Search

This article is the second part of a continuing education series reviewing the Health Insurance Portability and Accountability Act (HIPAA) of 1996. The term HIPAA should be familiar to those who work in the medical profession, but this article includes details on its rules, patients' rights, violations, breaches, and penalties. To help administer these safeguards, HIPAA requires that every organization designate a HIPAA privacy and security officer. HIPAA violations can have serious repercussions when rules are not followed; these violations can be either negligent or willful. If breaches of unsecured protected health information occur, HIPAA requires covered entities to notify affected individuals, the Secretary of Health and Human Services, and in some cases the media. Violations in which the covered entity did not know of the violation are now punishable under the first tier of penalties. Unintended violations carry a minimum penalty of $100 per violation and a maximum of $50,000 per violation. All patients have a right to privacy and a right to confidential use of their medical records. The role of medical professionals includes understanding how and when to apply these HIPAA rules verbally and electronically., (© 2020 by the Society of Nuclear Medicine and Molecular Imaging.)

The United States' All of Us Research Program is a longitudinal research initiative with ambitious national recruitment goals, including of populations traditionally underrepresented in biomedical research, many of whom have high geographic mobility. The program has a distributed infrastructure, with key programmatic resources spread across the US. Given its planned duration and geographic reach both in terms of recruitment and programmatic resources, a diversity of state and territory laws might apply to the program over time as well as to the determination of participants' rights. Here we present a listing and discussion of state and territory guidance and regulation of specific relevance to the program, and our approach to their incorporation within the program's informed consent processes.

The documentation of immigration status in patient records poses a challenge to clinicians. On one hand, recording this social determinant of health can facilitate continuity of care and improved communication among clinicians. On the other, it might expose patients or their family members to immediate and unforeseen risks, such as being stigmatized and discriminated against by nonimmigrant-friendly clinicians or being exposed to immigration enforcement if staff contact immigration officials in violation of patient confidentiality. Patients may raise concerns about the purpose and risks of such documentation alongside fears about potential data sharing and violations of privacy and confidentiality. This commentary explores clinicians' options for documenting immigration status within the context of ethical, legal, and historical considerations in caring for stigmatized populations in changing political landscapes., (© 2019 American Medical Association. All Rights Reserved.)

In response to a case of an undocumented patient who was reported to immigration authorities, this commentary considers whether a patient's immigration status should be deemed protected health information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. A legal argument, supported by clinical data, is offered that immigration status should be regarded as PHI not subject to valid exception for release without patient authorization. This argument concludes that covered entities (eg, hospitals and health care professionals) are legally precluded under the HIPAA Privacy Rule from disclosing a patient's immigration status., (© 2019 American Medical Association. All Rights Reserved.)

In 2014, the United States granted individuals a right of access to their own laboratory test results, including genomic data. Many observers feel that this right is in tension with regulatory and bioethical standards designed to protect the safety of people who undergo genomic testing. This commentary attributes this tension to growing pains within an expanding federal regulatory program for genetic and genomic testing. The Genetic Information Nondiscrimination Act of 2008 expanded the regulatory agenda to encompass civil rights and consumer safety. The individual access right, as it applies to genomic data, is best understood as a civil-rights regulation. Competing regulatory objectives-safety and civil rights-were not successfully integrated during the initial rollout of genomic civil-rights regulations after 2008. Federal law clarifies how to prioritize safety and civil rights when the two come into conflict, although with careful policy design, the two need not collide. This commentary opens a dialog about possible solutions to advance safety and civil rights together., (Copyright © 2017 American Society of Human Genetics. Published by Elsevier Inc. All rights reserved.)

Increasing quantities of medical and health data are being created outside of HIPAA protection, primarily by patients. Data sources are varied, including the use of credit cards for physician visit and medication co-pays, Internet searches, email content, social media, support groups, and mobile health apps. Most medical and health data not covered by HIPAA are controlled by third party data brokers and Internet companies. These companies combine this data with a wide range of personal information about consumer daily activities, transactions, movements, and demographics. The combined data are used for predictive profiling of individual health status, and often sold for advertising and other purposes. The rapid expansion of medical and health data outside of HIPAA protection is encroaching on privacy and the doctor-patient relationship, and is of particular concern for psychiatry. Detailed discussion of the appropriate handling of this medical and health data is needed by individuals with a wide variety of expertise.

Critical care providers are often privy to confidential information in the course of clinical practice. A dilemma can arise when confidential information is requested by family members or friends of the patient. Critical care nurses must be aware of the regulations regarding confidentiality, as well as situations where the use and disclosure of protected health information are permitted.

When it comes to enforcing HIPAA data security and privacy standards, the federal government means business. In fact, the government is conducting a national pilot program to audit 150 physicians and others that HIPAA covers as the first phase of a concerted effort to crack down on HIPAA violations.

Public health research and practice often have been facilitated through the evaluation and study of population-based data collected by local, state, and federal governments. However, recent concerns about identify theft, confidentiality, and patient privacy have led to increasingly restrictive policies on data access, often preventing researchers from using these valuable data. We believe that these restrictions, and the research impeded or precluded by their implementation and enforcement, have had a significant negative impact on important public health research. Members of the public health community should challenge these policies through their professional societies and by lobbying legislators and health officials to advocate for changes that establish a more appropriate balance between privacy concerns and the protection of public health.

Clinical data registries are valuable tools that support evidence development, performance assessment, comparative effectiveness studies, and the adoption of new treatments into routine clinical practice. Although these registries do not have important information on long-term therapies or clinical events, administrative claims databases offer a potentially valuable complement. This article focuses on the regulatory and ethical considerations that arise from the use of registry data for research, including linkage of clinical and administrative data sets. (1) Are such activities primarily designed for quality assessment and improvement, research, or both, as this determines the appropriate ethical and regulatory standards? (2) Does the submission of data to a central registry, which may subsequently be linked to other data sources, require review by the institutional review board (IRB) of each participating organization? (3) What levels and mechanisms of IRB oversight are appropriate for the existence of a linked central data repository and the specific studies that may subsequently be developed using it? (4) Under what circumstances are waivers of informed consent and Health Insurance Portability and Accountability Act authorization required? (5) What are the requirements for a limited data set that would qualify a research activity as not involving human subjects and thus not subject to further IRB review? The approaches outlined in this article represent a local interpretation of the regulations in the context of several clinical data registry projects and focuses on a specific case study of the Society of Thoracic Surgeons National Database.

As health care costs continue to rise, an increasing number of self-insured employers are using financial rewards or penalties to promote healthy behavior and control costs. These incentive programs have triggered a backlash from those concerned that holding employees responsible for their health, particularly through the use of penalties, violates individual liberties and discriminates against the unhealthy. This paper offers an ethical analysis of employee health incentive programs and presents an argument for a set of conditions under which penalties can be used in an ethical and responsible way to contain health care costs and encourage healthy behavior among employees.

This review, a work project of The Standards and Ethics Committee of The Academy of Psychosomatic Medicine, examines the challenges posed for consultation-liaison psychiatrists as they struggle to maintain the trust between patient and physician while balancing compliance with the increasing complexities of confidentiality with the provision of enough information to our medical colleagues for good clinical care. The authors discuss the moral, legal, and ethical issues that arise from the many-layered state and federal regulations, especially the impact of the Health Information Portability and Accountability Act (HIPPA) and make recommendations for practical application in the clinical setting.

The Health Information Portability and Accountability Act (HIPAA) regulations require that agencies provide authorizations that can be read and understood. Agencies are responsible to comply with this regulation. It is estimated that half of Americans read at an eighth-grade reading level. All institutional review boards (IRBs) listed on the website of the U.S. Department of Health and Human Services were contacted by investigators in this study. Fifty-one IRBs returned HIPAA templates on which readability tests could be completed. Three readability tests were used on all templates, including the Flesch Reading Ease formula, the Dale-Chall formula, and the Fry formula. For the returned templates, the mean of the Dale-Chall readability formula gave a ninth-grade level; the mean scores for the Flesch Reading Ease and Fry formulas were at a high-school reading level or above. The readability scores ranged from sixth-grade to college graduate. This study demonstrates that HIPAA authorization forms are written at too high a level for most of the population. Based on the results of this study and other similar studies, it can be concluded that consumers/patients are currently being asked to read important health-related documents that may be beyond their reading level.

THE PRIVACY RULE, as part of the Health Insurance Portability and Accountability Act, was implemented in 2003 as a response to public concern over potential abuses of private health information. Although the Privacy Rule was not intended to place limits on clinical research, its complexity has caused much confusion throughout the academic medicine and research communities. Many clinical and translational researchers have created clinical databases or human tissue banks to facilitate future research. Maintenance of such databases is considered a research activity under the Privacy Rule, and researchers are, therefore, subject to its regulations. We present a novel Internet-based method to generate and maintain a neurooncology patient registry and human tissue bank. Through our web site, we secure both Health Insurance Portability and Accountability Act research authorization and informed consent, enabling us to contact the treating physician for clinical data and pathological specimens. Considering the importance of continued use of clinical databases and tissue banks in the genetic era of medicine, our method offers one way for researchers to adapt to the changing world of clinical research.

Recently enacted Health Insurance Portability and Accountability Act legislation requires health care professionals to provide patients with a "Notice of Privacy Practices" (NPP) document as part of their informed consent process to participate in assessment and treatment. We were interested in the readability of these forms. We attempted to find a NPP from an academic medical center in each state plus the District of Columbia where documents were placed on the institution's Web site. Documents were obtained from 40 jurisdictions and were then analyzed utilizing two measures of readability. The majority (65%) of these documents were written beyond the 12th grade reading level, and almost the entire sample (90%) fell in the difficult range of reading ease. Academic medical centers have an ethical obligation to improve the readability of these documents and should do so to improve clinical practice and reduce liability.

HIPAA regulations have been seen by many physicians as providing innumerable administrative hoops that require jumping through with no clear benefit for individual patients. Although this article has not comprehensively explored the requirements of HIPAA regulations, it has focused on the issues of "incidental disclosures" that are so important to the daily interactions of physicians and patients. Through the use of illustrative cases, it has been shown that HIPAA regulations frequently are based on well-accepted ethical principles. Although one should never conclude that changing something from an ethical responsibility to a legal responsibility makes it more important, there is no question that HIPAA regulations have forced physicians to consider more carefully how confidential information may be transmitted to others. As such, physicians should look on HIPAA regulations as largely supporting the use of professional judgment in providing good quality medical care. Although not all aspects of HIPAA are grounded in ethical practices, the overall thrust of the HIPAA regulations is consistent with the ethical practice of medicine and surgery. As a result of this general alignment of the legal and ethical requirements, more attention should be directed by physicians at using good judgment in deciding how to disclose private information, rather than adopting an unreasonable approach that confidentiality may never be breached. As Lo and colleagues have very appropriately pointed out: In the context of inadvertent disclosure, the legal risks of good practice are very low. Physicians should work with risk managers and practice administrators to develop policies that promote good communication in patient care, while taking appropriate steps to protect patient privacy. By adopting such an approach to HIPAA, physicians can abide by the regulations while maintaining high ethical standards and minimizing the impact of the new requirements on physician-patient relationships.

As new informational technologies emerge and ever more innovative applications of existing technologies are found, new circumstances will also evolve. The ethical issues involved in these situations will challenge forward-looking nurse leaders to become aware of the matters in question and to employ critical thinking to ensure that information technology serves all stakeholders well.

Privacy, anonymity, and informed consent are the hallmarks of current research conduct. How do the Health Insurance Portability and Accountability Act regulations regarding individually identified health information and protected health information affect research? The purpose of this article is to discuss ways that the Health Insurance Portability and Accountability Act is influencing the conduct of research, including the implications for institutional review boards, recruitment of subjects, obtaining consent, access to data, de-identification of data, authorization to disclose data, and the processing, transmission, and storage of collected data.

Respect for patient privacy and confidentiality is an ancient and a contemporary professional responsibility of physicians. Carrying out this responsibility may be more challenging and more important in the emergency department than in many other clinical settings. Part I of this 2-part article outlines the basic concepts of privacy and confidentiality, reviews the moral and legal foundations and limits of these concepts, and highlights the new federal privacy regulations implemented under the Health Insurance Portability and Accountability Act of 1996. Part II of the article examines specific privacy and confidentiality issues commonly encountered in the ED.

Congress enacted the Health Insurance Portability and Accountability Act (HIPAA) to protect patients' basic rights to privacy and their control over the disclosure of their personal health information. Advances in and the more widespread use of communication technology were increasing the public's concerns over the ease with which their health information could be transmitted, how protected that information was during such transmissions, and their lack of approval for the use of that information by known and unknown third parties. This article, the first of two papers focusing on HIPAA, discusses HIPAA from the clinical perspective and focuses primarily on the HIPAA Privacy Rule. Under what circumstances can a covered entity disclose protected health information? What are the ethical issues inherent in HIPAA? What does HIPAA require of covered entities? What are the implications of HIPAA for professional nurses? The goal of HIPAA is to ensure the protection of confidential health information through having appropriate security systems to guard against unintentional disclosure of that information.

United Network for Organ Sharing policy allows patients to be listed for a transplant at multiple hospitals. This strategy can sometimes lessen the transplant waiting time for patients because waiting times vary geographically. We explore the ethical dilemma of "shopping for a transplant" by presenting the case of a patient with an addictive disorder who was listed for liver transplantation at one hospital on the east coast of the United States and was seeking listing at 2 additional hospitals in midwestern United States, when marijuana use was suspected by 1 of the latter 2 facilities. Although the transplant team at this facility deferred listing the patient, the team's bioethicist posed the concept of a duty to notify the facility where the patient was already listed for transplantation about any confirmed substance abuse, in an effort to prevent a scarce resource from being allocated to an individual who is noncompliant.

Background: Communication via e-mail has become widespread. Nearly every practicing neurosurgeon is confronted with numerous unsolicited e-mail requests for medical advice, guidance, or information. Neurosurgeons need to be aware of the clinical, financial, legal, and ethical implications of providing medical consultation via e-mail., Methods: A literature review of the penetration of e-mail consultation in medical practice was performed. The data on the potential for reimbursement for provision of these services is presented. Precedents for legal liability are discussed, and issues of compliance with HIPAA regulations are reviewed., Results: Communication between patients and physicians via e-mail is increasing in prevalence, and a substantial number of physicians are providing medical information via e-mail consultation. Billing for online consultation has been approved by the American Medical Association, and several medical insurance carriers are evaluating the economic consequences of reimbursement for e-mail consultation. E-mail consultation raises potential medico-legal concerns, including establishment of the physician-patient relationship, malpractice liability, and HIPAA compliance., Conclusions: The increasing prevalence of e-mail consultation raises new concerns for neurosurgeons. Some of these concerns have yet to be addressed by regulatory commissions or in the courts. If used appropriately, e-mail communication can facilitate physician-patient interactions, improve access to care, save time for each interaction, and possibly reduce costs of care.

The deadline for compliance with the privacy rule of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) was April 14, 2003. Understandably, many psychiatrists and other mental health providers have been focusing on compliance. This brief report discusses the negative impact of efforts to implement HIPAA on patient care in a community-based mental health system. Three cases highlight several issues: fear of violating HIPAA, failure to understand HIPAA's privacy regulations, and ethical concerns. The authors discuss the key issues and address implications for practice. Several recommendations are offered for maintaining excellent patient care while complying with HIPAA.

Health professionals must be familiar with regulations and statutes addressing privacy and confidentiality issues. The occupational health nurse must also be aware of specific limitations and exceptions to confidentiality. Occupational health nurses must become proactive in governmental affairs to lobby for changes to include workplace health records in future legislation. To ensure employee trust, occupational health nurses must maintain their ethical and legal responsibility to act morally when making decisions related to confidentiality. The AAOHN Code of Ethics and Interpretive Statements and the AAOHN Position Statement on Confidentiality of Health Information can be used as frameworks to guide occupational health nursing practice.

Objective: The author provides an overview of the current status of privacy in psychiatric treatment, with particular attention to the effects of new federal regulations authorized by the Health Insurance Portability and Accountability Act (HIPAA)., Method: The author reviews the ethical and legal underpinnings for medical privacy, including the empirical data supporting its importance; discusses those portions of the new federal regulations most relevant to psychiatric practice; and suggests steps that psychiatrists can take to maintain their patients' privacy in the new environment., Results: Medical ethics and law, in keeping with patients' preferences, traditionally have provided strong protection for the information that patients communicate while receiving medical care. In general, release of information has required patients' explicit consent. However, limitations of the consent model and technological innovations that permit the aggregation of computerized medical information have led to pressure for greater access to these data. Although the new federal regulations offer patients some additional protections (including security for psychotherapy notes), they also mark a retreat from reliance on patient consent and open up records to previously unauthorized uses, among them law enforcement investigations and marketing and fundraising by health care organizations. However, states retain the power to provide higher levels of protection., Conclusions: The new regulatory environment is less friendly to medical privacy but still leaves a great deal of discretion in physicians' hands. A commitment to protecting privacy as an ethical norm can be advanced by psychiatrists' requesting patients' consent even when it is not required, by ensuring that patients are aware of the limits on confidentiality, and by avoiding unnecessary breaches of privacy in the course of providing psychiatric care.

With few exceptions, personal privacy has long been an ethical right and legal mandate. Clinicians, policy makers, and consumers are challenged to find a balance between allowing consumers to be protected and allowing clinicians to meet patient care needs. This article examines the current debate pertaining to new Medical Privacy Guidelines that were issued in April 2001. The ethical principle of patient confidentiality, including the right to personal privacy, is reviewed along with its relationship to computer-generated wound care tracking programs that transcend practice settings. Options for Health Insurance Portability and Accountability Act (HIPAA) compliance are presented.