Most privacy problems are not hackers. They are everyday slips: a conversation overheard, a curious look at a record, a fax sent to the wrong number. This lesson walks through common situations.
Conversations in public areas
- Discuss patients in private areas when you can, and keep your voice down at nurses' stations, front desks and pharmacy counters.
- Avoid talking about patients in elevators, hallways, cafeterias, parking lots and on public transport.
- Some talk near others is unavoidable — calling a name in a waiting room, or a clinician discussing care at a semi-private bedside. These are incidental disclosures and are allowed when reasonable precautions are taken, such as drawing a curtain and speaking quietly.
Snooping: looking at records you do not need
Accessing a record only because you are curious is a violation, even if you never tell anyone. This includes the records of:
- a celebrity, athlete or local figure who has been admitted;
- a family member, partner, ex-partner or friend;
- a coworker or your manager;
- a neighbor or someone in the news.
Your access rights are for your job. Electronic health record systems keep audit logs of who opened which record and when, and organizations review them. Snooping has led to firings, OCR action and, in some cases, criminal charges.
Your own record: follow your organization's procedure for patients requesting access. Many organizations do not allow staff to look up their own or their family's records with work credentials.
Social media
- Never post about patients, even without a name. Details such as the date, the unit, an unusual injury or a photo can identify someone.
- Do not take photos or videos in patient areas where patients, charts, screens or whiteboards could appear.
- Do not discuss patients in private groups or messaging apps, and do not reply to a patient's public post in a way that confirms they are your patient.
- Deleting a post does not undo a disclosure.
Faxes, mail and email
- Check the fax number before sending, use a cover sheet with a confidentiality statement, and use preprogrammed numbers where your organization provides them.
- Check that every page in an envelope belongs to the same patient before sealing it.
- Pick up printouts and faxes promptly so they are not left in shared trays.
- If PHI goes to the wrong person — wrong fax, wrong address, wrong email — report it straight away. Do not try to handle it quietly yourself.
Phone calls and messages
- Verify the identity of a caller before giving out information.
- Leaving voicemails or appointment reminders is allowed, but keep the message to what is needed — for example, a callback number rather than test results — and respect any request the patient made about how to contact them.
Paper records and disposal
- Keep charts and printouts face down or out of view, and do not take PHI home unless your job and policy allow it.
- Never put PHI in ordinary trash or recycling. Use locked shredding bins or shred it.
- Electronic media — old computers, copiers with hard drives, phones, USB drives — must be wiped or destroyed through your organization's process before reuse or disposal. Hand them to IT.
Scenarios
A patient you know. Your neighbor comes in for an appointment. You may care for her as part of your job, but do not mention her visit to anyone outside work — including other neighbors who ask why she was at the clinic.
A coworker snooping. You notice a colleague opening the chart of a local news story's victim, who is not on her unit. Report what you saw to the privacy officer. Audit logs will confirm what happened; you do not need to investigate yourself.
A misaddressed envelope. A patient calls to say she received another person's lab results in her envelope. Thank her, ask her to keep it safe or return it as your organization instructs, and report the incident straight away.
Key points
- Keep conversations about patients private and quiet; incidental disclosures are allowed only with reasonable safeguards.
- Never access records out of curiosity — celebrities, family, coworkers included. Access is audited.
- Never post about patients on social media, even without names.
- Verify fax numbers, addresses and recipients; shred PHI; report misdirected information immediately.