From the archive · 2023

Buzz · Blog · HIPAA

NFL and HIPAA Compliance?

By Sandeep Shah · Buzz by Skyscape · Published January 2023

All posts

Since Monday night’s Bills-Bengals game, the nation has watched Damar Hamlin’s medical condition with bated breath, hoping for good news, which has since come with his improving condition. The medical response in Cincinnati was remarkable, and it was due to the NFL’s game-day preparedness protocols that coordinated the urgent collaborative response that fortunately saved Damar’s life.

While Damar’s situation is tragic and, thankfully, very rare, it is concerning to learn that the radio transmission of the emergency response at Monday’s game has been reported on, and actually shared, by the New York Times. Having spent a career managing information and privacy across platforms, particularly mobile platforms in the healthcare environment, I think it is essential to recognize the potential for misuse of such sensitive medical information. This is particularly true for professional athletes, whose medical information moves the billion-dollar sports betting market.

The Health Insurance Portability and Accountability Act (HIPAA) exists to protect the privacy of patients and their medical information. The public release of this radio transmission, which likely included detailed descriptions of the player’s medical condition, whether through an unintentional information leak between treatment providers or a nefarious breach by a bad actor, violates HIPAA regulations and compromises the individual’s privacy and, secondarily, the sport’s integrity.

Furthermore, sharing such information without the patient’s explicit consent raises ethical concerns. While it is understandable that there is a desire for knowledge and transparency in high-profile cases like these, it is vital to consider the impact on the patient and their right to privacy.

Situations like this, where medical information is made public without the patient’s consent, fall into uncharted waters. Organizers and player associations need to collaborate on protocols that keep communication HIPAA compliant from the moment of response through treatment and recovery.

Book a demo

Twenty minutes. See how care teams keep sensitive conversations inside one secure thread. Skyscape signs a BAA before any PHI is exchanged.