Chapter 26: Breach of Privacy
Whether the publication of a person’s medical records would violate HIPAA today depends on
many factors; most important, who released the records. HIPAA protects “all ‘individually
identifiable health information’... in any form or media, whether electronic, paper, or oral,” but
it only applies to “covered entities,” which are health-care providers and health insurers that
“furnish, bill or receive payment for” health care, and who transmit any covered health inform-
ation electronically. This means any noncovered entity can release or publish a person’s med-
ical records without violating HIPAA.
According to Robert Gellman, a health-privacy expert who chaired a U.S. government
subcommittee on privacy and confidentiality, any Hopkins faculty member releasing Henri-
etta’s medical information today would most likely violate HIPAA, because Hopkins is a
covered entity.
However, in October 2009, as this book went to press, portions of Henrietta’s medical re-
cords were again published without her family’s permission, this time in a paper coauthored
by Brendan Lucey, of Michael O’Callaghan Federal Hospital at Nellis Air Force Base; Walter
A. Nelson-Rees, the HeLa contamination crusader who died two years before the article’s
publication; and Grover Hutchins, the director of autopsy services at Johns Hopkins. See B.
P. Lucey, W. A. Nelson-Rees, and G. M. Hutchins, “Henrietta Lacks, HeLa Cells, and Culture
Contamination,” Archives of Pathology and Laboratory Medicine 133, no. 9 (September
2009).
Some of the information they published had previously appeared in Michael Gold’s Con-
spiracy of Cells. They also published new information, including, for the first time, photos of
her cervical biopsies.
According to Gellman, “It seems quite likely that HIPAA was violated in this case. But the
only way to know for sure is an investigation that would go into complicated factors, including
how they got the medical records in the first place.” When I called Lucey, the paper’s primary
author, and asked how he’d gotten her records, and whether anyone had sought the family’s
permission to publish them, he told me the records had come from his coauthor, Hutchins, at
Hopkins. “Ideally, you’d like to get family approval,” he said. “I believe Dr. Hutchins tried to
track down a family member without success.” The authors had obtained IRB approval to
publish a series of articles using autopsy reports; in the other articles, they’d used initials to
conceal patients’ identities. Lucey pointed out that some of the information from Henrietta’s
medical records had been previously published, as had her name. “In this case protecting her