congregation members. The federal Health Insurance Portability and Accountability Act (HIPAA) imposes strict requirements of confidentiality for certain types of health information that an organization receives.

HIPAA applies to individually identifiable health information that is held or transmitted by a covered entity or its associates. It includes any information that identifies an individual and relates to their medical or mental health conditions, the receipt of health services, or matters related to healthcare payment.

HIPAA creates interesting pitfalls for churches. For example, a member of the clergy may receive an email from a congregant explaining a complex medical condition and asking for advice. In this case, the clergy member may have a HIPAA obligation to maintain the confidentiality of the information. If the information is disclosed outside of the exceptions to the confidentiality rule, the church may be held liable for violating HIPAA.

State privacy laws may also apply to churches, and it is important for churches to understand their legal obligations to protect the personal information of their members.

When are churches subject to HIPAA?

Churches are complex institutions that can encompass various activities and services, and their obligation to comply with HIPAA depends on the specific context and nature of their operations. While HIPAA (the Health Insurance Portability and Accountability Act) is a federal law in the US that safeguards the privacy of health information, it is important to understand when and how it applies to churches and religious organizations.

Firstly, it is essential to understand the definition of a "covered entity" under HIPAA. Covered entities include healthcare providers, health plans, and healthcare clearinghouses. Healthcare providers, in this context, refer to hospitals and medical offices, and in certain instances, religious institutions. Religious institutions that fall under this category are those that operate health clinics as an integral part of the organization without any legal separation.

Now, let's discuss when churches are subject to HIPAA:

Operating Health Clinics:

If a church operates a health clinic that is not a distinct legal entity separate from the church itself, it may be considered a healthcare provider under HIPAA. This means that if the church-owned clinic provides medical services, including preventive care, diagnostic services, rehabilitation, counselling, or dispenses drugs and medical equipment, it would be subject to HIPAA regulations.

Electronically Transmitting Health Information:

Religious institutions that electronically transmit health information in connection with specific transactions are also subject to HIPAA. This includes electronic exchanges of information with other entities, such as health plans, to carry out financial or administrative activities related to healthcare. For example, if a church-owned clinic electronically bills health insurance companies for patient services, it would fall under the purview of HIPAA.

Providing Employee Health Benefits:

If a church provides health insurance plans or other health benefits to its employees, it may have some obligations under HIPAA. This includes providing certain notices to employees and ensuring the protection of employee health information.

It is important to note that many churches do not fall within the categories of covered entities, and therefore, they are not subject to HIPAA's privacy requirements. However, churches should still respect the principle of health information privacy and obtain consent before disclosing any sensitive information, as they can still be held liable for unauthorized revelations of medical information.

Additionally, state privacy laws may also apply to churches, and these laws can sometimes be more stringent than HIPAA requirements. Therefore, it is advisable for churches to consult with legal professionals to understand their specific obligations and ensure compliance with both federal and state privacy laws.

What are the implications of a church being a covered entity?

Religious institutions that operate health clinics that are not distinct legal entities separate from the religious institution may be considered covered entities under the Health Insurance Portability and Accountability Act (HIPAA). This means that they are subject to the HIPAA Privacy Rule, which requires covered entities to obtain patient prior written authorization to use PHI for purposes other than their own treatment, payment, or healthcare operations. As such, religious organizations may not include PHI about congregants or individuals in bulletins, prayer lists, or other communications unrelated to payment, treatment, or healthcare operations.

In the context of a church, this means that if a church provides health care benefits to its employees, it must handle applications and records containing private facts about employees confidentially. Additionally, churches often receive sensitive health information through counseling sessions or informal conversations, which are also subject to HIPAA confidentiality requirements. For example, if a congregant emails their clergy about a complex medical condition, the clergy must keep this information confidential unless the congregant provides written consent for its disclosure.

It's important to note that while religious entities are exempt from Title III of the Americans with Disabilities Act (ADA), which covers public accommodations, they are covered by Title I of the ADA if they have at least 15 employees. This means that they cannot discriminate against qualified applicants and employees with disabilities, but they may give preference to individuals of their own religion and require adherence to religious rules.

What are the privacy laws for churches in different states?

Churches are generally required to comply with state and federal laws, although they may enjoy religious exemptions in some cases. For instance, churches may be exempt from certain state privacy laws, but they are still subject to the Health Insurance Portability and Accountability Act (HIPAA) and the General Data Protection Regulation (GDPR) if they handle health information or process data of EU citizens, respectively.

California

In California, the state's Evidence Code (§§ 1030-1034) establishes clergy-penitent privilege, which prevents clergy from testifying in criminal or civil cases about confidential information that was confessed or confided to them.

Minnesota

In Minnesota, invasion of privacy is not recognized as a basis for liability.

Texas

In Texas, "false light" invasion of privacy is not recognized as a basis for liability.

Michigan

In Michigan, a minister may be held liable for invading the privacy of a church member by disclosing confidential information to the congregation that was communicated during a counseling session.

Ohio

In Ohio, a church was sued for invasion of privacy after disclosing its music director's psychological disorder on its website. The court ruled in favor of the music director, stating that the church's comments were based on his private affairs and could be viewed as offensive or objectionable to a reasonable person.

Illinois

In Illinois, a pastor successfully sued a church for invasion of privacy after the church sent out a letter containing information that damaged his reputation and led to his unemployment. The court ruled that the letter placed the pastor in a false light and that the First Amendment did not bar the court from resolving the case.

Oregon

In Oregon, a pastor was found guilty of invading the privacy of a church member and his wife by making public statements that placed them in a false light. The pastor accused the couple of falsifying their children's condition to obtain a larger insurance settlement without investigating the facts.

Federal Law

The Privacy Act of 1974 applies only to records maintained by the federal government and some federal contractors, and therefore does not apply to church records.

HIPAA

The HIPAA Privacy Rule applies to religious organizations that operate health clinics that are not distinct legal entities separate from the religious institution. These religious institutions are considered covered entities and are subject to the entirety of the HIPAA Privacy Rule. Covered entities must obtain patient authorization to use PHI for purposes other than treatment, payment, or healthcare operations.

GDPR

The GDPR, adopted by the European Union in 2018, applies to all organizations that process data of EU citizens, including faith-based non-profit organizations.

While churches may be exempt from certain state privacy laws, they must still comply with federal laws such as HIPAA and international laws such as GDPR if they handle health information or process data of EU citizens, respectively. Churches should also be aware of potential invasions of privacy, as recognized by many states, which can lead to costly legal troubles.

What are the privacy rights of church members?

Churches often handle confidential health information about their volunteers, employees, and congregation members. This can occur in formal settings, such as workers' compensation claims, health care benefits, and substance abuse assistance programs, or informally, such as during counseling sessions or casual conversations. As such, churches have certain legal obligations to protect the privacy of their members.

The Health Insurance Portability and Accountability Act (HIPAA)

HIPAA imposes strict requirements of confidentiality for certain types of health information. This includes any individually identifiable health information that is held or transmitted by a covered entity or its associates. Covered entities include healthcare providers, health plans, and healthcare clearinghouses. In some cases, religious institutions that operate health clinics may also be considered covered entities and subject to the entirety of the HIPAA Privacy Rule.

Under HIPAA, covered entities must obtain an individual's prior written consent before disclosing their health information, except in limited circumstances. This means that churches that receive confidential health information must maintain its confidentiality and may be held liable for violating HIPAA if they disclose it without consent.

Invasion of Privacy

In addition to HIPAA, churches must also be mindful of invasion of privacy laws. Many states recognize "invasion of privacy" as a basis for liability, which can include:

• Public disclosure of private facts: This includes publicly disclosing highly offensive or embarrassing private facts about an individual without their consent.
• Use of another person's name or likeness: Churches may commit this type of invasion of privacy by publishing a picture of a person without their consent, especially if they expect financial gain by doing so.
• False light in the public eye: Attributing beliefs or positions to individuals that they do not hold, or making false statements about them, can place them in a false light and constitute an invasion of privacy.
• Intruding upon another's seclusion: Intentionally intruding upon an individual's private affairs, such as entering their home without consent or eavesdropping on their conversations, can be considered an invasion of privacy.

Privacy Policies

To protect the privacy of their members, churches should create comprehensive privacy policies that address the collection, use, and sharing of personal information. This includes information collected through websites and online directories, which may be subject to state privacy laws and regulations such as the Child Online Privacy Protection Act (COPPA).

Best Practices

• Determine what information is public and private: Allow members to set their contact information to private and restrict access to certain details to specific groups.
• Collect and distribute data on a "need to know" basis: Only share information with those who need to know, such as financial details with the treasurer or medical conditions with the visitation pastor.
• Exercise caution with high-profile members: Members who work in civil service, the military, legal or healthcare professions, or missions may need extra data security.
• Protect the privacy of children and youth: Only include limited information about minors in online directories and ensure that access is restricted to members only.
• Add password protection: Use password-protected access to limit who can view personal information in online directories.
• Obtain consent: Always seek permission before posting any sensitive information about members, such as prayer requests or health conditions.

What are the privacy obligations of church leaders?

Church leaders have a duty to respect the privacy of their members, volunteers, and employees. This includes protecting their personal information and health information. Here are some key privacy obligations for church leaders:

• Comply with Health Insurance Portability and Accountability Act (HIPAA): If a church handles any confidential health information, it must comply with HIPAA. This includes information received in writing, electronically, or orally by employees, clergy, or volunteers. HIPAA imposes strict confidentiality requirements and allows disclosures only in limited circumstances without prior written consent. Violations can result in penalties.
• Protect Personally Identifiable Information: Church leaders should safeguard members' and visitors' personal information, such as names, contact details, addresses, and financial information. This is especially important for those in high-profile jobs or sensitive fields, like law enforcement or military personnel.
• Obtain Consent for Use of Images and Likeness: Churches should obtain consent before using an individual's name, image, or likeness for promotional or financial gain, as unauthorized use may constitute an invasion of privacy.
• Respect Confidentiality in Counseling Sessions: Information shared by members during private counseling sessions should be kept confidential and not disclosed without consent.
• Create a Comprehensive Privacy Policy: Churches should have a privacy policy that informs members and visitors about how their personal information is collected, used, stored, and protected. This builds trust and ensures compliance with regulations like the General Data Protection Regulation (GDPR) when processing data of EU citizens.
• Avoid Public Disclosure of Private Facts: Church leaders should refrain from publicly disclosing private information about members, such as sensitive health conditions or personal struggles, without their consent. Such disclosures may constitute an invasion of privacy and lead to legal consequences.
• Exercise Caution with Children's Information: Church directories and online communications involving minors should be handled with extra caution. Only share limited information, and ensure that access to minors' personal details is restricted to authorized individuals.

Frequently asked questions