You just heard that your college president has been involved in a car accident near campus and has been taken to the university hospital. Witnesses told your reporter that the president was bleeding pretty badly, but they did see her answering the questions of paramedics at the scene. As you have done for "accident stories" in years past, you immediately call the hospital to find out the president's condition. This time, though, you're met with a firm "I'm sorry but we can't provide that information."

Meet HIPAA.

The "Health Insurance Portability and Accountability Act of 1996," 42 U.S.C. Sec. 1320d et seq., a federal law better known by its acronym, HIPAA, effectively kicked into gear in April 2003, creating new obstacles for journalists seeking to obtain health information.

Part of the law limits the ability of health care providers, insurance companies, medical billing companies � and the business associates of such groups (for example, a health insurance company's law firm) � from providing protected "health information" about an identifiable patient without that patient's consent. Among the records required to be kept confidential by HIPAA: physical or mental health information created or received by a health care provider or public health authority, health care claims and attachments, insurance applications and health care payment information. The law also limits the disclosure of physical or mental health information created or received by a school or university. Violations of HIPAA can result in fines or even jail time.

Unfortunately, HIPAA � and the Department of Health and Human Services regulations that accompany the legislation � are a model of government muck, spurring an entire industry whose job it is to help health care providers, HMO's, health insurance companies, schools and others figure out their obligations. Two things, though, are certain: First, the law does prohibit some previously available sources from providing medical information about specific individuals to reporters. Second, the law does not close off all medical information to reporters. Unfortunately the law is being used � out of ignorance, fear, malice or a combination of the above � to prohibit access to newsworthy information even when HIPAA does not apply, causing growing frustration among news media organizations.

For example, HIPAA only restricts the release of health information by "covered entities," a finite group defined by regulation. Journalists are not "covered entities" and student reporters that lawfully obtain and publish medical information about an individual on their own do not violate HIPAA. This remains so even where the information is obtained from a "covered entity," as long as the journalist did not improperly induce the source to break the law. (Of course, the traditional law regarding invasion of privacy still applies.) HIPAA does not prohibit student journalists from asking questions of health care providers or patients or engaging in other lawful newsgathering efforts, such as peacefully taking photographs or video of a hospital or an accident scene from a public street or sidewalk.

HIPAA also does not apply to most other government service providers not engaged in health care. For example, law enforcement agencies and fire departments are not "covered entities" and HIPAA does not prohibit disclosure of police or fire incident reports. Similarly, court documents that contain medical information, autopsy records and courthouse birth and death records are not affected and continue to be available as required by a state open records law. Family members, witnesses to an accident, clubs and associations and religious organizations can also provide medical information to reporters without violating HIPAA.

Even where health care information is protected it can always be released with a patient's � or if the patient is a minor, parental � consent. In addition, the law allows health care providers to release limited "directory information" about a patient after that patient has been given the opportunity to restrict the disclosure of this information, which usually occurs during the admissions process. Where a patient has not objected, the hospital can then confirm for a reporter the patient's name and provide his location in the hospital and his general condition (for example: "good," "fair," "serious," "critical," or "treated and released").

Finally, HIPAA only applies to "individually identifiable health information." So while a university medical clinic is a "covered entity," HIPAA would not prevent its employees, for example, from providing anonymous statistical information about the number of students treated for the flu or the number of students seeking birth control information.

While HIPAA does provide some new hurdles to medical reporting, it is not the information-eating monster that some claim. Knowing where the lines are drawn should help reporters navigate the HIPAA maze.

Mike Hiestand is an attorney and works as a legal consultant to the Student Press Law Center.