HIPAA and Medications
First – this post is for informational purposes only, and does not constitute, and may not be relied upon as, legal advice. We are not creating an attorney-client relationship here. If you need further guidance, please seek competent legal advice from an attorney licensed in your jurisdiction.
We have two issues here. The first issue is the Emergency Plan part of having medication available, and the second issue is whether HIPPA's privacy rules apply. I deal with the emergency plan issues on a constant basis in my role as a director of the National Association of Church and School Security. This is a hot topic across the country right now. With respect to medications there are also two issues. First, who administers the medication? Second, how are we controlling/storing the medication if it is a controlled substance? I want to raise some of the issues that ought to be considered, but I cannot give you definitive answers because the laws of your jurisdiction may vary.
Medications:
For example, if a primary child has severe asthma, it would be a good idea to have some on location in the event of an asthma attach during church or during an emergency, especially if something happened that caused the building to shelter-in-place, you may be stuck in that room for days. Because it is a prescription drug, there are limitations on who can administer the medication. For asthma, parents or the child could generally administer the medication as necessary. The same holds true for stroke medication and other regular prescription medications, as long as the drugs are being taken in a preventative manner. However, there are circumstances that could arise where somebody other than the patient may need to administer the medication (i.e. emergency treatments). In Colorado we have laws that allow certain qualified, identified, emergency response providers to administer medication without exposing themselves or the organization to liability. The church needs to identify those people with the requisite qualifications as part of its emergency plan. If the church does that, both the church and the member should be able to avoid liability for administering the medication. What you want to avoid is having the primary president, or relief society president, or high priest group leader, turn into a nurse tasked with dispensing or administering medication. That would be bad.
The second issue is controlling the actual medication. For most medications (including an inhaler) the patient, parent, or child could be responsible for bringing that medication to church to avoid storage issues. If a parent has that medication, you need to know where that parent will be at any hour. We generally encourage people to bring enough medication to last for a full day or more, in the event an emergency prevents them from replenishing their stock. That makes sense. You may also want to have certain medications on hand, provided that: (i) the medication is prescribed to, and provided by, the person who will be using that medication, and (ii) you have a qualified person able to administer the medication if necessary. If you decide to have medication on the premises, ensuring the secure storage of that medication is important, but not impossible. A good lock-box would work. However, you do not want to get into issues of trying to store any Schedule III drugs, such as Vicodin.
It is always a good idea to look at the "Good Samaritan" laws for your state. For example, in Colorado, a person providing emergency medical care is generally immune from liability as long as their actions are not grossly negligent; although medical professionals are still held to their normal standard of care and ethics. The same holds true for operating an AED device. The individual operator is not liable as long as they act reasonably and are not grossly negligent. However, the organization providing the AED device may be liable unless they qualify under a separate immunity provision, which states that the AED device must be provided pursuant to an emergency/training plan that is overseen by a physician. Good Samaritan laws generally do not allow for the administration of medication as part of emergency first aid. Which brings us back to the main topic – who is going to administer the medicine you have on hand, and how are you going to control it. Unfortunately, there is no "final answer" for these types of questions. I always tell churches that "a canned plan is not a plan." The right answer for your situation, as with any element of a security plan, only comes from the mental efforts of thinking critically about each potential threat or incident as it applies to your congregation and building.
HIPAA:
Now for HIPAA – the Health Insurance Portability and Accountability Act. HIPAA's privacy rules deal with the "protected health information" of individuals that is collected or held by "covered entities." This is not my main area of practice, but I do come across the rules on occasion. Generally, "covered entities" include health insurers, medical care providers, medical record/health care clearing houses, and employer sponsored health plans. Boy Scout camps collecting health forms and medications would not come within the scope of a "covered entity" nor does it seem that a church collecting similar information for emergency purposes would be considered a "covered entity." Thus, the church should not be subject to HIPAA's strict privacy and disclosure rules, nor would it be subject to the accompanying security, electronic security, and storage rules. However, it would nevertheless be a good idea to keep any information you collect as secure as possible and only discloses such information if necessary. Being careless with this type of personal information (especially something like being HIV positive) could open the church to additional claims for damages.
The earlier post also raises the practical issues of keeping this information up to date (don't our clerks already have enough to do).
Good luck!