Confidentiality. Privacy. Consent.
A recent experience at a conference has been weighing on my mind and resulted in this post, submitted for your consideration. Not too long ago, I attended a class on ethics, insurance coding, and privacy laws (commonly known as HIPAA). These classes occur annually and are mandatory to remain licensed to practice chiropractic in the state of Texas (something I plan to do for quite some time). While most of the class material is common sense (or should be), insurance and documentation standards can change from time to time, so it’s helpful to have the opportunity to remain up to date with those best practices. The issue at hand in today’s post, however, is that of confidentiality and privacy. As you may know, healthcare providers are required to keep your information confidential. This is thanks to the Health Insurance Portability and Accountability Act (HIPAA), enacted in 1996, and the purpose is to protect patients from unnecessary exposure of their sensitive health information. Protected health information includes but is not limited to names, date of birth, contact information, conditions or illnesses, and many other pieces of information. This is a fundamental piece of knowledge for every healthcare profession that is bound by it.
It's why you only rarely see photos of us “in action” in our office - because sharing those photos requires CONSENT from the patients (or the parent of the patients, in the case of a minor) if the photo shows anything identifiable about the patient. It’s why when some of you have asked about patients seen leaving the office (“are they pregnant?” “how far along are they?” “how old is that baby?” “do you treat so-and-so?”) you receive answers along the lines of “I can’t say.” It’s why during your appointment for your initial examination, we provide you with a stack of privacy papers to initial, and then we give you a copy of those signed papers for your records. It’s why when you message us on social media and include sensitive health information we contact you via email (if we have your permission to do so) or wait until your next appointment to fully address your concerns. Because it’s your right to protect your information, and it’s our responsibility to do so.
Every healthcare provider knows the rules and how to follow them, typically before they even receive their license to practice. Recently, however, I found myself witnessing a clear cut violation of this fundamental right to privacy. While standing in line to leave the aforementioned class - after the information had already been presented - two individuals near me in line began discussing, by name, patients they had treated at a particular clinic in recent years. HIPAA violations are reportable and can carry significant penalties, depending on the degree of the privacy breech and the nature of the damage caused by the breech, however, given the circumstances, reporting wasn’t exactly a viable option (“Hi, what was your name? License number? I’d like to report this glaring violation, thank you.”) so the next best thing was to call it out using my preferred mode of communication in such situations - sarcasm. I took a deep breath and, slightly more loudly than necessary asked, “aren’t we leaving a class….on…HIPAA…?” My rhetorical question hung in the air and was met with a couple of scowls and not much changed in the big scheme of things. However, in that moment, I could not let a breech of such a fundamental patient right go unchallenged. Hopefully someone who overheard the exchange will internalize the discussion and renew their commitment to protecting patient privacy and the comment will have more of a lasting impact. We hold certain principles in high esteem at Precision Chiropractic - informed consent, and privacy/confidentiality being among our top priorities. While maintaining patient confidentiality is required by law, we just think it’s the right thing to do. Working frequently with pregnant and postpartum patients, this responsibility becomes even more important. If you’re seeking chiropractic care in our office during the early stages of pregnancy, when you’re not ready for all of Fort Worth to know about it, you don’t have to worry that the wrong person is going to find out because we couldn’t stay quiet. As a patient in our establishment, you should never have to worry about us revealing your pregnancy status or history, illnesses or conditions you may have, age, sexual orientation or gender identity, family status, profession, or even whether you’re a patient of ours unless specifically allowed by law or your consent. Are there scenarios where your information can be shared? Yes! Some of those scenarios are outlined below. Pertinent information can be shared to coordinate your care with other providers. Unnecessary information still cannot be shared. For example, if we co-manage your care with another provider, it may be essential that they know you had surgery on your ankle due to a sports injury. It is probably not essential that they know you told us you’re getting a divorce. Information can be shared if we determine that you may do something that may place yourself or others in danger. In fact, if we determine you may do something dangerous to yourself or others, we have an obligation to share that information with authorities. Again, however, only essential information may be shared. So in that instance, the nature of our concern for your safety or the safety of others would be shared, but the fact that you’re seeing us for sciatica most likely isn’t essential and would not be shared. Incidental exposures are allowed. For example, if you see someone in our reception area and they recognize you and know your name and now know/assume you’re a patient of ours, that’s allowable under the law. Related to this, we always provide you with an opportunity to tell us how you’d like to be addressed in common areas vs in private - names, pronouns, titles, etc.
Testimonials, photos, and other information can be shared with patient consent. Information can be shared for research purposes, but identifying information is removed. For example, if we wrote a case study about the fact that your balance improved under our care, we would need to obtain your permission to use your chart notes in the study, but we would still remove your name and as much identifying information as possible from the data that we utilize in the case study. These are some of the most common examples but is by no means a thorough and complete description of all applicable privacy laws.
These rights are yours in our office, and in the offices of every other healthcare provider who is bound by HIPAA. Informed and empowered patients can and should demand responsible guardianship of their protected health information from their providers, and quality providers will safeguard your information by default.