ED Patient's Pic Posted? HIPAA Violation Possible
Corey M. Slovis, MD, professor and chairman of the Department of Emergency Medicine at Vanderbilt University Medical Center in Nashville, says to remember that requirements of the Health Insurance Portability and Accountability Act (HIPAA) apply not only to words, but also to images.
"Whatever images you take and display can, and potentially will, be used against you in a lawsuit," he says.
HIPAA laws, however, do not apply to de-identified patient information, says William Sullivan, DO, JD, FACEP, director of emergency services at St. Margaret's Hospital in Spring Valley, IL, and a Frankfort, IL-based practicing attorney.
Therefore, a picture of an X-ray, EKG, or ankle fracture may not violate HIPAA laws, says Sullivan, if these do not contain identifying information.
Even if there is no HIPAA violation, though, posting an X-ray of a patient may violate hospital policies, says Sullivan, or violate a physician's contract with a hospital or contract management group.
Privacy Violations
Any medical provider who posts a patient's photograph, or protected health information, without that patient's explicit permission may be liable for a HIPAA violation, warns Sullivan.
"If you choose to discuss a case on a social-media site, consider changing or deleting identifying information about the patient before doing so," he advises.
Slovis says that the issue of public postings about ED patients "touches on the sanctity of medical care and the privacy that all of us expect when we go to see a physician."
If an emergency physician (EP) takes pictures of a patient and posts them, or writes in detail about a patient, on a blog, twitter, or Facebook page, that patient is likely to feel angry, exposed, and indignant, says Slovis, even if his or her identity wasn't revealed. "Private is private. That is the beginning and the end of this," he says.
Online Discussions
It is not unheard of, says Michael Blaivas, MD, RDMS, professor of emergency medicine in the Department of Emergency Medicine at Northside Hospital Forsyth in Cumming, GA, for both ancillary staff and EPs to discuss ED patients online. "In these discussions, they may not only provide incorrect information, but also inappropriate information, not to mention violate privacy laws," he says.
Blaivas advises ED staff to avoid any discussion of work on public sites. "The alternative is constantly policing what people write and post," he says. "However, it may surprise some people what may get them in trouble. A lawyer cannot review everything."
Since it may not be realistic to put a stop to all potentially risky posts of pictures or other information, Blaivas recommends having written guidelines in place. "That will help the social-media folks among us who may not have a lawyer's eye for potential problem spots," he says.
An ED's guidelines should remind people not to post pictures of patients, descriptions of patients, symptoms, exact dates, times, or X-rays, says Blaivas, along with a general description of proper public conduct to use when representing the hospital or facility.
Slovis says that regardless of cultural norms of communication, patient visits are private, according to both the Hippocratic Oath and accepted standards of care. These should not be discussed in any form, he says, other than how a visit might have made the ED physician feel personally.
Slovis says that a posting stating, "I saw a really sick patient today. It is depressing to see someone who isn't doing well," allows the ED physician to express his feelings with no way of associating this with a specific patient. "On the other hand, a posting referring to a 27-year-old graduate student with metastatic cancer who came feeling terrible allows people to make some associations," he says.
Above all, says Slovis, the ED physician's role is to "take care of patients, protect them, and do the best we can for them. Never expose them to the outside world for something they came to us in private for."
Corey M. Slovis, MD, professor and chairman of the Department of Emergency Medicine at Vanderbilt University Medical Center in Nashville, says to remember that requirements of the Health Insurance Portability and Accountability Act (HIPAA) apply not only to words, but also to images.You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content