HIPAA what happened?

This forum made possible through the generous support of SDN members, donors, and sponsors. Thank you.

JackADeli

Full Member
10+ Year Member
15+ Year Member
Joined
Aug 28, 2008
Messages
2,633
Reaction score
19
I thought, with all the attendings & progdirector comments, the thread on HIPAA violation was interesting. There were very good points in that thread, including the issue of ER EMR surfing and such. It was the one from the OP that opened up a litigants EMR at night from curiosity based on news paper article. Was the thread moved? 😕
 
I thought, with all the attendings & progdirector comments, the thread on HIPAA violation was interesting. There were very good points in that thread, including the issue of ER EMR surfing and such. It was the one from the OP that opened up a litigants EMR at night from curiosity based on news paper article. Was the thread moved? 😕

I assume the content was too sensitive and easily be identified and that's why it was removed to avoid any litigation.
 
I assume the content was too sensitive and easily be identified and that's why it was removed to avoid any litigation.
Litigation? There are gazillion malpractice suits pending, plenty in the pop press/news papers. Farah Fawcett had her records scandalized, a few governors and actors too. I think the entire topic was important for the readers and residents. Plenty of residents getting fired for HIPAA violations. The fact that an FM intern chose to look up the name he/she read in a news paper, obtain the EMR number and enter into the hospital computer system out of curiosity is important for the readers. The fact that others mentioned pre-emptively reviewing EMR of ER patients they had no legitimate clinical involvement with ...yet, is important. We are going to continue to see residents and physicians in trouble. We will continue to see residents and physicians blowing off the multiple HIPAA training sessions and its importance. IMHO the entire thread was important.
 
The OP deleted it (as SDN donors are allowed to do). I agree that it was a useful and educational thread. Feel free to continue to discuss the issue.

And I don't think it was a privacy issue as much as it was that the OP was going to get bent over even worse if it came to light that he was discussing it here.
 
Litigation? There are gazillion malpractice suits pending, plenty in the pop press/news papers. Farah Fawcett had her records scandalized, a few governors and actors too. I think the entire topic was important for the readers and residents. Plenty of residents getting fired for HIPAA violations. The fact that an FM intern chose to look up the name he/she read in a news paper, obtain the EMR number and enter into the hospital computer system out of curiosity is important for the readers. The fact that others mentioned pre-emptively reviewing EMR of ER patients they had no legitimate clinical involvement with ...yet, is important. We are going to continue to see residents and physicians in trouble. We will continue to see residents and physicians blowing off the multiple HIPAA training sessions and its importance. IMHO the entire thread was important.
agree. I guess the readers deserve an explanation from the moderator.
 
So, I am going to post some points I think are important that came up in the OP deleted thread. I encourage and welcome others to post.... For those concerned, my spelling generally sucks when using flow of ideas....

1. HIPAA, while may have some politics and excess paperwork, etc... is geared around a fundamental principle in medicine. That is the sanctity of the patient/physician relationship built on trust ~ privacy. So, a little "curiosity" and "victimless" snooping is not a big deal, it IS a HUGE deal. Their is no "ignorance" excuse. We are physicians, presumed to be adults, presumed to have common sense, presumed to be more educated then the "average joe".

2. You have no business looking at the records of patients that you are not involved in providing care. There can be global "clinic patients" exceptions... but do not look for an exception, if in doubt, if you don't know the patient, etc.... do not look.

3. it will generally be a immediate "strike you are out". You should not look for a warning or expect some excuse of "unfair" or "to harsh" to find sympathy. Look at #1 above.

4. short of peaking into a paper chart on the counter (again a violation...), you will get caught! EMR are tracked. Attornies search and review all electronic access logs. It doesn't have to be a famous person or court case. Patients can and do request hospital medical records division produce a log of who has accessed their chart.

5. Pre-emptive chart/record review by definition is a violation. By being pre-emptive, it means you do not have a currently valid reason to be snooping. Once you are consulted/assigned a patient you have a legitimate reason to review the patient's records. Doing so pre-emptively is not defendable.
 
Is there a team approach to this situation? i.e. if you, as the intern, are not the primary physician but it is a patient that belongs to another intern/resident on the team, what are the rules there when it comes to you looking up that patient for educational purposes? or if you have a resident in the OR who pages his co-resident to ask him to check labs on his patient (who is not a patient of his co-resident)?
 
Is there a team approach to this situation? i.e. if you, as the intern, are not the primary physician but it is a patient that belongs to another intern/resident on the team, what are the rules there when it comes to you looking up that patient for educational purposes?...
You need to check with hospital HIPAA person... not just another resident, etc... get direct info from experts.

In general, if you are part of the care team for a patient, you have a legitimate reason to look at their records. But, if you are not part of the care team, you do NOT have a legitimate reason to look just because it might be good for your own interest/education. Your interest/education is secondary when it comes to a patient giving you the privilege to see their confidential medical information. You need a legitimate medical care [for the patient] reason to be looking at their records.
Is there a team approach to ...if you have a resident in the OR who pages his co-resident to ask him to check labs on his patient (who is not a patient of his co-resident)?
You are functioning as a care provider, thus reviewing labs and prsumably acting upon them appropriately...

Again, don't take it from me, don't take it from anyone on-line or senior or junior residents. Speak to your hospital HIPAA people.
 
5. Pre-emptive chart/record review by definition is a violation. By being pre-emptive, it means you do not have a currently valid reason to be snooping. Once you are consulted/assigned a patient you have a legitimate reason to review the patient's records. Doing so pre-emptively is not defendable.

So say you're an ER doc and a patient comes in and is currently sitting in a room. You're about to go see them for the first time, but you decide to check the EMR to see how many times and for what they've been in for in the past. That's a violation? Or is it not a violation because you're "consulted" (the patient came into the ED) to see the patient and thus have a legitimate reason to look at their records?
 
So say you're an ER doc and a patient comes in and is currently sitting in a room. You're about to go see them for the first time, but you decide to check the EMR to see how many times and for what they've been in for in the past. That's a violation? Or is it not a violation because you're "consulted" (the patient came into the ED) to see the patient and thus have a legitimate reason to look at their records?

If you're the ER doc and the patient is in the ER (and you will be seeing them) then you have every right to look at their PHI. In fact you really have an obligation to do so.

The best rule of thumb is that if you are looking at PHI to make treatment decisions about a patient you are taking care of you will be OK in terms of HIPAA.
 
So say you're an ER doc and a patient comes in and is currently sitting in a room. You're about to go see them for the first time, but you decide to check the EMR to see how many times and for what they've been in for in the past. That's a violation? Or is it not a violation because you're "consulted" (the patient came into the ED) to see the patient and thus have a legitimate reason to look at their records?
If you're the ER doc and the patient is in the ER (and you will be seeing them) then you have every right to look at their PHI. In fact you really have an obligation to do so.

The best rule of thumb is that if you are looking at PHI to make treatment decisions about a patient you are taking care of you will be OK in terms of HIPAA.
👍 For the most part, this is not that complicated. If your reason for reviewing a patients chart records is to provide care [that you are expected to be providing], you are doing your job. If the reason you are looking is for curiosity, gossip, or just some over-all global sweep of charts (presumably to identify the single patient you might be asked to consult), you are violating patients' rights. Again, it isn't that complicated. If you are thinking of twisted and/or convoluted scenarios of "what if" and "maybe if", you should be thinking several times about what you are considering doing, should be checking with your hospital HIPAA advisors, or are being argumentative for a forum chat.

Easy rule to follow before accessing patient information is ask yourself these questions:
1. Am I supposed to be accessing this and why? What clinical reason?
2. Would #1 be easily explained to patient/family as to why I am supposed to be accessing these records?
3. Am I accessing these records with primary intent to facilitate further proper care for the patient?
 
So say you're an ER doc and a patient comes in and is currently sitting in a room. You're about to go see them for the first time, but you decide to check the EMR to see how many times and for what they've been in for in the past. That's a violation? Or is it not a violation because you're "consulted" (the patient came into the ED) to see the patient and thus have a legitimate reason to look at their records?

As a scribe I do this all the time. Our EMR actually asks if they've had prior visits to our ED, and if so, what for. Usually I get that part of the chart done before I go in with the MD for the exam.

What you can't do is access their EMR record once they leave the ED. At that point you're no longer playing an active role in their care. At least thats how it was explained to us.
 
👍 For the most part, this is not that complicated. If your reason for reviewing a patients chart records is to provide care [that you are expected to be providing], you are doing your job. If the reason you are looking is for curiosity, gossip, or just some over-all global sweep of charts (presumably to identify the single patient you might be asked to consult), you are violating patients' rights. Again, it isn't that complicated. If you are thinking of twisted and/or convoluted scenarios of "what if" and "maybe if", you should be thinking several times about what you are considering doing, should be checking with your hospital HIPAA advisors, or are being argumentative for a forum chat.

Easy rule to follow before accessing patient information is ask yourself these questions:
1. Am I supposed to be accessing this and why? What clinical reason?
2. Would #1 be easily explained to patient/family as to why I am supposed to be accessing these records?
3. Am I accessing these records with primary intent to facilitate further proper care for the patient?

I actually think there's a lot of stuff that occurs at a hospital on a daily basis, which is totally reasonable, but probably runs afoul of many hospital HIPAA policies. For instance frequently any team that's up for an admission, or a surgical subspecialist who is holding the consult pager and doesn't want to get blindsided will scan the ED list and check out the labs, imaging, etc of those patients they think they may be asked to see before they are in fact called (if ever). This is prudent, good for patient care, and logistically helpful to the person who is ultimately called. It benefits the patient for the orthopod to know that there's someone in the ED for "rule out compartment syndrome" before he goes off to find a call room. Yet technically, looking at this person's info is probably a HIPAA violation. Or at an academic center where a patient's imaging is accessed by physicians not on his primary team because it's a good teaching case. These are legitimate reasons IMHO to access a patient's info by folks not on the primary team. That is in pretty stark contrast to the person who simply wants to see what plastic surgery X celebrity is having repaired.
 
One thing I think is important for students and residents to know is that not only can you not look at charts of patients for whom you're not providing care, but you also cannot continue to look at the chart after the patient leaves your care. So, you might wonder what happened to that patient you were seeing on your last rotation, but you're not allowed to continue to follow the patient's progress using their chart once you're off the team. I just wanted to put that out there, because it would have never occurred to me that this would be a HIPAA violation had I not been told that it was. It's yet another example of the tension between patient privacy and trainee education.
 
I guess we can go back and forth on semantics. In the end, it is really fairly easy to abide by HIPAA if the question asked is are you actually involved or asked to be involved in the patient's care? Is your accessing of the patient's private information for the patient?
...For instance frequently any team that's up for an admission, or a surgical subspecialist who is holding the consult pager and doesn't want to get blindsided will scan the ED list and check out the labs, imaging, etc of those patients they think they may be asked to see before they are in fact called (if ever). This is prudent, good for patient care, and logistically helpful to the person who is ultimately called...
The first part of this is for the physician benefit, i.e. "doesn't want to get blindsided". The underlined portion is rationalization as to why one thinks it appropriate to globally violate patients' privacy/HIPAA because it may ultimately help some individual patient down the line, i.e. everyone is violated because it may prove to be good patient care for the patient you are actually asked to consult/participate in their care.
...It benefits the patient for the orthopod to know that there's someone in the ED for "rule out compartment syndrome" before he goes off to find a call room. Yet technically, looking at this person's info is probably a HIPAA violation...
It does benefit the patient, thus the EM physician calls a consult immediately in most circumstances. Emergent/time sensitive scenarios like AAA, compartment syndrome, pre-eclampsia, ACS, etc... in most ERs have standard rapid type consult protocols. I don't know of orthos or vasc surgeons just randomly surveying ER charts just in case.... to find that one compartment syndrome or AAA rupture.
...Or at an academic center where a patient's imaging is accessed by physicians not on his primary team because it's a good teaching case. These are legitimate reasons IMHO to access a patient's info by folks not on the primary team...
First, cool case, interesting image, etc... is not specifically legitimate reason for a patient to have their confidentiality violated. Second, there are very well established ways for teaching institutions to "sanitize" these imagings and such to allow for proper usage in education. If it is for legitimate teaching purposes, it should be handled appropriately. Medical education does not obviate patient rights. I suspect almost every image you can pull from an interesting ER case can be found in textbooks and teaching files.
...These are legitimate reasons IMHO to access a patient's info by folks not on the primary team. That is in pretty stark contrast to the person who simply wants to see what plastic surgery X celebrity is having repaired.
Education at the expense of patient rights is no more legitimate then review of the random celebrity file. That is simply using education as an excuse. There are volumes and volumes of education materials that make it very easy to NOT violate patient confidentiality for the purpose of teaching. Further, there are plenty of ways to properly use patient materials without violating their confidentiality. To do otherwise smacks of self-serving rationalization to justify laziness.
 
Is your accessing of the patient's private information for the patient?
This is a good litmus test to decide if your action is HIPAA-compliant. 👍

Accessing charts even for educational purposes might or might not benefit the trainee, but it definitely does not benefit the patient. It could actually hurt the patient if their info is accidentally (or purposely) released to others who also have no "need to know."

Nobody has brought this up yet, but one other legitimate reason to access charts besides clinical care is for research purposes. However, in that case, the patient will have given signed consent for their chart to be accessed, or an IRB will have waived the necessity for patient consent. Either way, the researcher will not be just opening random charts or otherwise opening charts that are not necessary for conducting the research.
 
One thing I think is important for students and residents to know is that not only can you not look at charts of patients for whom you're not providing care, but you also cannot continue to look at the chart after the patient leaves your care. So, you might wonder what happened to that patient you were seeing on your last rotation, but you're not allowed to continue to follow the patient's progress using their chart once you're off the team. I just wanted to put that out there, because it would have never occurred to me that this would be a HIPAA violation had I not been told that it was. It's yet another example of the tension between patient privacy and trainee education.


This point highlighted in bold is actually something that every resident in the ED violates. A lot of programs have cases that the residents are supposed to "follow up" on for the purpose of their education. However, once a patient is no longer in the ED the residents are not taking care of them, and per HIPAA rules should not be accessing their chart to see the outcome. Is this a violation that could get me in trouble one day or not a big deal?
 
This point highlighted in bold is actually something that every resident in the ED violates. A lot of programs have cases that the residents are supposed to "follow up" on for the purpose of their education. However, once a patient is no longer in the ED the residents are not taking care of them, and per HIPAA rules should not be accessing their chart to see the outcome. Is this a violation that could get me in trouble one day or not a big deal?
I think this is a pretty gray area. Obviously, you were a part of that patient's care, and oftentimes I hear the ER guys saying they'd be 'checking up on' the patient after they went upstairs (usually an interesting case or patient they made a good connection with). A bit vague (usually they end up asking the admitting doc what happened instead of visiting the patient), but I've seen the ER guys come up to visit a couple times. The patients generally appreciated this and I am sure the patients were ok with them checking the chart after they left the ER.

The factor we need to also remember is the patient's preference. *Most* patients are completely amenable to ER physicians being able to review their chart and see what happened and wouldn't object to it---I actually think *most* patients would assume that doctors who have treated them have access to their chart (most patients I think assume HIPAA permissions last the duration of their admission as there is nothing stating otherwise on the consent forms). The question here is, does the patients need to expressly state that the ER guy can look them up once they leave the OR, or is it implied consent if the patient has already permitted that provider access for treatment of this medical condition and the *typical* patient assumes initial consent is valid for their hospitalization? Not sure what the courts would say about this one. Does the ER guy violate HIPAA if the patient is ok with him checking the chart? [I say no; the institution should not assume that any ER guy checking up on a patient is violating HIPAA unless the patient feels violated...it would be difficult for a hospital to enforce sanctions on the ER doctor unless the patient says the doc did not have their permission anymore to look at the chart]. So do we need to delineate end-points of chart access to patients or ask patients every time they change floors who still is allowed to look at their charts?

Thoughts on this anyone?
 
Last edited:
I actually think there's a lot of stuff that occurs at a hospital on a daily basis, which is totally reasonable, but probably runs afoul of many hospital HIPAA policies. For instance frequently any team that's up for an admission, or a surgical subspecialist who is holding the consult pager and doesn't want to get blindsided will scan the ED list and check out the labs, imaging, etc of those patients they think they may be asked to see before they are in fact called (if ever). This is prudent, good for patient care, and logistically helpful to the person who is ultimately called. It benefits the patient for the orthopod to know that there's someone in the ED for "rule out compartment syndrome" before he goes off to find a call room. Yet technically, looking at this person's info is probably a HIPAA violation. Or at an academic center where a patient's imaging is accessed by physicians not on his primary team because it's a good teaching case. These are legitimate reasons IMHO to access a patient's info by folks not on the primary team. That is in pretty stark contrast to the person who simply wants to see what plastic surgery X celebrity is having repaired.

I am also going to disagree with this. Our ED has a web based census list that I can review. On the list are all of the working diagnoses of the patients -- but no identifiers. This allows me to peruse the list. Perhaps I am thinking of going home but want to make sure that there isn't an admission coming in the next 30 minutes. I can see that there's an 80 year old guy with SOB who has been in the ED for 3 hours. I can call the ED doc and ask -- "hey, is that 80yo guy with SOB going to get admitted to me?". All of this is fine. But actually looking at charts of patients that you do not have a treating relationship with (or and approved chart review research study on) is a HIPAA violation.

I think this is a pretty gray area. Obviously, you were a part of that patient's care, and oftentimes I hear the ER guys saying they'd be 'checking up on' the patient after they went upstairs (usually an interesting case or patient they made a good connection with). A bit vague (usually they end up asking the admitting doc what happened instead of visiting the patient), but I've seen the ER guys come up to visit a couple times. The patients generally appreciated this and I am sure the patients were ok with them checking the chart after they left the ER.

The factor we need to also remember is the patient's preference. *Most* patients are completely amenable to ER physicians being able to review their chart and see what happened and wouldn't object to it---I actually think *most* patients would assume that doctors who have treated them have access to their chart (most patients I think assume HIPAA permissions last the duration of their admission as there is nothing stating otherwise on the consent forms). The question here is, does the patients need to expressly state that the ER guy can look them up once they leave the OR, or is it implied consent if the patient has already permitted that provider access for treatment of this medical condition and the *typical* patient assumes initial consent is valid for their hospitalization? Not sure what the courts would say about this one. Does the ER guy violate HIPAA if the patient is ok with him checking the chart [I say no; the institution should not assume that any ER guy checking up on a patient is violating HIPAA unless the patient feels violated...it would be difficult for a hospital to enforce sanctions on the ER doctor unless the patient says the doc did not have their permission anymore to look at the chart].

Thoughts on this anyone?

This is a different issue. Once you are treating a patient, you do have some need to review the chart afterwards to see what happened. That's required for your own education, whether you're still in training or not. Most policies allow you to continue to review the chart for a reasonable period of time, certainly the current admission. Hospitalists might even be able to review outpatient notes post discharge, again dependent on hospital policy.

Also, education does get a HIPAA exception. Let's say you hear about an interesting case in the ED, seen by a resident in another field. You decide that you want to present the case in Morning Report, but you didn't actually treat the patient. Is it a HIPAA violation to look at the chart? The answer is usually no -- as long as you present the case with all PHI removed, you're allowed to look at a chart as long as you can prove it was for educational purposes. This is specifically addressed here on the govt's website about HIPAA. Again, the key is to follow your institution's policy.

For those that are interested, UCSF has a pretty good site about HIPAA
 
One thing I think is important for students and residents to know is that not only can you not look at charts of patients for whom you're not providing care, but you also cannot continue to look at the chart after the patient leaves your care. So, you might wonder what happened to that patient you were seeing on your last rotation, but you're not allowed to continue to follow the patient's progress using their chart once you're off the team. I just wanted to put that out there, because it would have never occurred to me that this would be a HIPAA violation had I not been told that it was. It's yet another example of the tension between patient privacy and trainee education.

I actually asked the AoD and head of the ethics service at my program's hospital is this was kosher (we had a medical ethics inservice thing during our clinical years), and they said it was ok because it was for "educational purposes". I definitely agree it is one of those gray areas that is open to interpretation though.
 
Also, education does get a HIPAA exception. Let's say you hear about an interesting case in the ED, seen by a resident in another field. You decide that you want to present the case in Morning Report, but you didn't actually treat the patient. Is it a HIPAA violation to look at the chart? The answer is usually no -- as long as you present the case with all PHI removed, you're allowed to look at a chart as long as you can prove it was for educational purposes. This is specifically addressed here on the govt's website about HIPAA. Again, the key is to follow your institution's policy.

This is what I was always told as well. Obviously you stay clear of anyone even remotely famous, but the "its educational" excuse likely won't fly, but otherwise there is some leeway.
 
thanks, aPD!
👍
...there are very well established ways for teaching institutions to "sanitize" ...and such to allow for proper usage in education. If it is for legitimate teaching purposes, it should be handled appropriately. Medical education does not obviate patient rights. ...there are plenty of ways to properly use patient materials without violating their confidentiality. To do otherwise smacks of self-serving rationalization to justify laziness.
...Also, education does get a HIPAA exception. Let's say you hear about an interesting case in the ED, seen by a resident in another field. You decide that you want to present the case in Morning Report, but you didn't actually treat the patient. Is it a HIPAA violation to look at the chart? The answer is usually no -- as long as you ...This is specifically addressed here on the govt's website about HIPAA. Again, the key is to follow your institution's policy...
👍Yep, educational is OK as long as you follow appropriate rules/policies/protocol. Just claiming "educational" as an excuse does not fly.
...stay clear of anyone even remotely famous, but the "its educational" excuse likely won't fly...
Good advice. Also, the dramatic or unique "wow" or "giggle factor" or "patient embarassing" cases, i.e. FB in rectum will not fly for "educational purposes" excuse...
 
Last edited:
Once you are treating a patient, you do have some need to review the chart afterwards to see what happened.
This is explicitly the opposite of what we were told. As in, we do *not* have permission to continue to review the chart just "to see what happened." But if the purpose is to present a patient at conference, that is not the same as accessing the chart just because you want to see what happened, although I'm still not clear on whether it technically violates the rules.

Seems like the best thing to do whenever we have a question is make sure we know what policies our institution has in place concerning educational use of charts. It's better to ask than assume and be wrong.
 
...educational is OK as long as you follow appropriate rules/policies/protocol. Just claiming "educational" as an excuse does not fly...
...the best thing to do whenever we have a question is make sure we know what policies our institution has in place concerning educational use of charts. It's better to ask than assume and be wrong.
👍Some institutions may have a more strict approach and rules then are required via HIPAA. So, obey the institutional policies or risk severe sanctions that usually = termination.
 
This is explicitly the opposite of what we were told. As in, we do *not* have permission to continue to review the chart just "to see what happened." But if the purpose is to present a patient at conference, that is not the same as accessing the chart just because you want to see what happened, although I'm still not clear on whether it technically violates the rules.

Seems like the best thing to do whenever we have a question is make sure we know what policies our institution has in place concerning educational use of charts. It's better to ask than assume and be wrong.

If you're not allowed to review the chart as follow-up on patients you've seen, it's probably worth bringing up to your program director to enquire about why. Especially for EM residencies, being able to review the chart after admission is key to improving practice.
 
👍Some institutions may have a more strict approach and rules then are required via HIPAA. So, obey the institutional policies or risk severe sanctions that usually = termination.

Agreed. But this is where the "educational" exceptions almost always get overridden. Many hospitals want no non-treating personnel to look at the chart for any reason, to avoid having to deal with the issues.
 
I am also going to disagree with this. Our ED has a web based census list that I can review. On the list are all of the working diagnoses of the patients -- but no identifiers. This allows me to peruse the list. Perhaps I am thinking of going home but want to make sure that there isn't an admission coming in the next 30 minutes. I can see that there's an 80 year old guy with SOB who has been in the ED for 3 hours. I can call the ED doc and ask -- "hey, is that 80yo guy with SOB going to get admitted to me?". All of this is fine. But actually looking at charts of patients that you do not have a treating relationship with (or and approved chart review research study on) is a HIPAA violation.
...

Well, at a lot of hospitals the online ED lists do have identifiers. Depending on the admissions/consult service you are on, a review of labs/imaging is what you will want to be looking at, not the basic patient description. Particularly in the case of very generic complaints like "abdominal pain". Some places might limit the identifiers to try and prevent this. But honestly the ortho resident scanning the ER board isn't going to want to call the ED to ask about a patient with arm pain. To do that would be suicide -- you buy yourself a consult that you might not have gotten. Your goal when on call is to have fewer consults, not basically "invite" the ED resident to consult you by jumping on the phone with him. No, instead he would want to just look at the x-ray, and decide for himself if a consult is imminent. I personally think there's no good privacy reason that overrides a clinician in the hospital being able to see if someone in the ER is going to come to his service. It benefits the patient to have multiple physicians looking over his labs/imaging, and it benefits the patient to have his consult know about him at the earliest possible moment, particularly if it ends up being a time sensitive condition. But I imagine that looking at someone's chart who is not yet on your service is simply problematic under HIPAA and every hospital policy. Still it's done everywhere, and there are pretty legitimate reasons for it. This is not "gawking" like many of the hospital rules were designed to prevent.
 
Good thread. 👍

After seeing the original thread that prompted this one I was curious as well about some of the seemingly "normal" but iffy practices that happens in the name of education..... ER browsing, looking up an interesting case, patient followup after discharge, etc.

At least up until now I've never really given much thought to some of these practices, and at least it seems like some of what I've seen is covered under the "educational use" as per the link that aPD posted.

Good info here though. And, at least in my clinical time thus far, I have noticed that, in general, residents/students and even some attendings don't give much thought to accessing records in some of these grey areas. Certainly will make me more aware of what I'm doing.
 
...But honestly the ortho resident scanning the ER board isn't going to want to call the ED to ask about a patient with arm pain. To do that would be suicide -- you buy yourself a consult that you might not have gotten. Your goal when on call is to have fewer consults, not basically "invite" the ED resident to consult you by jumping on the phone with him...instead he would want to just look at the x-ray, and decide for himself if a consult is imminent.
Do you not recognize that the foundation on which you base your premises throughout are not about protecting patients or patient rights but rather physician convenience? Instead of the ortho protecting patients... he/she globally violates patient rights to avoid inviting more work/consults!
...I personally think there's no good privacy reason that overrides a clinician in the hospital being able to see if someone in the ER is going to come to his service...
You know when you are called. No clinician is entitled to globally preview all ED pts. You are not self consulting. Whio then decides what physician gets to globally review the charts? Heck, psych could then review everyone too... in case the belly pain is in their head. You don't want to be coming back for a late night psych consult.
...It benefits the patient to have multiple physicians looking over his labs/imaging, and it benefits the patient to have his consult know about him at the earliest possible moment, particularly if it ends up being a time sensitive condition...
That is a strawman argument. Many could say excessive physician review of individual patients taxes the healthcare system and clouds the decisions. The answer to urgent/emergent issues is the "first responder", i.e. ER physician recognizing and calling the consult appropriately and promptly. It is not to allow any and every physician within the hospital to peruse patient records "just in case" I may have to do something.... especially if finding it will avoid my being inconvenienced and being called back to the hospital.
...Still it's done everywhere, and there are pretty legitimate reasons for it. This is not "gawking" like many of the hospital rules were designed to prevent.
It being done everywhere does not make it correct. Further, the basis of your arguments as to why it is legitimate seems to have excessive emphasis on physician convenience/benefit at the expense of the patients rights. The rules are not just to protect patients from "gawking". They are to set basic standards for every patient, to protect from even the smallest breaches of confidentiality. If you have no legitimate justification [beyond those you have suggested], you have no business seeing any piece of the patients confidential information...period.
 
Last edited:
Checking the census list of complaints that pops up with the standard log in is fine (perhaps then calling down to see if anything is headed your way). Going into the pt record (even if just to check a film or a lab) is not. Let's say you click on that arm pain and discover it is the wife of an attending coming in after a domestic violence incident. She doesn't have a fracture and gets sent home, but afterwards starts to think how many people are going to know about her ordeal. She asks for a list of who accessed her account and your name is on it but no consult was ever requested. Do you think your "I was just shopping through the ER to see if there were any patients for me" is going to fly. People may do it all the time and never get in any trouble for it, but it doesn't mean you won't get f'ed if it happens to be someone who values their privacy enough to check.

I never saw the value in checking the ER list before going home/going to bed. Usually if they haven't called me yet it is because the relevant studies aren't done yet. The ER is so focused on dispo they are quit to jump on something for which a consult is going to be required (at every hospital where I have rotated this has been the case-perhaps I have the benefit of only working with efficient ER folks). Seeing 10 abd pains on the list just makes you feel bad and most of the time they end up dispo'ed without you ever getting a call. The only sort of exception is one rural hospital that is a 40 min drive from my house. I wasn't ever actually on call, but it was customary for me to check before I left for the day because if the ER thought a consult was imminent and the studies were cooking the attending preferred I wait for it unless it was going to be a while-or if the ED guy didn't really think it was going to be an acute issue (if they were wrong the attending would just have the ER admit to him and have me see it in the AM-there wasn't a lot of truly emergent stuff, mostly appies and choles that could wait till the morn). But I didn't violate hipaa by looking up the info myself, I just asked if my services were needed.
 
I surf charts sometimes. Usually I don't even look at the name. If I did happen to look at the name and recognize it, I would not look under any circumstances.

I may have to rethink my practice.
 
Checking the census list of complaints that pops up with the standard log in is fine (perhaps then calling down to see if anything is headed your way). Going into the pt record (even if just to check a film or a lab) is not. Let's say you click on that arm pain and discover it is the wife of an attending coming in after a domestic violence incident. She doesn't have a fracture and gets sent home, but afterwards starts to think how many people are going to know about her ordeal. She asks for a list of who accessed her account and your name is on it but no consult was ever requested. Do you think your "I was just shopping through the ER to see if there were any patients for me" is going to fly. People may do it all the time and never get in any trouble for it, but it doesn't mean you won't get f'ed if it happens to be someone who values their privacy enough to check.

I never saw the value in checking the ER list before going home/going to bed. Usually if they haven't called me yet it is because the relevant studies aren't done yet. The ER is so focused on dispo they are quit to jump on something for which a consult is going to be required (at every hospital where I have rotated this has been the case-perhaps I have the benefit of only working with efficient ER folks). Seeing 10 abd pains on the list just makes you feel bad and most of the time they end up dispo'ed without you ever getting a call. The only sort of exception is one rural hospital that is a 40 min drive from my house. I wasn't ever actually on call, but it was customary for me to check before I left for the day because if the ER thought a consult was imminent and the studies were cooking the attending preferred I wait for it unless it was going to be a while-or if the ED guy didn't really think it was going to be an acute issue (if they were wrong the attending would just have the ER admit to him and have me see it in the AM-there wasn't a lot of truly emergent stuff, mostly appies and choles that could wait till the morn). But I didn't violate hipaa by looking up the info myself, I just asked if my services were needed.

That's how I always felt as well.
 
One thing I think is important for students and residents to know is that not only can you not look at charts of patients for whom you're not providing care, but you also cannot continue to look at the chart after the patient leaves your care. So, you might wonder what happened to that patient you were seeing on your last rotation, but you're not allowed to continue to follow the patient's progress using their chart once you're off the team. I just wanted to put that out there, because it would have never occurred to me that this would be a HIPAA violation had I not been told that it was. It's yet another example of the tension between patient privacy and trainee education.


This was not the case at my institution. Once you've treated the patient or been involved directly in the patient's care, you were considered to have a relationship with that patient, whether they had been discharged already or whether you go off service.
 
...Going into the pt record (even if just to check a film or a lab) is not. Let's say you click on that arm pain and discover it is the wife of an attending coming in after a domestic violence incident. She doesn't have a fracture and gets sent home, but afterwards starts to think how many people are going to know about her ordeal...
Perfect example. Nothing on the census list would red-flag you that there might be a "gawking" risk or that you are stepping into deep water. Also, it has been my experience that famous people, "VIP", colleagues, and other "family members" can and often do use aliases at admission. This further increases the risk that your self-serving/pre-emptive inconvenience avoidance tactic snares you into an inexcusable HIPAA violation.
...I never saw the value in checking the ER list before going home/going to bed. Usually if they haven't called me yet it is because the relevant studies aren't done yet. The ER is so focused on dispo they are [quick] to jump on something for which a consult is going to be required... Seeing 10 abd pains on the list just makes you feel bad and most of the time they end up dispo'ed without you ever getting a call...
Yep, I got past the arrogant presumption that I was somehow going to scoop the ED in consulting. I know I am not going to do their job except when they call a consult prematurely and request me to do so...but, they are still calling the consult. I am not self-consulting myself in a savior of the world fashion. The realities are that
a) patient care often suffers from too many cooks in the kitchen
&
b) most physician complaints are about over consulting by the ED [often prior to appropriate w/u] and not under consulting.... Things like compartment syndromes and AAA are often over-called.
 
Last edited:
One thing I think is important for students and residents to know is that not only can you not look at charts of patients for whom you're not providing care, but you also cannot continue to look at the chart after the patient leaves your care. So, you might wonder what happened to that patient you were seeing on your last rotation, but you're not allowed to continue to follow the patient's progress using their chart once you're off the team. I just wanted to put that out there, because it would have never occurred to me that this would be a HIPAA violation had I not been told that it was. It's yet another example of the tension between patient privacy and trainee education.

This is interesting, because I've actually had attendings tell me that as a med student, I should write down patients I have questions about so I can look them up later and find out the end result. For educational purposes, it really seems valid, since the whole point of rotations vs. book cases is to actually see what these things look like in real life. I suppose you could debate whether it's curiosity vs. education, but checking titers to see if my diagnosis was correct, or checking biopsy results for a patient I ordered a biopsy on doesn't seem like idle snooping to me. Perhaps I should ask the patient if it's alright for me to follow up on their lab results? Would that even make a difference?
 
...I suppose you could debate whether it's curiosity vs. education, but checking titers to see if my diagnosis was correct, or checking biopsy results for a patient I ordered a biopsy on doesn't seem like idle snooping to me...
The key in this scenario is that you are part of the care providing team that has ordered the diagnostic study/procedures. Your team has an obligation to follow up on the studies they have ordered. As a student involved in the patient's specific care, you should also participate in following up on the diagnostic studies/work-ups/procedures/labs [you] ordered. That is sound and expected medical practice. I don't see any "debate" that following up on the studies you ordered is somehow snooping.

Having said that, you do need to be appropriately pro-active. Simply wondering one evening, "whatever happened to MrsX I saw in the ED 3 months ago? I wonder if her labs/titers/etc... showed anything?"... not going to cut it.
 
Do you not recognize that the foundation on which you base your premises throughout are not about protecting patients or patient rights but rather physician convenience? Instead of the ortho protecting patients... he/she globally violates patient rights to avoid inviting more work/consults!You know when you are called. No clinician is entitled to globally preview all ED pts. You are not self consulting. Whio then decides what physician gets to globally review the charts? Heck, psych could then review everyone too... in case the belly pain is in their head. You don't want to be coming back for a late night psych consult.That is a strawman argument. Many could say excessive physician review of individual patients taxes the healthcare system and clouds the decisions. The answer to urgent/emergent issues is the "first responder", i.e. ER physician recognizing and calling the consult appropriately and promptly....

If you've ever worked in a busy hospital, it's often the nurses in the ED who triage the patients, send them off for CTs and labs and in many cases the folks languish in the ED for hours before seen by a physician. Not a great situation, but where the volume outpaces the staffing, and where the ED is simply overwhelmed and putting stretchers in the halls on a regular basis, that's what happens. But guess what -- some of those folks who look fine to the initial nurse don't look so fine on the imaging or labs, which also won't be read for a few hours. So your suggestion that the consults wait for an "ED physician to recognize and call the consult ...promptly" simply doesn't always happen. In fact, it happens a lot less than the consult having time to peruse the list and identify someone who needs a consult. Nice if it did but we don't universally live in that fantasyland where EDs are adequately manned in every part of the country. So the consult or admitting team that is proactive and scans the ED info and calls the ED benefits the patient hugely. Yes it benefits the physician as well and that is the motivation behind doing it, but so what. There are lots of aspects of good patient care that benefit the doctor too. It's generally beneficial for a patient to get moving and out of bed 1 day post-op, but it benefits the physician team as well to more rapidly clear their lists. Deciding that a patient will benefit from independent living rather than some form of rehab also makes less work for the physician team. So what. If it's good for the patient, it doesn't have to also not be the easist for the physician. As a resident I am happiest when my personal convenience and what's good for patient care are well aligned. Happens a lot. Doesn't make it wrong. However HIPAA doesn't allow this. Which means that a patient who needs to be seen immediately has less of a chance to be seen immediately because the ED is overwhelmed.
 
If you've ever worked in a busy hospital...
Worked in numerous busy hospitals with overworked Eds and/or level I trauma programs.
...guess what -- some of those folks who look fine to the initial nurse don't look so fine on the imaging or labs, which also won't be read for a few hours. So your suggestion that the consults wait for an "ED physician to recognize and call the consult ...promptly" simply doesn't always happen...
Been there, done that... I recognize the frustration and what seems to be the under current theme that the resident/potential consultant is going to save the day, be the hero... justifying the generalized violation of patient confidentiality rights; further background theme of...~I'm a doctor, the beurocrats don't understand the real world, let me do my job, I'm saving lives.
...So the consult or admitting team that is proactive and scans the ED info and calls the ED benefits the patient hugely. Yes it benefits the physician as well and that is the motivation behind doing it, but so what. There are lots of aspects of good patient care that benefit the doctor too...
I got that too.... The individual patient that the surveying [pre-emptive/self-consulting/snooping/gawking/HIPAA violating] physician MIGHT identify and MIGHT obtain more prompt care stands to POTENTALLY benefit. Of course, this individual patient's benefit comes at the expense of violating confidentiality and/or patient rights protection of all the other patients surveyed improperly to find the single individual patient. Again, a common theme seen often in medicine, ~I can only be concerned about the single patient I am helping. I can't think about the bigger picture or consider if I may be injuring other patients that are not my primary concern.... And of course, as repeated and emphasized throughout, the primary reason for the specific violations is NOT even the benefit of that "potential" individual patient you might find... rather, that "potential" patient is the excuse.
 
... Again, a common theme seen often in medicine, ~I can only be concerned about the single patient I am helping. I can't think about the bigger picture or consider if I may be injuring other patients that are not my primary concern.... A.

But that's just it -- you aren't really injuring other patients. If you polled patients in the ED and asked them if they'd rather wait for the ED doctor or allow other doctors in the hospital to review their labs/scans you and I both know what they would say. They don't consider this an invasion of privacy. Congress does. Maybe you do, although I'll give you the benefit of the doubt that you are playing devils advocate here. For the patient who ends up having something time sensitive it is a blessing for some astute consult or admitting team resident to call down to the ED and say "buddy, have you seen this patient and is he getting admitted, because his scan shows X?". It's not a hypothetical -- this happens daily. To say, it's better for patients to wait until the ED can get to them because their privacy is more important than someone getting them needed treatment earlier is problematic, IMHO, and not what HIPAA was intended to accomplish.

Now I get that when doctors benefit from convenience by doing it a certain way that tramples rights, that's suspicious, but if there's truly a health benefit for some % of patients to do it a certain way, you have to balance out (1) whether the patients would, in fact, object to this kind of intrusion (because the rights are those of the patients, not of some hospital to maintain their policy or of Congress who doesn't really have a first hand sense of how things work in practice), and (2) whether enough good comes out of it to outweigh some loss of privacy. I think this kind of surveying the board wins out in both categories because (1) the patients would be fine with it if you asked them, and (2) swooping in and getting someone the care they need and won't otherwise get does beat out the concern that some resident has seen the labs of someone who never gets admitted.

So yeah, while I suspect HIPAA covers this situation, I think this is a good example of where it does harm (not to mention physician inconvenience, which I submit is secondary).
 
But that's just it -- you aren't really injuring other patients. If you polled patients in the ED and asked them if they'd rather wait for the ED doctor or allow other doctors in the hospital to review their labs/scans you and I both know what they would say. They don't consider this an invasion of privacy. Congress does. Maybe you do, although I'll give you the benefit of the doubt that you are playing devils advocate here. For the patient who ends up having something time sensitive it is a blessing for some astute consult or admitting team resident to call down to the ED and say "buddy, have you seen this patient and is he getting admitted, because his scan shows X?". It's not a hypothetical -- this happens daily. To say, it's better for patients to wait until the ED can get to them because their privacy is more important than someone getting them needed treatment earlier is problematic, IMHO, and not what HIPAA was intended to accomplish.

I see both sides here, but don't you think this only opens you up to more liability by doing this? I mean, you are never going to be named on a suit for a bad outcome of which you were not a treating physician and never looked at their chart. But if something bad happens and it comes out that you had accessed their chart/labs then I would think that only opens up trouble for you.

Of course a patient is going to be fine with less wait time if that means other docs review labs in the hopes of expediting things (which I don't think it does), but I'm sure those same patients would have no problems also naming you in a suit since you had decided to access their records.
 
I see both sides here, but don't you think this only opens you up to more liability by doing this? I mean, you are never going to be named on a suit for a bad outcome of which you were not a treating physician and never looked at their chart. But if something bad happens and it comes out that you had accessed their chart/labs then I would think that only opens up trouble for you.

Of course a patient is going to be fine with less wait time if that means other docs review labs in the hopes of expediting things (which I don't think it does), but I'm sure those same patients would have no problems also naming you in a suit since you had decided to access their records.

Getting "named" in a lawsuit is meaningless. It's annoying to the person named, and may create licensing related paperwork, but that, in and of itself doesn't translate to malpractice or liability. And this pretty common in a hospital setting anyhow. The resident who is cross-covering a patient over a weekend and ends up being the name on the discharge summary may not have been involved with the patient's care for more than two seconds, but he's going to get named in any suit because a lawyer has his name. He will also be dropped from the lawsuit in two seconds when it is clear he didn't have any actual involvement with the patients' care during the course of the admission. But I think when you start trying to arrange patient care in the way least likely to get people listed on a lawsuit, you sacrifice patient care. Sure, we are not going to get sued if we do not see the patient, and willfully stay clear of any information about the patient, and if we have any information, if we pass on that information to someone else in the hierarchy. But playing hot potato with information so as not to be left holding the potato isn't what medicine is all about, and it's not what HIPAA is all about.
 
The answer isn't to allow people unfettered access to record. Instead, there needs to be a mechanism for reporting of resulted labs and completed (not necessrily read unless that happens really fast) studies to the physician the patient is assigned. I know nurses have protocol labs, are there really places with protocol CT scans? I have worked at hospitals where you see the trauma activation in the hallway because every other spot is filled, or the average wait time is really long. Seems like even then things would at least get run past an MD or PA before moving to the big stuff. But if the nurse is ordering stuff on their own they should then be responsible for bringing completed stuff to the supervising party.
 
...although I'll give you the benefit of the doubt that you are playing devils advocate here...
Interesting, although presumptious if not arrogant. This is not about playing devil's advocate. I can appreciate you believe in your position and/or think you are right.
But that's just it -- you aren't really injuring other patients...
If you violate patient rights, no matter how noble you think you are or how convenient it may be for you, it is still an ~injury, even if the calculable damages are nil, simple example:
...Going into the pt record (even if just to check a film or a lab) ...Let's say you click on that arm pain and discover it ...[ANYONE]... coming in after a domestic violence incident. She doesn't have a fracture and gets sent home, but afterwards starts to think how many people are going to know about her ordeal. She asks for a list of who accessed her account and your name is on it but no consult was ever requested. Do you think your "I was just shopping through the ER to see if there were any patients for me"...
...If you polled patients in the ED and asked them if they'd rather wait for the ED doctor or allow other doctors in the hospital to review their labs/scans you and I both know what they would say. They don't consider this an invasion of privacy...
That's a wonderfully self serving "survey". Sure, you could poll the average American around the country and ask if they feel healthcare should be "free". Everyone is fine in the generic sense until they individually appreciate what it will cost them and what they must give up. Let us ask the sick/injured/suffering if they are willing to waive their privacy protections to expedite their care! Maybe, we should ask them to waive because, by waiving appropriate protections and privacy rights, we might discover they are about to die sooner? How about, when asking the question we tell them, "well, it will not really help the majority of you, but as a physician it is just far more convenient for me". In moving forward with such a consent, would one be clear and honest that the primary reason is again physician convenience, as noted several times before in this thread. The problem with your premise of "polling" the ED patients, i.e. effectively asking them for ~informed consent/release, is that it violates fundamental principles of getting consent when one is not under excessive stress/duress/situational coercion.
...For the patient who ends up having something time sensitive it is a blessing ...To say, it's better for patients to wait until the ED can get to them because their privacy is more important than someone getting them needed treatment earlier is problematic...
Again, the argument that every patient should surrender their individual rights in exchange for the 1. primary benefit of physician convenience and 2. potential that an individual patient might benefit. The possible individual patient still being used as an excuse. Kind of like airport security strip searches and taking shoes off....

...Now I get that when doctors benefit from convenience by doing it a certain way that tramples rights, that's suspicious, but if there's truly a health benefit for some % of patients to do it a certain way, you have to balance out (1) whether the patients would, in fact, object to this kind of intrusion (because the rights are those of the patients, not of some hospital to maintain their policy or of Congress who doesn't really have a first hand sense of how things work in practice), and (2) whether enough good comes out of it to outweigh some loss of privacy. I think this kind of surveying the board wins out in both categories because (1) the patients would be fine with it if you asked them, and (2) swooping in and getting someone the care they need and won't otherwise get does beat out the concern that some resident has seen the labs of someone who never gets admitted...
Again, your belief or position that you can speak for all people and/or that you are just correct, i.e. "because the patients would be fine with it if you asked them". The problem is that the patients are fine until they are not fine. You are NOT asking and they are not consenting.

How about the belly pain patient... discovered to be secondary to foreign body obstruction in lower GI tract or the example of domestic violence or maybe UTI that is really a new STD or etc.... Maybe you are a vasc surgeon... and you see the D-cells in lower GI tract. Or, GI-med doctor and you see the rupture spleen from the domestic violence. If you are reviewing the CT scan of a belly pain patient without appropriate referral/consult/invitation into caring for the patient, you are trampling their rights. Still, the "greater good" was served and you have in one scenario something to chuckle about with the radiologist before you go home.

Yes, these patients can surrender their individual rights to privacy in order for physicians to avoid getting called back in for a consult and the possibility that, their individual sacrifice might by chance benefit someone they don't know, don't care about, will never meet... The problem ultimately aside from the primary motivation [i.e. individual physician convenience] is that the patients have NOT consented. They have NOT INDIVIDUALLY & VOLUNTARILY waived their rights. Rather, their rights are being taken based on individual physician belief that ~"I would be OK with it. So, I am sure EVERYONE else would also be OK. Thus, consent is NOT really required and, oh, by the way, one of them might even benefit too". And of course, "they would be fine with it if you asked", so why ask... because to do so would again result in inconvenience.
 
Last edited:
This is an interesting discussion that is rapidly turning into the usual angry debate. Regardless, I would give another example for consideration. It is usual, ordinary and EXPECTED that the neonatology staff routinely review, 24/7 the labor and delivery board. This includes patients that we have not been consulted on, won't be consulted on in all probability, etc. The L & D board is situated in a place that only staff can see it, but includes identifying information and, at times, somewhat "personal" information.

I have never heard of this being an issue. Having the neonatology team aware of all patients in L & D is of obvious benefit for our planning of staffing, etc, although of course, we could survive without that information.

Not long ago, for example, I was stat paged and the pager said "chiro in Room 10." 😱 I assumed they meant "emergency spinal manipulation needed for laboring woman in Room 10, only a neonatologist can do this."

Sadly, they had misspelled "chorio" (amnionitis).😛
 
Does that L+D board really have identifying info (such as name plus DOB, I think the last or first name alone doesn't count)? If it is only pseudo identifying (such as initials) then I can't see how that would be an issue. I ask because I thought boards with complete names and such were no longer allowed even in staff only areas.
 
...It is usual, ordinary and EXPECTED that the neonatology staff routinely review, 24/7 the labor and delivery board. This includes patients that we have not been consulted on, won't be consulted on in all probability, etc. The L & D board is situated in a place that only staff can see it, but includes identifying information and, at times, somewhat "personal" information.

I have never heard of this being an issue...
I appreciate that example. It is however, "service specific". It would be unusual for a belly pain patient in L&D to be something other then a pregnant woman. The same as cardiologists aware of who is in the card cath lab. Yes, there are areas in which appropriate respect for patient rights could be lacking. But, given the specific service area, it is distinctly different from the "general store" variety in the ER.

A patient in the ER with belly pain can be a psych pt, irritable bowl, gall bladder, ischemic bowle, AAA, trauma... even a pregnant woman, etc... So, while it may be reasonable and easy to establish appropriate protocols in L&D for the limited specialists involved in care, who gets to trawl the ER census list and open confidential labs and imaging just in case? Psych, GI-med, Cards, GSurge, Vasc, OB/Gyn, etc? The "just in case" excuse means each patient could conceivably have there records/data reviewed by a half dozen physicians [specialties] +/- their support team members to ensure the ER hasn't failed to consult them.
...it's really just the OP who hasn't figured out how to communicated without being unnecessarily rude, condescending, or argumentative.
I appreciate your opinion. I guess the perception is in the eye of the beholder and really since the conversation is predominantly between Law2 & I; I am certain Law2 & I can debate and have difference without your concerns. It is unfortunate the quality of your participation/contribution to the discussion.
 
Last edited:
Top