El Paso, Odessa, Dayton, Sutherland Springs. These are the names of cities now familiar not because of their unique culture or economic significance, but because each has been the scene of a mass shooting. Sadly, these types of mass tragedies are becoming more commonplace, and this trend shows no sign of abating.
There are multiple definitions for what constitutes a “mass casualty incident” (MCI). For the Department of Justice, Community Oriented Policing Services Division, an MCI is an event in which four or more individuals are shot, whether wounded or killed, excluding the perpetrator. Under federal law, a mass killing is defined as three or more killed in a single incident. However, for healthcare facilities, exact numbers aren’t always critical. A major urban trauma center may be equipped to deal with four critically injured patients, while a small suburban facility would be overwhelmed by such a situation. Thus, the best definition of an MCI may be “the number of casualties that exceed the resources normally available from local resources. This is based upon available resources, number of injuries, and severity of injuries.” It is this type of MCI, one that exceeds a facility’s normal capacity, that requires the most advance planning and preparation.
Unlike natural disasters, which can occur over days, an MCI can happen quickly, often within minutes, and without notice. Although earthquakes share these same characteristics, the damage from an earthquake is typically spread over a wider area and the emergency response will often involve multiple facilities. With an MCI, the hospital nearest to the incident can be immediately overwhelmed. While a full discussion of the legal requirements for emergency preparedness is beyond the scope of this article, this article will discuss a hospital’s EMTALA obligations during an MCI, applicable HIPAA requirements, including the limitations of public disclosures, a frequent issue with newsworthy events, and finally, unexpected operational issues experienced by facilities that have faced MCIs within their communities.
The Emergency Medical Treatment and Labor Act (EMTALA) requires all Medicare-participating hospitals with emergency departments to provide any individual who comes to the emergency department, regardless of ability to pay, with the following services:
Complying with EMTALA can be challenging during an MCI. These events occur extremely quickly and patients may arrive at the hospital with little or no notice. Further, because they often occur in a single location, the nearest hospital will receive a disproportionate number of victims. Diversion protocols established within emergency medical services (EMS) systems may do little to prevent this surge, as many patients either self-transport or are transported by friends or family. Although there are certain circumstances under which a hospital’s EMTALA obligations can be waived, these criteria will unlikely be present with an MCI. However, there are strategies that can be implemented in the event of a significant surge in emergency department (ED) patients without the need to obtain a waiver.
It is not required that an MSE be conducted within the hospital’s ED; the hospital can set up alternative screening sites on campus. Patients can be redirected to these alternate sites even prior to arrival at the ED, although the person directing potential patients must be qualified to recognize those who need immediate emergency treatment. Further, patients must be logged in prior to being redirected. However, absent an EMTALA waiver issued by the Centers for Medicare & Medicaid Services (CMS), hospitals may not direct an individual who has arrived at the ED to any off-campus locations. Once a patient is directed to an alternate site on-campus, the patient must receive an MSE, although the scope of the required screening will depend upon the patient’s clinical symptoms. Any MSE conducted outside the ED must be performed by qualified clinical personnel, and if a patient is determined to have an EMC, the patient must be provided stabilizing treatment or an appropriate transfer.
There are additional specific strategies hospitals can consider in coping with a sudden influx of injured patients, such as early discharge planning, opening additional beds, and the use of remote locations. For an outpatient surge, the use of tents or mobile facilities located on or within a hospital’s campus are potential coping strategies as long as such facilities meet all CMS Conditions of Participation as was well as any state, county, or life safety code requirements.
A hospital can consider coordinating triage and the redistribution of patients with local EMS authorities and other regional hospitals through the use of a community wide plan (this is distinct from a community call plan). In such circumstances, a qualified practitioner would be required to conduct an MSE and, as appropriate, patients would be directed to the hospital or transferred to other receiving facilities who have agreed to accept patients. In its guidance entitled “EMTALA and Disasters,” the Health and Human Services’ Office of the Assistant Secretary for Preparedness and Response, Technical Resources, Assistance Center, and Information Exchange (ASPR TRACIE), provided an example of EMTALA compliant arrangements utilizing a community plan. In its example, ASPR TRACIE stated that if the capacity of local hospitals was determined based upon a pre-existing plan (e.g., hospitals A, B & C can accommodate 50 critical, 100 immediate and 300 ambulatory patients), a qualified practitioner could perform an MSE and redirect and coordinate transfer of those patients without having to speak directly, clinician to clinician, to the receiving hospital for each patient. However, it should be noted that the EMTALA Interpretive Guidelines for surveyors, issued by CMS, do not appear to echo the language indicating that use of a community plan acts as the de facto consent required from a receiving hospital prior to transfer. As identified, this type of patient transfer should only be conducted in compliance with pre-established community planning efforts.
The Health Insurance Portability and Accountability Act (HIPAA) is designed to safeguard a patient’s protected health information (PHI), while also ensuring that such PHI can be disclosed and utilized by facilities, practitioners and individuals, as necessary, to provide treatment to the patient. However, during an MCI, determining the appropriate use and disclosure of PHI can be a challenge. Many patients will be incapacitated and arrive without wallets and purses, complicating the task of identification and determining who is a family member. Multiple law enforcement agencies will likely be involved and require patient information. Further, with today’s 24/7 news cycle, it can be expected that reporters will be omnipresent and requesting constant updates. Despite the difficult circumstances, it will be incumbent on hospitals to implement sufficient safeguards to protect patient information against impermissible disclosures.
A hospital may share PHI to assist in the identification of the patient or to locate his or her family members. Further, a hospital may share PHI with family members and friends or other persons identified by the patient as involved in the patient’s care. However, the hospital must (i) obtain the patient’s agreement to the disclosure, (ii) be able to reasonably infer the patient does not object to the disclosure, or (iii) determine the sharing of such PHI, under the circumstances, is in the best interest of the patient.
A hospital may release patient information to disaster relief organizations, such as the Red Cross, to coordinate efforts with such organizations in identifying victims or notifying family members. However, it is not necessary to obtain the patient’s authorization to share the information if it will interfere with the organization’s ability to respond.
When information is requested about a patient by name, a hospital may release limited directory information to verify that the individual is in the hospital. Additionally, a general description of the patient’s condition (e.g., critical, stable, fair) may be released and members of the clergy may be informed of the patient’s religious affiliation, provided the patient has not objected to or otherwise limited such disclosures. If the patient is incapacitated, the disclosure is permissible if it is believed to be in the best interest of the patient and is consistent with any prior expressed wishes of the patient. Specific information about a patient, such as identified condition or test results, may not be disclosed without a written authorization.
A hospital may release information to law enforcement as required by law. Additionally, when a patient is a potential victim of a crime, PHI may be disclosed to law enforcement upon the authorization of the patient or, if the patient is incapacitated, upon the officials’ representation that (i) the PHI is necessary to determine whether there has been a violation of the law, (ii) the PHI obtained will not be used against the victim, and (iii) the investigation would be materially and adversely affected by waiting until the victim can agree to the request. Additionally, it must be determined, in the professional judgment of hospital clinical personnel, the disclosure of information is in the best interest of the patient.
If the patient is the suspected perpetrator, a hospital may disclose information necessary for purposes of identifying or locating the suspect. This may include name and address, date and place of birth, social security number, ABO blood type and Rh factor, type of injury, date and time of treatment, distinguishing characteristics (e.g., age, race, gender, scars, tattoos, body hair), and if applicable, date and time of death.
In any circumstance involving the sharing or disclosing of information, hospitals must make reasonable efforts to limit the information provided to that minimally necessary to accomplish the intended purpose. It is also in a hospital’s best interest to ensure that its internal policies and procedures regarding the accessing of patient information remain in place and operational and that only employees carrying out their duties view patient information. A reminder to employees of the seriousness of inappropriately accessing or disclosing patient information may be warranted.
Any hospital receiving victims of an MCI will face incredible and unique challenges. Facilities that have experienced such tragedies within their communities have identified several unexpected issues that were of significant concern. These include:
The ability to respond immediately and capably to patients of a major MCI will stretch the resources of any facility. Understanding in advance the obligations posed by EMTALA and HIPAA under these circumstances, and the development of mechanisms to comply with such obligations, will be crucial. It will also be necessary for hospitals to consider and prepare for other concerns that may arise during these tragic events, including communication and security issues, overcrowded waiting rooms and corridors, and traumatized staff and visitors. Hospitals will be well served by devoting the time and resources necessary to develop carefully thought out strategies to enable them to competently confront the complex challenges inherent in dealing with an MCI.
