Possible HIPAA Violation? Forum

[DickyBumBum]

I currently work as a care provider at a small mental health treatment center. I'm sure that a vignette of my experiences with a patient or patients at the facility would offer compelling fodder for a personal statement, but I'm concerned about possible confidentiality issues. Especially given the (very) small size of the facility, I can see how any discussion of individual patients and their conditions--even if I use pseudonyms--could be construed as a violation of the Health Insurance Portability and Accountability Act, or, at the very least, as ethically questionable. Can anyone offer any insight into this issue? Has anyone incorporated their experiences working as a care provider into a successful PS?

[danielhay11]

It's definitely a fine line to walk. I am writing about my experiences as a teacher, and I was nervous of violating FERPA (education version of HIPAA).

Obviously, make the person as anonymous as possible - give a pseudonym, change the age slightly, and use generic descriptions of their condition (eg "a respiratory condition" instead of bronchitis). And check HIPAA to see if there's some threshold of anonymity - for FERPA, for example, 15 students in a cell is sufficient to protect their privacy.

One final question: How do medical journals handle this question? I know they often discuss patient conditions; does this require consent, or is there an anonymity requirement. Or, better yet, read some of Atul Gawande's work in the New Yorker - he often discusses his patients in non-identifying ways.

[ThreeRivers]

It's definitely a fine line to walk. I am writing about my experiences as a teacher, and I was nervous of violating FERPA (education version of HIPAA).

Obviously, make the person as anonymous as possible - give a pseudonym, change the age slightly, and use generic descriptions of their condition (eg "a respiratory condition" instead of bronchitis). And check HIPAA to see if there's some threshold of anonymity - for FERPA, for example, 15 students in a cell is sufficient to protect their privacy.

One final question: How do medical journals handle this question? I know they often discuss patient conditions; does this require consent, or is there an anonymity requirement. Or, better yet, read some of Atul Gawande's work in the New Yorker - he often discusses his patients in non-identifying ways.

I really don't know much about this subject or medical journals, but I do know that my brother had a particularly rare form of cancer and they asked him for his consent to report how he responded to chemotherapy and such in a medical study (not experiment drugs, he went through chemo for a medical report since this cancer is really rare).... I'd imagine consent is needed from most patients.

[danielhay11]

I really don't know much about this subject or medical journals, but I do know that my brother had a particularly rare form of cancer and they asked him for his consent to report how he responded to chemotherapy and such in a medical study (not experiment drugs, he went through chemo for a medical report since this cancer is really rare).... I'd imagine consent is needed from most patients.

You're probably right. I don't know anything about med journals, just speculating.

[DickyBumBum]

I'm fairly new to the mental health/medical field in the first place, and don't know much about HIPAA beyond what I picked up during my job orientation. The "threshold of anonymity" issue seems somewhat complex. On the one hand, a patient's privacy would be maintained as long as any information I disclose could not be combined with publicly available information to uniquely identify the patient. On the other hand, it's my understanding that I shouldn't really be disclosing any patient information, whether identifying or not, unless I have a legitimate professional reason for doing so.

I have some firsthand experience as far as medical journals go: I participated in a handful of medical studies during undergrad to make a little extra cash, and they all required consent forms authorizing the release of any medical data they obtained from me--even though my real name and identifying information would always be removed from the actual results of the studies. HIPAA fines are pretty significant, so I think care providers and researchers tend to err on the side of caution.

I can't think of any way that the information I'd share about a patient in my PS could be used to identify that patient--especially if I changed his/her name--unless the reader actually knew the patient in question and knew that they were a resident at this treatment center.

[dudders]

HIPAA fines are pretty significant

Fun fact - HHS just imposed a fine under HIPAA for the first time ever this year, actually.

I'll bet some level of changing names and identifying information will be sufficient; keep in mind that chances are you'll still be identifying your employer elsewhere on your application. See if HHS or professional organizations (AMA, AHA, practice-specific, etc.) have guidance on the issue.