In healthcare, confidentiality is the responsibility accorded to the healthcare professional s to keep the information and data of their patients in secret to maintain its confidentiality as intended and required by law. This confidentiality relies on the relationship between the patient and the healthcare provider, a culture and practice developed and maintained for a very long time. There are guidelines that govern this oath of secrecy and has been embedded into the laws of the land to make sure the providers uphold it at all times. The constitution also offers the patient a right to govern how their information is used or shared. In this paper, the issues on responsibility of the healthcare providers to protect their patient data, ownership is patient data, purpose of maintaining accurate and correct patient health records, defense of a person accused of leaking patient records and examples of legal cases regarding patient’s and provider’s right on private health records are discussed. The Health Insurance Portability and Accuracy Act has very clear guidelines on the privacy and confidentiality of patient information.
The HIPAA was enacted in 1996 under the privacy and security rules with a sole purpose of setting up a national standard that governs the use and disclosure of protected patient data (Moore, 2019). It offered the patients a control over their health information. They are offered a right to decide, when to whom, and to what extent their confidential information can be used. This information constitutes of and not limited to insurance information, diagnosis, research information, mental information, prescriptions and treatment schedules and plans. In this act, the health providers have their part to play in ensuring the security of patient data. Disclosure of patient private health information whether intentional or not intended is considered a violation of this act.
Delegate your assignment to our experts and they will do the rest.
Some of the responsibilities accorded to the providers in securing patient information include their rights to the use of this data. They can disclose or share this information for the purpose of treatment, when requesting or acquiring payments and when doing healthcare operations without requiring consent from the patients through a written or verbal confirmation. However, for the purpose of advertising or marketing themselves or their products and services, they must acquire direct authorization from the owner of the data before using or disclosing their health information.
It also clearly states that any health provider has to adhere to the requirements and regulations of Health Insurance Portability and Accuracy Act in making agreements with any business associates. This includes notifying their patients in the incidence of occurrence of a data breach as indicated in the breach notification rule of this act. This includes the impermissible use unless there is a clear indication that there is low probability of having the protected information compromised. It is however the responsibility of every physician to assess the whether the disclosure is above the required threshold of low probability of compromise. This is done through a four-factor level of assessment. First, is the nature of information, second is the person involved in the disclosure, third is whether the information was actually acquired, finally the extent to which the breach has been mitigated. Whether there is success to the control of this breach, it is required by law that the patient gets notified of the occurrence of these kinds of incidences.
Under the minimum necessary rule, the providers and their business associates need to limit and control their access to the patient information in carrying out their activities to the least levels possible. This way, there is limitation to unnecessary disclosures to this information minimizing the risks of occurrence of violation of the privacy act. The design of this policy is flexible to sufficiently take care of different circumstances that may require different levels of access and disclosure.
Under the law, the healthcare professionals and their facilities have an obligation to a careful and safe disposal of patient protected health information. This is clearly stipulated in the proper disposal policy of this act. It is prohibited to throw this information in regular trash. Most of the breaches of this information are usually accidental where a person access private information due to the negligence of the healthcare institutions or professionals especially in disposal practices. Whether the information is in electronic format or in paper, it is the responsibility of these organization to ensure proper disposal. Any information carried in electronic devices such as flash discs, cellphones, laptops, or floppy discs have to be erased, formatted or encrypted when it is not needed (Bourgeois, 2015).
The providers have to adhere to both federal and state laws concerning privacy of patient information. It should be noted that the protection of patient information is only removed if the owner is deceased for a time longer than 50 years. People involved in a deceased patient’s treatment or payments have access to the patient information too unless there are directives from the dead denying them access. If a patient pays all his or her bills out of the pocket, they have the right to offer restrictions on the use and disclosure of their information. There has been various other patient private data protection rules and acts after the HIPAA that further strengthen this rule while offering more protection such as Health Information Technology for Electronic and Clinical Health Act (HITECH) Omnibus Rule (Halamka, 2017). Any actions that violate the policies and standards set by this act are liable to civil and even criminal charges in a court of law.
There has been a lot of debated revolving allowed the ownership of medical records. Most people take a guess and say it is the patient who owns the medical record. Well, that is not entirely correct as the physician taking the information or responsible for creating the record and the facility from where these records were created have the ownership of these records (Telenti, 2018). However, the patient has exclusive rights to review, inspect and create a copy from the existing records of his or her treatment and payments. They have no right over the original document though. It is the responsibility of the facility safeguard this data by ensuring its safety from loss, changes, destruction or access from unauthorized persons. The original document can only leave the premises of the facility when requested to through a court order. The facility has no right to deny any patient access to their information even if their bills have not been settled. The laws state that the records containing health information are facility owned while the information in them belongs to the patient.
In recent times, there are issues arising from the electronic data of the patients. The federal laws do not have an explicit laws stating the ownership of electronic protected health information. Most of the state governments do not happen to mention the ownership of patient records in their laws and acts. In the case of electronic data, there are several holders of these data. There are the professionals creating the records, there is the facility that the providers work for, and there are the Electronic Health record vendors who control the cloud based databases. This makes it complicated to control the ownership of these records. The access of this information also gets complicated with some vendors denying access to this records for various reasons to various users.
On the scenario of celebrity’s data leakage, the celebrity has the right to sue both the nurse and the hospital for various violations of the protection, accuracy and privacy laws of protected health information. The institution is liable for containing wrong information on the patient. It is the responsibility of the provider to ensure accuracy of the information belonging to the patient. If the inaccurate records were created by a person working on behave of the providers, the institution is liable for these errors made by their employee. If the person who created these records is an independent contractor, the liability is complicated and will depend on the state laws of the hospital. However, if the hospital has control over the work of this health worker, there is a high chance the hospital will stand liable for these charges. The celebrity has the right to sue them for defamation on the view of the hospital having false information spread under his name. It is hospital negligence to have inaccurate information under the celebrity’s name.
On the exposure of the celebrity’s pictures, the nurse is fully responsible. The law states clearly that the unauthorized access whether intentional or accidental to the protected health information is a violation of the law. If the policies of the hospital clearly state the conduct of their workers in safeguarding the privacy of patient information, the nurse will be liable for creating this mess. The hospital however has a continued responsibility to teach their staff on the importance of ensuring confidentiality and keeping the patient information secure at all times. It was very reckless of the nurse to take pictures of the patient without his consent. The hospital has a responsibility in informing the patient in case of leakages of his information. The nurse has also a responsibility of informing the hospital on the accidental leakage.
Violation of the Health Insurance Portability and Accuracy Act is not a thing that is unheard of. There are various occurrences of bleaching of protected health information in many accounts. One of this incidences happened in an Atlanta midlevel clinic. On a usual day, a nurse receives a patient in the reception who has come to seek medical attention. The patient sees the doctor and is sent to the laboratory. The patient is informed that his results will be out in a few days’ time. He gives the nurse his cellphone number and his home address in case they need to communicate further. In his records, the patient had filled a mandatory record requiring his personal information.
When the results were released, the nurse was requested by the doctor to collect the laboratory results and communicate them to the patient. This was important because he needed urgent medical attention according to the laboratory results. When the nurse received these results, he called the cellphone number of the client. The number was unreachable. The nurse sought his medical records to find out whether there was another way to reach the client. In the record was the number of the home phone. She thought it was logical to try this number. When she called the number, the daughter of the patient received the call. She communicated the information to her about the request of that her father should visit the hospital as soon as possible. The daughter requested for more information and when the nurse declined to tell the details of the appointment, she begged for it and even turned emotional on the call. The nurse was sympathetic and finally gave some few details concerning the client’s condition.
After the father came home, he received the information conveyed by the nurse to his daughter. However, he felt sad that his information had been given to someone else without his consent. He felt he had an obligation to teach the nurse the right way to communicate patient information. He filed a lawsuit on the bleach of privacy of his protected information to unauthorized persons. He argued that he had specifically given his cellphone number for the purpose of receiving that information. He also argued that the nurse had not satisfied that even the receiver was his daughter expect taking her word for it. She had also given a lot of information over the phone about the client’s medical condition.
After the hospital was served with the lawsuit, they called the client to the hospital and requested to resolve this issue internally. The only condition of the client was to have the hospital have additional policies on the minimum necessary information that can be communicated through other means other than conveying it directly to the patients. The hospital complied to the conditions and further educated their workers on what can be communicated electronically to the patients. There were no legal consequences faced by the nurse or the hospital but there were changes made to the policies of the hospital.
Another scenario is the case that happened at Guthrie Clinic Steuben in Corning, New Nork. A nurse had been on duty and learned of a patient who had sought medical attention over a sexually transmitted disease in the hospital. The patient was the boyfriend to her sister-in-law. They nurse sent six messages to her sister-in-law with contents on the condition of the patient. When the patient learned of these acts, he filled lawsuit against the hospital claiming violation of his privacy rights.
The clinic took action and fired the nurse immediately. The client’s lawyer told the court that his relationship had been ruined, his friendships strained and his whole life affected by the occurrence of these incidences. He even claimed to have moved from his home. The lawyer needed the corporations to be held liable for these actions to act as a lesson to formulate new protocols that prevent the occurrence of these incidences. The lawsuit was dismissed by a federal judge claiming the nurse was liable for her actions as she acted outside her duties (Price, 2019). The nurse had violated the clinic’s policy accessing information of a patient she was not even involved in his treatment. The clinic’s attorney viewed this case as an unforeseeable circumstance which the corporation cannot be liable to.
These cases lead to changes in their corporation policies with the intention of preventing these kind of events from happening. The relationship between these cases and Jennifer’s case is the unauthorized leakage and bleach of patient protected health information. The consequences of the incidences have repercussions where some of the employees lose their jobs (Price, 2019). The providers too take actions by adding more hospital policies to keep away such events from reoccurring in their institutions. It is the responsibility of the providers to educate their employees on the importance of ensuring information confidentiality. The employees have a moral responsibility to adhere to these rules and avoiding actions that can compromise the integrity of this data. The courts should keep up their work of prosecuting those liable for such crimes and violations
In conclusion, it is a collective responsibility to preserve manual or electronic data confidentiality. The health professionals, the providers and associated servicers should learn the consequences of violating these polices and rules every now and then. The HIPAA has clear guidelines on what is permitted and what is prohibited on patient protected health information. Any violators of these guidelines should face the full force of the law.
References
Bourgeois, F. C., Nigrin, D. J., & Harper, M. B. (2015). Preserving patient privacy and confidentiality in the era of personal health records. Pediatrics, 135(5), e1125-e1127.
Halamka, J. D., & Tripathi, M. (2017). The HITECH era in retrospect. New England Journal of Medicine, 377(10), 907-909.
Moore, W., & Frye, S. A. (2019). A Review of the HIPAA, Part 1: History, PHI, and Privacy and Security Rules. Journal of nuclear medicine technology, jnmt-119.
Price, W. N., & Cohen, I. G. (2019). Privacy in the age of medical big data. Nature medicine, 25(1), 37-43.
Telenti, A., Steinhubl, S. R., & Topol, E. J. (2018). Rethinking the medical record. The Lancet, 391(10125), 1013.
