A breach of patient confidentiality occurs every 62.5 hours.
Researchers determined this incident rate after over 33,000 hours of observation in hospitals. This was equivalent to 2.5 breaches per week in a1197-bed hospital.
If you work in the healthcare industry, you know how problematic that statistic sounds. How could these confidentiality breaches occur so often without anyone realizing it?
Well, some privacy incidents are harder to realize. Since they often aren’t intentional, it’s easy to mistake inappropriate disclosure as innocent work behavior. This could be as simple as conversations about a patient or leaving PHI in an insecure area.
While these mistakes might not always result in an official breach, it still disrupts clients’ privacy. Nurses need to do everything they can to ensure they maintain patient confidentiality. This helps prevent accidental violations, even ones that may go under the radar.
Table of Contents
Steer Clear of Earshot
One way to protect confidentiality is to prevent people from listening to conversations. Nurses might not realize someone is eavesdropping or overheard a discussion that included protected health information (PHI).
This can be difficult to prevent because you never know who might be around the corner. It’s also a challenge when patients share a room, which is why many hospitals have abandoned semi-private for fully private options.
Mayo Clinic is one hospital that’s made the switch. It completed a $200 billion expansion project to include more private spaces. The project resulted in 91% of the hospital’s beds being in private rooms. At the Johns Hopkins Hospital in Baltimore, 96% of patients stay in singles.
While many hospitals are implementing this privacy, they haven’t all done so because it’s costly. HIPAA doesn’t require structural changes to rooms to keep others from overhearing information. But it still helps protect confidentiality if you do everything you can to prevent it from happening in the first place.
For starters, it’s helpful to make sure you close the curtain separating people within shared rooms. This respects their boundaries in their vulnerable state, even when you aren’t in the room discussing their PHI.
The hospital could install soundproof dividers instead of simple fabric curtains. This requires less structural change than if the facility switched to private rooms. Any other noise-canceling devices such as sound machines help limit what the neighbor can hear. Or try catching a time to talk to the patient when their roommate is watching TV.
It’s important to give privacy guidance to the patients and family members in semi-private spaces. Inform them of how they can respect the other individual’s confidentiality. Likewise, let them know at the beginning of their stay that their roommate could potentially overhear. But reassure them that you do everything on your end to maintain their privacy.
Nurses also try to talk softly when discussing PHI. Of course, there are limitations with this if there’s an older person who struggles to hear. But those with better hearing will appreciate it if their information isn’t broadcasted to the entire room with strangers.
If possible, nurses can go even further by bringing the patient or family members into a separate private room. This ensures others don’t overhear. But at the very least, always discuss data with other staff in private rooms. It’s easier to find privacy with your coworkers, and it stops unauthorized staff from learning any information.
Keep Information Out of Eyesight
While the hospital doesn’t need to make changes for preventing people from hearing PHI, it does need to ensure that not just anyone can see it.
Nurses maintain this confidentiality by being extra cautious when they handle documents. This includes both paper and electronic records. When it comes to physical copies of data, it relies on more precaution that the nurse doesn’t leave it in plain sight by mistake.
It could be forgetting it in a room, leaving it on a desk where anyone could see, or accidentally dropping it. These mistakes lead to more likely scenarios for a breach. Paper medical records are more likely to cause a data leak than electronic medical records, as only 7 out of 479 breaches were due to EMRs.
via referralmd
This is one of the many reasons to go paperless in healthcare. But to prevent paper document access without permission, health facilities keep them in locked areas. That way, only those with authorized access and trained in HIPAA can view these confidential records.
Even though EMRs aren’t as common for breaches, it’s still just as important to keep these out of view from people passing by. This means keeping all screens turned away from the public, especially when assisting someone at the desk.
As part of a clean desk policy, it also requires nurses to lock computers when they’re away from their stations.
Both of these safeguards protect data from people who could abuse it or shouldn’t have access in the first place.
Whatever You Do, Don't Gossip
As I mentioned, nurses can discuss confidential data with other staff and patients even if someone might overhear. But this isn’t a free-for-all on conversations. Gossiping is always off-limits since it’s one of the most common reasons for a HIPAA violation.
Everyone in a conversation needs the authorization to know the PHI, and there are reasonable precautions to take when sharing. It must also be relevant for them to know. Gossiping about patients and their data is intentional misuse. It serves no purpose for the person’s treatment.
These are also conversations that if someone overheard, it would still hurt the hospital. It creates a negative reputation if the staff is gossiping about a patient.
Sure, maybe they have proper authorization to discuss the person, and it doesn’t violate HIPAA if someone hears. But people won’t trust that they’ll maintain confidentiality if they’re talking about a person and their data out of nosiness.
By avoiding gossip, nurses are maintaining clients’ privacy. They don’t risk sharing anything that they shouldn’t with someone who doesn’t need to know.
Know Who You're Talking To
I keep referring to authorization and permission to discuss PHI. But what exactly does this mean?
Just because someone works at a hospital doesn’t mean they can know about a person’s condition. Nurses avoid discussing their patients with other staff who don’t need to know the information to provide care. If it isn’t relevant to providing care to the person, then it starts to become gossip.
Before talking about PHI with another employee, make sure it’s someone that the information pertains to. If they have no role in providing care to the person, then chances are you shouldn’t be discussing conditions and treatment with them.
Otherwise, it’s just out of curiosity.
It’s more important to know who you’re talking to when it comes to family members and friends. Just because someone has visitors doesn’t mean those people should know everything about the patient’s condition.
The HIPAA Privacy Rule permits health workers to disclose PHI with relevant people in certain situations. If patients are available to give disclosure and have the capacity to make health decisions, they can agree or object to who can know their PHI.
The best way to maintain this confidentiality is to have the patient identify the individuals with permission to know PHI. If that’s not possible, a guardian or designated caregiver can point out those people.
That way, nurses won’t accidentally share with the wrong visitor who they thought had authorization. And they won’t feel pressured to give details if the patient gave clear consent not to.
Pay Attention in Training
The easiest way to ensure privacy is by paying attention in training. I’d hope this doesn’t come as a surprise, but there’s a good reason why you sit through those lengthy HIPAA training sessions each year.
Some people just view this as another task to check off their list. But it’s more than a tedious activity.
This training goes into depth about what’s permissible in and out of the workplace. It expands on each of these topics I already went over, and the legal ramifications of not adhering to confidentiality.
Hospitals can receive penalties of up to $1.5 million per violation. Most of these involve human error which often is preventable with better training. If there’s poor training or staff doesn’t pay attention, then it’s more likely there will be a larger fine.
Paying attention helps nurses remember all the steps to privacy so they don’t risk making a mistake. As a nurse, you don’t need to question or worry about if you’ve made a mistake because you understand exactly what you can and can’t do.
Don't Treat Conflicts of Interest
Although it isn’t illegal to do so, it’s highly inadvisable to treat people you know. This has been the case since as early as 1803. Percival’s Medical Ethics argued for separating personal and professional identities in care. Today, the American Medical Association gives similar guidelines. Because of this, nurses choose to avoid caring for conflicts of interest.
Treating someone you know has many challenges since it compromises objectivity. It can make the patient feel awkward and vulnerable, or you may feel like you need to give them special treatment. There’s also a stronger emotional pressure if something were to go wrong.
But another major challenge is confidentiality. Since you know the patient, it’s difficult to identify where your personal relationship ends and your work regulations start. There’s a chance you’ll have the urge to discuss their condition with them outside of the health setting. Or maybe you want to talk about it with another mutual family member or friend.
Because it’s harder to separate the professional and personal life from treating these people, it’s best to avoid it altogether. That way, you don’t risk making a mistake or harming a relationship.
Conclusion
There’s so much to know about when and where to discuss PHI, and who to share it with. It can be a challenge to remember all of these steps when on the job and your primary focus is on providing immediate care.
HIPAA training is the best foundation for understanding how to protect others’ privacy in the healthcare setting. It’s so important to pay attention to this, even though it might seem tedious. This way, you’re less likely to make a mistake that causes a breach.
But there are even ways to maintain patient confidentiality outside of what HIPAA requires.
For example, while it might not be illegal if people overhear hospital conversations, what you talk about can impact if it results in a violation. And there are steps you can take to prevent eavesdropping or snooping altogether as extra ways to ensure privacy.
A great way for nurses to ensure that they maintain patient confidentiality is by putting themselves in the patient’s shoes. That way, they can consider if a conversation or situation with their information would make them uncomfortable. And if so, then they should make all the effort they can to protect those scenarios for their patients.
In this blog post we explore if HIPAA laws apply to employers and how.