HIPAA Regulatory Alert
Realities of disclosure: When docs violate patient privacy
Study shows while providers often violate HIPAA requirements, the intent is good
While patients assume their doctors will work to maintain trust and privacy in their relationships with patients, research has shown that health care providers often disclose personal information to patients' family members. The reasons they give for breaking confidentiality requirements generally involve concern for their patients' welfare and the belief that they know better than lawmakers and regulation writers what those patients need.
A study by West Virginia University communications studies professor Maria Brann found that health care providers share confidential health information daily, frequently with patients' relatives. And, while providers maintained that Health Insurance Portability and Accountability Act (HIPAA) privacy regulations theoretically are good ideas, they said they follow their own ideas for their patients, even if that means violating HIPAA.
"Through personal observations of the lack of confidentiality maintenance in various health care organizations, I began to research what types of confidentiality disclosures occur and, more importantly, why they are occurring," Brann, who has studied confidentiality practices in the health care setting for nearly 10 years, tells HIPAA Regulatory Alert.
"In previous research, physicians routinely commented on their willingness to share patients' personal information with relatives of patients. They commonly spoke about this practice of communicating with family members without receiving permission from patients, and they felt that they were justified in doing this," she says.
"Then, with the implementation of HIPAA, more people became aware of the salience of this topic, and obviously many health care providers needed to respond to this new legislation. As clearly illustrated by the physicians in this study, they understand and respect the theoretical ideology behind HIPAA; but, practically, they felt it was too cumbersome and hindered patient care, which leads them to continue to disclose information to relatives of patients... Many of them feel that politicians, people not in medicine, are telling them how to practice medicine."
She says confidentiality of patient information is vital to positive interaction between patients and health care providers. "Patients expect that their information will be kept confidential," she says, "and based on this expectation, patients disclose personal and sometimes sensitive information to their health care providers."
Is it really an emergency?
HIPAA allows disclosure of information to specific third parties in emergency situations. But Brann found many instances in the study, published in the September 2006 issue of Communication Studies, were not truly emergency situations, such as a diagnosis of mild dementia or lower IQ.
"As a health care consumer, I have always been interested in confidentiality maintenance or lack thereof," she says. "I have witnessed first hand how easily patients' confidential information is disclosed. Many times, physicians freely give information to relatives of patients simply because they are relatives; but we know that this may actually be harmful to a patient."
Brann writes that while ethical principles exist for health care providers, confidentiality of private information is one of the most basic human rights for patients in a health care setting and the study of confidentiality in the health care context "represents [one of] the more fundamental problems of the relative rights of the individual in the social system."
HIPAA is the first federal law to try to codify a privacy requirement in health care. It describes maintaining confidentiality as restricting dissemination of private information. Brann says health care organizations abide by HIPAA and sometimes impose even stricter rules regarding patients' confidential health information.
All in the family
One reason the issue is arising with physicians, she notes, is shifting emphasis in the United States from institutional care to more communal care, which means that families are more involved with the care of relatives. "This assistance with health care raises the issue of who should have access to confidential health information," she writes. "A noticeable tension emerges because relatives who become informal caregivers for the patient need information, coping skills, and support in order to adequately assist their loved ones.
"But at the same time, they are not always legally entitled to that information," she adds. "Relatives claim that they do not receive enough information from physicians, but studies have shown that physicians are more likely to disclose confidential health information to relatives than to other individuals."
In interviewing 22 internists for periods ranging from 35 to 150 minutes, Brann found that several illness factors, such as a patient's prognosis or diagnosis, can play an important role in information disclosure. She found that sometimes physicians disclose information because they empathize with relatives, want to encourage relatives to be advocates for the patient, or, more commonly, believe the diagnosis is severe.
When physicians disclose information to families about a poor prognosis or when they believe the family could be emotionally or instrumentally supportive of a diagnosis, Brann says, the intent obviously is not malicious. "They just thought it was best for [the patient]."
Physicians cited mental impairments most often, but also discussed how patients' emotional issues and physical limitations influenced their decision to disclose information. Brann says the physicians she interviewed chose to share information with patients' relatives regardless of consent or even possible conflict that could arise between the patients and their relatives.
"The physicians felt they knew what was best for the patient (i.e., informing relatives) and would continue to share information to improve the physical health of the patient, even if conflict between patients and relatives resulted," she wrote.
She also found that when physicians determined a serious diagnosis or poor prognosis, relatives sometimes were told before the patient was told. Seeking direction from relatives when a patient has a bad diagnosis or prognosis was reiterated by several of the interviewees, she says.
The type and age of patients whose HIPAA rights are violated often varies, according to Brann. Fully competent and cognitive patients also experience privacy violations, she adds, reporting that physicians sometimes disclosed information to family members who were in the room with the patient because they thought it would be alright.
Physicians said they would knowingly take steps that are contrary to HIPAA regulations because patients need to be cared for in the context of their family. "This theme suggests that physicians include relatives because they feel it is in the patient's best interests," Brann says. "Especially when relatives take on the role of caregiver, physicians share information with them. They encouraged patients to talk with their relatives, and when physicians chose to talk with relatives on their own, they began to communicate with the relative as if they were speaking to the patient…. Physicians constantly reiterated the importance of assessing the individual within the context of the patient's family.
"I don't agree with it, but they really feel they're doing what is best," she says. "Sometimes they look to the family to help them. It's really disheartening that they had to put a law into effect to protect patient confidentiality and physicians continue to disclose information."
Early communication might lead to compliance
Knowing why physicians disclose confidential health information to patients' relatives provides a better understanding of the phenomenon, which may offer insights into managing physician communication, Brann says. If physicians are concerned about possible impairments, they may be able to communicate with patients about health care surrogacy before a situation arises in which they want to disclose confidential information with a relative of a patient, she suggests.
"Much like preventive health care, communication before a potential problem occurs could improve the health and care of a patient," she says. "When physicians have the opportunity to discuss potential sharing of information with patients before engaging in such actions, they should be able to abide by the HIPAA regulations... In many instances, physicians should be able to determine and follow the requests of the patients. This practice coincides with a patient-centered approach to health care, affording patients freedom of choice in numerous aspects regarding their health care."
Educate physicians rather than change HIPAA
She tells HRA she is not sure that changing HIPAA requirements would lead to a desirable change in physician communication behavior.
"Ultimately, I believe the goal of most people involved in patient care is to provide quality care and respect for the patient," she says. "The problem is that each party sees a different way to do this. I agree that allowing physicians more autonomy in caring for their patients may lead to HIPAA violations, but as the physicians in this study explained, regardless of the legislation, they are still going to practice medicine the best way they know how, and that is often involving relatives in patient care.
"I think the biggest change needs to occur in educating physicians about possible negative consequences for the patient in disclosing the patient's personal information," she continues, "and then teaching physicians how to communicate with patients and family members while still maintaining patient confidentiality."
Brann recommends that additional research of confidentiality and HIPAA implications be conducted before any changes to the law are considered. Her article suggests it could be useful to look into patient reactions and wishes with regard to disclosure of confidential health information. While physicians say disclosure of information to relatives is in patients' best interests, Brann says scholars should determine if patients agree. She says it would also be beneficial to discuss the issue with patients' relatives to find out why they want information, not just why physicians think they want information; it may be that relatives are not actually looking out for patients' best interests.
Future research also could look into comparisons among health care providers and organizations, which may provide valuable information into who is more likely to disclose information, why they are disclosing information, and whether disclosures are consistent across different types of health care providers and organizations.
Brann suggests that since physicians didn't have to deal with HIPAA's legal ramifications until 2003, it may be that they are just now feeling its effects and once patients are more aware of their rights, they may make their physicians more aware of what needs to be done, either through their own communication with their physicians or through lawsuits related to information breeches. "This may have a bigger impact on physicians than what they are willing to admit at this time," she concludes.
(Editor's note: You can contact Maria Brann at [email protected].)
While patients assume their doctors will work to maintain trust and privacy in their relationships with patients, research has shown that health care providers often disclose personal information to patients' family members.You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content