Though it’s been in effect for more than 12 years, the Health Insurance Portability and Accountability Act likely entered the lexicon of many sports fans for the first time last week. What those fans discovered is that, for such a clear-cut law, HIPAA presents a lot of ethical gray areas for reporters.

To set the scene: Last week, ESPN NFL reporter Adam Schefter obtained an image of medical record that showed New York Giants defensive lineman Jason Pierre-Paul had surgery to amputate his right index finger following a 4th of July fireworks accident. Schefter attached the image to a tweet:

Since [HIPPA] was passed, it’s often been used as an excuse for hospitals to release less information than is actually allowed under the law.

ESPN obtained medical charts that show Giants DE Jason Pierre-Paul had right index finger amputated today. pic.twitter.com/VI5cbS1uCw

— Adam Schefter (@AdamSchefter) July 8, 2015

That one post resulted in myriad stories questioning the legality of the tweet and suggesting that Schefter and ESPN may be in violation of HIPAA.

But that’s not the case at all, according to the Reporters Committee for Freedom of the Press.

“ESPN is very much in the clear here. HIPAA does not apply to journalists—it only applies to covered health entities,” said Kimberly Chow, a legal fellow at RCFP. “Whoever released the medical information is the one who is under the gun, so to speak, and they’re the one who can be punished for that law theoretically. But reporters, as long as they did not aid in the leaking or facilitate it, if they just received it, then they are in the clear to report on it and publish it.”

Clearing up this kind of confusion is something RCFP has been working on since HIPAA went into effect in April 2003.

“When HIPAA was passed, it created a lot of confusion for reporters and for hospitals in terms of what could be released by hospitals about patients and treatment information,” Chow said. “We found that, since it was passed, it’s often been used as an excuse for hospitals to release less information than is actually allowed under the law.”

And that’s cause for concern from a journalistic aspect, she said. Despite several legal battles between hospitals or healthcare providers and reporters over the release of patient medical information—which have typically been resolved in favor of news organizations—reporters’ ability to obtain information hasn’t gotten any easier.

“It’s such a case-by-case basis with each hospital making their own decision, and often reporters will, instead of citing HIPAA, often just choose not to do the story because it is so difficult,” Chow said. “It’s not like they’re pushing back in every case, they’re just changing their behavior, which is damaging when there are a lot of public interest stories to be had out of reporting from hospitals.”

To help, RCFP provides a number of resources for reporters on legal matters, including HIPAA. The group also has a hotline that reporters can call to get advice and ask questions about privacy issues and how to proceed with a story they are pursuing.

“It’s important for us to help reporters distinguish between the legal requirements and whatever ethical obligations they might have, because they’re often quite different,” said Chow. “The law allows reporters, often, to do a lot more than most reporters would feel comfortable with doing ethically. So, we help them to figure out those boundaries, but in the end, it’s a question for the reporter and editors about what they feel is in the public interest. In this case, it seems like ESPN thought it was in the public interest for the public to find out what happened after this fireworks accident.”

Jason Pierre-Paul, whose medical records were controversially shared by a prominent reporter on Twitter. (Mike Morbeck/Flickr)