Originally published in the February 4, 2021 issue of Part B News.
A murder-suicide at a doctor’s office in Texas serves as a distressing reminder that, in addition to an active-shooter protocol, a physician practice should prepare a post-incident response to help employees and patients cope and insulate itself from liability.
On Jan. 26, pediatrician Bharat Narumanchi, M.D., entered Children’s Medical Group in Austin and, after a five-hour armed standoff, killed another pediatrician, Katherine Lindley Dodson, M.D., then himself. His motive remains unclear, though Narumanchi, who had received a terminal cancer diagnosis, had been refused work at the practice previously.
Such incidents are uncommon but not unheard of. For example, in February 2020, orthopedic surgeon David Duffner,M.D., was shot dead at his Rancho Mirage, Calif., office. In July, a staff member at a Mount Laurel, N.J., doctor’s office was shot to death by a patient’s son. In December, a man entered a clinic in Vancouver, Wash., and fatally shot a caregiver, then himself.
More recently, a man shot his estranged wife as she worked at the Chatuge Outpatient Rehabilitation Clinic in Hiawassee, Ga., on Jan. 26, 2021.
Rare — but time to prepare
Health care facilities rank first among occupations for workplace violence incidents in general. While statistical studies are infrequent and seldom limited to physician practices, the U.S. Occupational Safety and Health Administration (OSHA) reported in 2013 that “between 2011 and 2013, workplace assaults ranged from 23,540 and 25,630 annually, with 70 to 74% occurring in health care and social service settings.”
For both safety and legal reasons, practices are often advised to take precautions, including training and protocols, that will prepare staff for violent incidents in their offices (PBN 2/25/19). Less often discussed is how to handle the aftermath of such incidents.
Expect police presence, mind PHI
If such a harrowing situation were to occur, you should know that the police may be in, and throughout, your office for several hours after such an incident, warns Robert D. Sollars, a security consultant in Tempe, Ariz., and author of the book Murder at Work: A Practical Guide for Prevention on workplace violence.
“They’ve got to interview everybody,” Sollars says. “Sometimes they’ll just get your name and all that stuff and send you on your way, but other times, they’re going to keep you for a couple of hours.”
However, you should know that the police don’t have unlimited rights on your time and premises, says Andrew A. Rozo, an attorney in New York City. “The 4th Amendment protects people — and businesses to variable degrees — from unreasonable searches and seizures,” Rozo says. “The U.S. Supreme Court has also ruled that there is no ‘murder scene’ exception to these rights. However, the reality is that we do want the police to conduct a full investigation.”
Be aware that your HIPAA responsibility to keep patient protected health information (PHI) private does not extend to information needed to identify or apprehend a dangerous criminal: You may make a “good faith” disclosure, HHS explains in a Privacy Rule FAQ. If disclosure is “necessary to prevent or lessen a serious and imminent threat to the health or safety of the patient or others and is [made] to a person(s) reasonably able to prevent or lessen the threat,” such as the police, then you are by law able to share PHI, HHS says.
Once the police have finished with you, you’re going to have to clean up, and in extreme circumstances this will require the services of cleaners specializing in crime scenes, which can be substantially more expensive than regular cleaners, Sollars says.
How much to say
In the meantime, you and your staff will need to make some calls. Rozo advises that you check on your employees. “The practice has emergency contacts for a reason,” he says. “Calling the emergency contacts is one thing the practice can control in that situation and the practice should be sure to do it well.”
You’ll also need to inform such patients as are expected in the immediate aftermath of the incident that they need to be rescheduled, or to arrange alternate treatment. How much to tell them when you make contact is a judgment call —assuming that the patients are not under threat. If any of them are, you have a positive duty to warn them (PBN blog,7/30/19).
“Just be as general as you possibly can,” Sollars advises. Allude to an “incident,” and if pressed say, “’I can’t really discuss it right now,’” Sollars says. “The police are probably going to want everybody there to be tight-lipped until they’re finished with their investigation anyway.”
Word of the event will probably leak eventually, however. “If somebody got murdered in your office, more than likely it’s going to be all over the news anyway,” Sollars says. People will get more specific in their questioning. Again, how much to reveal is your call, but be careful not to violate HIPAA, as there’s no compelling reason to reveal PHI in that situation.
One consideration is the patients’ peace of mind. “You do not necessarily need to tell patients who are not in danger about a violent incident that happened at your office,” says Erin Smith Aebel, shareholder with Trenem Law in Tampa, Fla.
“However, you may choose to do so to communicate what safety measures you are planning on taking in light of the incident.”
Check security
The additional “safety measures” aren’t just a good PR measure — they may actually help indemnify your practice against liability if it’s subject to another such attack.
“Legally, any reasonable precautions should be implemented to avoid possible future liability and to prevent the same tragedy from happening again,” Rozo says. “If it is the first time an incident like this happened, then there shouldn’t be much to worry about in terms of liability. That worry increases significantly the more [often] something has happened, though.”
“The main questions for lawyers should be, what are the reasonable precautions I should implement to avoid harm to patients and employees?” Rozo says. “In the case of COVID-19, it’s requiring face masks and social distancing. In the case of a violent act, it’s probably a panic button to call the police quickly; security cameras; smart locks to control who enters, and things like that.
You should also have “a section in office policy manuals where employees [are told] how to handle various situations,” Rozo adds. “The best analogy is playing the field on a baseball team: You have to know where to throw the ball if it comes to you.”
Rozo is especially keen on the cameras: “Every business, medical or not, should have some installed if they serve the public and have high volume,” he says. “The recordings make the police investigation easier and can get the police out faster because they can see exactly what happened.”
Aebel favors a professional security consultation. “If something awful like this happens, what’s the safest thing for us to have done?” she asks. “It is hard for small businesses, because it may not be cost effective to have bulletproof glass everywhere, but there may be something that they could do that’s more practical and affordable, and it may be worth their while to talk to a safety expert about the different levels of protection that they can afford. It’s good to look at that at least annually as well as in response to an incident.”
