HIPAA (Health Information Portability Accountability Act of 1996) is the privacy care act involving electronic transfer of records so that the identity of a patient remains unknown. It includes any electronic, written or oral transfer of information. When I was a kid, there was no such thing. As a grown-up medical professional, you are surrounded constantly by HIPAA. Charts are placed on doors, so the names are hidden, instead of names initials are used when referring to patients in clinical conferences, doors are shut while rounding in the hallways when the attending begins his usual discussions with residents and medical students. It is an excellent way of protecting patient ID. It can impede or delay more fruitful activities. It can also be a bit murky so when in doubt sometimes it is better to remain mum. If the good intentions behind the act don’t convince you perhaps the penalties will. Penalties are hefty and can be up to $25,000 for a violation, maximal at $50,000 or 1 year of imprisonment depending on the severity of the offense.
Sometimes when you are rounding, and there is only a curtain that serves as a partition between two patients how does one get around it? Does it violate HIPAA when discussing someone’s care when you are clearly within earshot of someone else? Technically speaking, yes it does. Do authorities turn a blind eye? Of course, they do. Unless a quarter of a million health care facilities remodel their patient rooms, you can’t get around not speaking about someone’s case in earshot of other people. Most rounds occur in the morning outside of visiting hours. But sometimes you have to round in the afternoon, and by then you are greeted by a room filled with people. So, in this case, HIPAA seems more of a formality but something you try to do even when it is impossible in this set-up. At least, giving the illusion of protecting privacy by drawing the flimsy curtain even though everyone inside the room can hear you appear sufficient. HIPAA violation: technically yes, but authorities turn a blind eye because you have to do your job and there’s no way around it so in reality no.
They say so long as patient identifiers are left out you act in accordance with HIPAA. One morning as a fresh brand new attending trying to get my job done and living the urban life I inadvertently had to get some information while riding on the bus. It was very noisy I tried my best not to mention names but couldn’t hear clearly so asked my colleague to repeat some statements. As luck would have it, I was sitting across from someone who worked in a hospital. She corrected me that I was violating HIPAA. I wracked my brains trying to recall my conversation, did I mention any names? Although names are identifiers, if you are discussing information or even writing about a previous case in a novel, if someone is still identifiable that is a violation of HIPAA. I swore to myself never again will I allow myself to be put in that position again. HIPAA violation: yes, because someone might still be able to identify that person hearing the information.
Going down an elevator, physicians are always reminded not to discuss care even without patient identifiers. A few years after this incident above, a colleague started to ask questions about a common case we shared in the elevator. Alarm bells were ringing in my head recalling a past incident of HIPAA mainly my bus event. The hardest lessons sting so you never forget. So, I tried to courteously avert the discussion because of HIPAA. He countered that he did not mention any names none too pleased. But if the information is presented in such a way one can identify a patient, this is in violation of HIPAA. I wasn’t about to go down that rabbit hole again. So, I acted in accordance with HIPAA and waited until we both got off. My colleague eventually got over it, and we were collegially nodding at each other in the hallways again after a few weeks. HIPAA violation: yes. Some say no but in reality, it’s yes because someone can still be identifiable through the information. Even if it means displeasing colleagues for a few days, protect your patients’ privacy and protect your unblemished name.
Many physicians write on the side as an outlet including novels and health blogs. Usually one draws on one’s work life experience to describe characters in a book or relay an interesting tale. However, even without mentioning names one must keep in mind if a patient can identify themselves in what you write about this may be a violation of HIPAA. HIPAA violation: potentially yes if someone can identify it is them and prove it. So, technically yes but proving it would be difficult. Best bet is to change as many demographics as possible and even details, so the person is completely unrecognizable.
Most people working in the health care field are well-intentioned, but even if you are unknowing of all the nuances of HIPAA, it might be better to stay mum or ensure you keep discussions private in a room with a closed door.
Virginia Thornley is a neurologist who blogs at Neurology Buzz.
Image credit: Shutterstock.com
