The Tension Between Confidentiality and Accessibility Edward B. Goldman, J.D. Deputy General Counsel University of Michigan October 10, 2007

Michigan Confidentiality Law n Any information acquired to treat a patient may not be disclosed to any third party. n Except: To defend a malpractice action, avoid injury to a child, vulnerable adult or identified third party, obtain payment, respond to a court order, protect the public health, etc.

Federal Confidentiality laws n Substance abuse information. n HIPAA Privacy (Health Insurance Portability and Accessibility Act of 1996): Any patient information can only be used for treatment, billing or normal operations. Any other use requires a specific patient authorization except... 04/03

HIPAA Privacy n Requires a Notice of Privacy Rights. n Confidentiality exceptions for public health purposes, child or vulnerable adult abuse,law enforcement, and many many other listed exceptions. n Use and disclosure law. n Issue: Proper balance?

Case Example 1 n A child is transported from Rural to Academic Hospital. Rural wants to know the outcome of the case. The child did well and does not need further care. n Can Academic tell Rural the medical details? Can they say anything? (Issue: Is there an ongoing treatment relationship? QA rational?)

Case Example 2 n Hospital has an electronic medical record. It is password protected. Nurse signs on to document care for a patient then is called away for a patient emergency. The computer is left on and a visitor uses the computer to look up his neighbors medical record. n Who is responsible? (Time out or biometrics needed?)

Case Example 3 n It’s May 1, New mother gives birth to New Baby. There is a chart for both mother and child. Father wants to see both charts. Is that allowed? n Is the information about mom in the babies chart protected? i.e. Must mom give consent to allow it to be seen? n Can the information be used for care?

Case Example 3 Continued n Can the treating staff use the data for QA? For Grand Rounds? For a seminar? For a paper in JAMA? n Can other staff use the data? For what purposes? n What if the Hospital hires an outside firm to help put information on line; can the firm see this data? (BA agreement)

Case Example 4 n You work at Wireless Hospital where all medical data is computerized and can be retrieved by any computer or PDA in the Hospital (with proper access). What restrictions should exist for hospital personnel? Can they take the PDA’s or lap tops out of the hospital? Password protection, encryption needed?

Case Example 5 n Dr. Sue Fentanyl is seeing a 19 year student who is non-compliant with medications. Can she inform the parents? n What if the medications are for depression and Sue believes the student is suicidal? n Which case would you rather defend?

Case Example 6 n Kindly Dr. Jones has been the sole general practitioner in a small town for 40 years. He is seen by his eye doctor and found to have early macular degeneration and possible early signs of dementia. Must the Licensing Board be told?

Case Example 7 n Dr. Vera Fib takes her elderly mother to the hospital for a check-up. While her mother is sitting down Vera asks at the desk about other appointments and is told that information cannot be provided since it is confidential. Is that right?

Case Example 8 n You see a patient with a work related eye injury and provide treatment. n What can the employer be told? n 45 CFR (l) says: You may disclose information “as authorized by and to the extend necessary to comply with laws relating to workers’ comp.”

The Goals of Confidentiality n Encourage patients to trust and freely communicate with care givers. n Provide a “shield” to protect care givers from having to disclose information. n Promote an environment of patient privacy. n Promote a “just” society.

The Goals of Accessibility n Allow care to be provided efficiently and appropriately. n Provide access for public health purposes. Ex: HIV data; cancer registries; birth information, protection of the public. n Provide data for research and advancement of health care.

The Balance Point n Confidentiality exists to protect the patient. n Disclosure exists to protect society. n Easy access should exist to allow staff to do their jobs (patient care, risk management, data management, billing) and protect the public (disclosures as mandated by law).

The Challenge n Continued privacy in the electronic age. n Issue: patient electronic access to medical information, renewal of prescriptions, update/change visits, access to their physicians versus continued need for privacy and security of medical information.

Questions? n Answers: n 1. It’s too soon to tell. n 2. Just why do you want to know? n 3. That’s true but on the other hand… n 4. I’ll have to check and get back to you. n 5. That’s too specific so please ask your own attorney.