Patient Confidentiality

Excerpt

Ensuring the security, privacy, and protection of patients' healthcare data is critical for all healthcare personnel and institutions. This is truer than ever in this age of fast-evolving information technology. In the past, healthcare workers often collected patient data for research and usually only omitted the patients' names. This is no longer permitted; any protected health information (PHI) that can identify a patient or the patient's relatives, employers, or household members must be omitted before being used for research. The Health Insurance Portability and Accountability Act (HIPAA), Public Law 104-191, was enacted into federal law to ensure that patient medical data remains private and secure. There are 2 main sections of the law: the privacy rule, which addresses the use and disclosure of individuals' health information, and the security rule, which sets national standards for protecting the confidentiality, integrity, and availability of electronic PHI. The privacy rule specifies 18 elements that constitute PHI. These identifiers include demographic and other information relating to an individual's past, present, or future physical or mental health or condition or the provision or payment of health care to an individual.

HIPAA was enacted to encompass 3 areas of patient care:

1. Portability of insurance or the ability of a patient/worker to move to another place of work and be certain that insurance coverage is not denied

2. Detection and enforcement of fraud and accountability

3. Simplify administrative procedures in health care and other professions (this is an area where communication and transmission of records are done electronically). With improved technology, the role of wearable technology and androids in disclosing PHI is now under scrutiny.

The penalties for failing to comply with HIPAA can be severe.

To Whom Does HIPAA Apply?

HIPAA applies to all healthcare institutions and healthcare workers who submit claims electronically. For example, if you are a healthcare worker and transmit or even discuss PHI with others not involved with that patient's care, you violate HIPAA. However, a HIPAA rule permits disclosure of PHI without prior obtained consent for healthcare operations, treatment, and payment. This includes consultation between providers regarding a patient, referring a patient, and information required by law for public health safety and reporting. These exceptions cover the majority of clinical uses of PHI. Other disclosures demand explicit patient consent and apply to everyone in a healthcare facility, including:

1. Providers

2. Nurses

3. Pharmacists

4. Administrative personnel

5. Foodservice

6. Clerical

7. Janitorial service

8. All other healthcare professionals

The HIPAA policies also apply to any interns and volunteers who work under supervision at a health clinic or hospital, third-party contractors, or business associates, including:

1. External laboratories

2. External imaging services

3. Outside computer repairman

4. Accredited agencies that conduct patient surveys

5. Medical equipment companies

6. Pharmaceutical salespeople

Definition of PHI

HIPAA broadly defines PHI as any health information transmitted or maintained in electronic media. It is also important to know that PHI is restricted to transmission not only on electronic media but also in any oral communications of identifiable health information that constitutes PHI. For example, if a surgery resident speaks about a surgical procedure in an elevator full of people, that can be a HIPAA violation if any PHI is mentioned. The majority of medical records in healthcare institutions and clinics meet the definition of PHI, some of which include:

1. Admission profile

2. Billing records

3. Patient profile

4. Prescription records

5. Referrals

6. Discharge and follow-up appointments

Hence, all healthcare institutions and clinics must comply with HIPAA standards for security and privacy.