Time Stamps

• 03:51 What is the difference between Privacy and Confidentiality?
• 05:50 Guidelines and laws
• 10:06 Limits/appropriate breaches (competing principles/obligations)
• 22:03 Privacy vs Education
• 35:34 Conclusion

Sponsor: DoxGPT

Check out DoxGPT by Doximity and see how it can simplify your clinical workflow, from patient care to paperwork. Visit: https://www.coreimpodcast.com/DoxGPT 

Show Notes

1. Introduction
2. Definitions and background
   1. Ethical underpinnings of privacy and confidentiality are patient rights, protection of their dignity, and respect for their autonomy.
   2. Clinician’s responsibility to protect a patient’s information alongside a person’s ability to protect information about themselves.
   3. Upholding privacy and confidentiality are crucial to successful care, building patient-physician trust, and promoting truthfulness.
3. History, guidelines, and laws
   1. Hippocratic oath
   2. American Medical Association (AMA) 
   3. HIPAA and the Privacy Rule
   4. 21st Century Cures Act
4. Potentially necessary exceptions to patient privacy/confidentiality 
   1. Preventing imminent harm 
   2. Public health or safety concerns including sexually transmitted infections and other infectious diseases
   3. Mandatory reporting including child abuse, elder abuse, injuries resulting from deadly weapons
   4. Considerations regarding intimate partner violence 
5. Balancing privacy/confidentiality with educational imperatives 
6. Conclusion

Transcript

Dr. Tamar Schiff: Welcome back to At the Bedside. Today we’re going to talk about patient privacy and confidentiality. It’s a topic that might make us think of mandatory online modules, but it also comes up in meaningful ways in practice all the time. For example, if a patient shares ongoing domestic abuse, would it be a breach of her privacy to report it? What about sexually transmitted infections? And what if I took care of a patient with a really interesting presentation a few months ago and I want to see how he’s doing, and to continue learning from his clinical course? Considerations around privacy and confidentiality have big ethical, legal, and practical implications in how we approach not only patients and their personal information, but also medical education, research, and public health concerns. So let’s jump in. I’m Tamar, I trained as an internal medicine physician and I’m now a bioethics researcher.

Dr. Jafar Al-Mondhiry: I’m Jafar Al-Mondhiry, a medical oncologist at Inova Schar Cancer Institute near Washington DC and Assistant Professor of Medical Education at the University of Virginia School of Medicine.  

Dr. Margot Hedlin: And I’m Margot, a hospitalist at Harborview Medical Center in Seattle, and an Assistant Professor of Clinical Practice at the University of Washington’s School of Medicine.

Dr. Tamar Schiff: We’re lucky to have two expert guests with us today. The first is Dr. Joel Giederman.

Dr. Joel Geiderman: I’m the co-chair of the emergency department at Cedar Sinai Medical Center in Los Angeles. I’ve been my position as co-chair for 31 years now, and I’ve been at the hospital since 1979, which is a long time. And I’ve served on the ethics committee of the hospital as well as our college, American College of Emergency Physicians. 

Dr. Tamar Schiff: Dr. Geiderman has written extensively about this topic and we asked him how he got interested in it.

Dr. Joel Geiderman: At least part of it I think comes from my background as being the child of Holocaust survivors. You know physicians violated almost every code that you could think of during that period of time and were highly complicit in crimes against humanity. So I kind of became interested in a little bit that way.

Dr. Tamar Schiff: We’ll also hear from Dr. Gregory Brisson. 

Dr. Gregory Brisson: I’m an internist at Northwestern Hospital in Chicago. For half of my job I see patients in the office. And then the other half of my job I spend my time teaching medical students and writing about medicine. And I’m also a member of the hospital ethics committee, which is at the intersection of these different roles that brought this issue to my attention. 

Dr. Tamar Schiff: He told us about a particular experience that made him think about how medical students can balance patient privacy and confidentiality with their need to learn.

Dr. Gregory Brisson: It was some years ago that I heard a group of third year medical students out in the hallway after class. And one of the students was talking about the way he tracked former patients in the EHR and how he found it a helpful way to follow up on them. But one of the students in the group challenged him. He said that tracking former patients violated HIPAA because the student was no longer part of the team that was caring for the patient. Well, this first student responded that he had a right to do this for his education and, uh, said that it was expected of students. And then this group got into an animated discussion, and after a few minutes without reaching a conclusion, they turned to me and they said, “You know, Dr. Brisson, what’s the right answer? Is it okay to track patients in the  EHR for educational purposes?” Well, I had no idea, you know, even though I was wearing the long white coat I didn’t know the answer to this. So I did what teachers typically do when they don’t know the answer. I acknowledged that it was a great question and suggested that we all read about it. When we explored the topic, we found there was little guidance in the literature.

Dr. Tamar Schiff: So Dr. Brisson and his students decided to do some research and publish on the topic themselves. And we’ll get back to their interesting findings and solutions in the second half of the episode. But first, let’s start by defining privacy and confidentiality. Where do they overlap and how do they differ? Why do we even care about them?

Dr. Gregory Brisson: Confidentiality is an ancient principle in medicine well known to both, you know, physicians and patients. And it can be defined simply as the commitment of the physician to protect information about the patient. That’s important because the doctor-patient relationship is based on trust. Patients need to be able to trust their doctors will protect the information, that private information, that they share in confidence or they may not seek care. And so, in that respect, the principle of confidentiality really enshrines the trust that’s at the foundation of the doctor-patient relationship. Privacy, in contrast, is a more modern principle in medicine and it can be defined as a person’s ability to protect information about themselves. And even if patients trust their doctors not to share health information, there are some things that are sensitive or personal that patients may not want their doctors to know, and they have the right not to disclose that. You know, privacy is assumed as part of the guarantee of patient autonomy. Certainly if there isn’t that trust that doctors will maintain that confidentiality, then patients are more likely to protect their own privacy.

Dr. Tamar Schiff: So these responsibilities are rooted in the need to respect patients’ autonomy and to maintain the trust in the clinician-patient relationship that’s crucial to providing good care.  

Dr. Joel Geiderman: I think it really stems from our respect for the moral worth of a person and for their dignity. And so, at its core, that’s what it’s about, is that a patient has moral worth because of their personhood and that that should be respected, whether it’s physical privacy or informational privacy, that’s under their control.

Dr. Tamar Schiff: Now I’ll hand it over to Jafar. He’s first going to review some of the major guidelines and prominent laws relevant here. We’ll then move to considering a few important cases where we may ethically limit how we protect patient privacy and confidentiality for the safety of other individuals or the general public. And finally, we’ll circle back to our discussion with Dr. Brisson about how he explored this issue with his medical students. 

I. Guidelines and laws 

Dr. Jafar Al-Mondhiry: So just like Tamar outlined, respecting privacy and confidentiality is a fundamental part of what we do in healthcare. It’s a part of our training that comes up over and over again, at every different level of our career, and with good reason. Like Drs. Brisson and Geiderman pointed out, it’s the basic covenant of trust that allows patients to feel safe bringing their problems to us. And this is not a very modern ethical principle. 

Dr. Joel Geiderman: It’s an ancient duty. It’s actually one of our foundational duties. It’s about the only thing that survived the Hippocratic Oath. And it’s beautifully stated in the oath. The oath states that: “Whatsoever a house I enter, I will enter to help the sick and I’ll abstain from all intentional wrongdoing and harm, especially from abusing the bodies of a man and woman. And whatever I shall see or hear in the course of my profession as well as outside my profession should not be published abroad. I’ll never divulge holding such things to be holy secrets.” And it’s a beautiful phrase. It really does invoke almost a holy duty. And Hippocrates reference going into a patient’s house. And the truth is, when you have an interaction with a patient, it’s as if you’re going into their house because they’re laying into the most private parts of their lives. And it’s necessary in order for us to do our job correctly and as well as to make the patients feel comfortable and be able to disclose things to us.

Dr. Jafar Al-Mondhiry: Okay, historical references aside, I wanted to jump ahead to the modern era and take some time here to go over the relevant guidelines published by a couple of our biggest governing bodies in medicine. First, we’ll talk about ethics, and for that we’ll look at the AMA guidelines:

So the AMA defines four main parts of privacy.  First, we have informational privacy, and this is the thing we tend to focus on, meaning personal health information, or PHI, gathered during medical care and how we protect that through confidentiality. By contrast, physical privacy relates to how we respect a patient’s control of their body, who touches it, when, and how. Whereas decisional privacy means honoring a patient’s ability to make personal choices, like those reflecting religious or cultural identities. Finally, associational privacy is defined as a patient’s ability to choose among personal relationships, and who they include in their medical care.

Now, in terms of how to manage privacy? I’ll quote the AMA in saying, quote: “Physicians must seek to protect patient privacy in all settings to the greatest extent possible.” So what does that mean? Basically it breaks down like this: First, if you have to intrude on a patient’s privacy, do it as minimally as possible. Second, If their privacy gets breached in a significant way, make sure they know that. And then, if they ask about how their privacy is managed, be transparent about it, acknowledging limits in systems and policies. Finally, know that different patients may want different degrees of privacy.

Now, in practical terms, and even just thinking about informational privacy here, we do share PHI pretty often. Some of those reasons include coordination with other medical providers, or for billing purposes, and cooperation with legal investigations and reporting laws – stuff we’ll get into some depth here with the next section. But again, the overriding expectation is that we’ll share only the minimum amount of information required, and with full transparency. Ok, so that’s that AMA code of ethics in a nutshell. On the legal side, we have our old friend HIPAA. and what’s called the “Privacy Rule”, which defines “covered entities” that have to guard PHI. We’ve included a link in the show notes to the US Department of Health and Human Services website if you want to get into the nitty gritty of the Privacy Rule, but suffice it to say, this is a pretty hefty federal mandate, protected by the Office of Civil Rights. And patients do have a lot of rights in this: they can request a list of any disclosures ever made with their PHI, and now with the advent of the 21st Century Cures Act, HIPAA also allows nearly unlimited patient access to clinician notes written about them in their healthcare records, with room for patients to object and submit requests for amendments to their records, and restrict disclosures to certain groups. What we’ll get into next are the ethical tensions we wrestle with when privacy & confidentiality comes up against other moral demands—something I’ll leave for Margot to open up because, well, this is where it gets much, much harder.

II. Limits/appropriate breaches (competing principles/obligations)

Dr. Margot Hedlin: As Jafar mentioned there are times when our duty to protect the patient’s confidentiality clashes with our duty to protect the health and safety of others. Let’s dive into the rare situations where we need to put confidentiality to the side: the mandatory reporting categories. The first category is the threat of imminent harm to other people. This category was defined by a tragic case: A 1969 California Supreme Court Case called Tarasoff v. the Regents of the University of California. A man named Prosenjit Poddar fell for a woman named Tatiana Tarasoff, but felt like his love was unrequited. He became obsessed, and told his psychologist that he planned to kill her. His psychologist was obviously alarmed: he asked the campus police to detain Poddar for paranoid schizophrenia, but after interviewing him, the police let him go, they said he seemed rational. Ultimately, Poddar followed through on his threat and murdered Tarasoff. Tarasoff’s parents filed a lawsuit, saying that the psychologist failed to warn them that their daughter was in danger. There is a lot to unpack with this case, but the court focused on several issues. Did the psychologist have a duty to warn Tarasoff’s parents about Poddar? When there’s a conflict between patient confidentiality and the health of another person, which one do we prioritize? The psychologist’s legal team argued that a duty to warn would threaten the open and honest communication that is essential for a therapeutic patient-clinician relationship. But the court said that confidentiality needed to be balanced with the public interest in safety. Their conclusion? Quote, “The protective privilege ends where the public peril begins”. 

Dr. Joel Geiderman: And that enshrined the duty to warn and said, if it can’t be a general thing saying I’m going to go shoot up society, it’s got to actually be an identified specific person in order to have that duty to warn be triggered. 

Dr. Margot Hedlin: If you’re aware that your patient presents a serious threat to someone else, you have a duty to make sure the person at risk is warned. If you find yourself in this situation, reach out to the legal team at your local institution. The second mandatory reporting category takes a broader view: what is our duty to protect public health? 

Dr. Joel Geiderman: Another whole area of reporting are infectious diseases, and this goes back to the late 1800s,, early 1900s, where diseases such as yellow fever and the like were mandatorily reported for infection control. And to this day, there’s a federal list actually, of diseases that we’re obligated to report. Usually that’s done internally by hospitals, etc. But again, that’s for societal good.

Dr. Margot Hedlin: Surveillance systems have saved countless lives by enabling clinicians to communicate their concerns to public health officials. We’ve gotten early warning about everything from SARS to the west nile virus. But there’s a tension between our patient’s right to confidentiality, and our duty to protect others from an infectious disease they may carry. There are mandatory reporting laws in all 50 states that require clinicians or healthcare institutions to report active tuberculosis and certain sexually transmitted infections to the local or state-level department of health. The focus is on STIs we have good treatments for: syphilis, HIV, gonorrhea, chlamydia, and chancroid. The department of health usually manages whatever next steps may be necessary, like contact tracing and partner notification. But it’s important to know your state laws: in a few states, you have a duty to warn the people who are in harm’s way; if a clinician knows of any partners that their patient may have passed the STI onto, they’re legally obligated to notify the health department about that person too. 

Dr. Margot Hedlin: Surveillance is complicated for reasons beyond its tensions with confidentiality. Surveillance can sometimes lead to more intrusive measures, like quarantine. This conflict of interest became particularly clear to me in residency. Jafar, Tamar, and I all trained at a public safety-net hospital with a wing dedicated to caring for people with tuberculosis. These patients weren’t all there voluntarily; in New York City, we do everything we can to connect patients with tuberculosis to treatment, but as a last resort, the department of health has the power to compel non-adherent patients to be placed in isolation, as a way of protecting the public. Those patients didn’t want to be there – but while they had the right to refuse medication, they didn’t have the right to leave. To sum up, I just want to acknowledge how complicated this can be. We’re used to focusing on what’s best for our patient, but when there’s a clash between our patient’s right to confidentiality and the public’s right to safety, there are a handful of situations where we may have to betray our patient’s trust. 

Dr. Jafar Al-Mondhiry: So Margot just outlined some important scenarios where a respect for patient privacy runs up against our need to protect others from harm, whether it be from a communicable disease or homicidal intentions. But what happens when we think we’ve witnessed a harm? How do we respond to cases of suspected abuse? Now, it’s probably not surprising to hear that all 50 states have mandatory reporting laws for suspected child abuse, and up to 47 states have laws for reporting suspected elder abuse. And this makes sense: bringing in the appropriate law enforcement and social services helps extend our care for the patient into the rest of their life. 

Dr. Joel Geiderman: There are similar laws to child abuse that are relatively non-controversial. Elder abuse requires reporting. It’s because the elder person oftentimes is dependent on their children or another person for caretaking, and they’re unlikely to report for themselves. They may not have capacity even to report. So in those cases where we have a suspicion, we have a duty to report as well, in order to protect the elderly. 

Dr. Jafar Al-Mondhiry:  But there’s more to this than just beneficence: reporting also allows us to track how often this is really happening. Building statistics helps build the right kinds of political and legal attention, which then helps us build the social resources we need to address it.  And so in that sense, breaching confidentiality in cases of abuse serves the overriding ethical principle of justice. It’s about asking the bigger questions of how we as a society can prevent such acts of violence and better aid victims, with a special attention to the most vulnerable. And there are some other critical social issues covered by mandated reporting policies – things like injuries resulting from deadly weapons, acts of crime, or intimate partner violence.  Currently, 42 states have reporting requirements for injuries resulting from firearms, knives, or other weapons. Unfortunately, the laws around this area can get pretty hairy and technical from state to state: nearly half of the states have reporting requirements for injuries resulting from crimes with or without a deadly weapon, many states have varying rules about what constitutes a deadly weapon, and only 7 states have laws specifically focused on intimate partner violence. So here’s where we hit our age-old retreat: at the end of the day, you’ve got to know the laws of your own state and practice environment. But underneath all of them lies the same ethical tension.

Dr. Joel Geiderman: Confidentiality is a prima facie duty, but if there’s an overriding duty such as protecting society,  that may be a legitimate reason to override somebody’s privacy.

Dr. Jafar Al-Mondhiry: So going back to cases of child and elder abuse again, at its face, the ethical calculus seems to more clearly favor the duty to report over our duty to protect confidentiality. But we could do a whole episode just about the ethical ambiguities of what it means to suspect abuse–like what’s the threshold at which to report? And how do these unfairly break down around racial and class lines? And what are the social consequences for patients and families when we pull the trigger on reporting? 

Dr. Joel Geiderman: One of the arguments, for instance, against reporting domestic abuse or suspected domestic abuse or violence, I should call it, is that it may actually deter a patient who needs treatment from coming in at all. And same argument has been made over seizures and other things that, if a patient knows they’re going to be reported, they may not want to come in whatsoever.

Dr. Jafar Al-Mondhiry: These tensions get even worse in cases of intimate partner violence, and it brings up a troubling question: when does the threat of exposure through mandated reporting actually deter a victim from seeking help, when reporting could provoke an act of retaliation from an abuser? And are we justified in stripping consenting adults of their rights to confidentiality and self-determination?  

Dr. Joel Geiderman: Reporting of domestic violence in adult patients is more controversial. It’s actually required in certain states, and it’s not required in many states. In some states, you can actually, it’s permissible to report, and there are immunities for reporting, which is important, so that if you report somebody in good faith, but it turns out there was no abuse after investigation, then they can’t turn around and sue you. But in my own, again, this is not legal advice, it’s not, but there can be problems if a competent adult does not want the police to be involved, but you may want to involve social services or other remedies that don’t involve the police. In certain situations that may be better because all kinds of things can follow on once you have the police involved, including loss of job, up to deportation, there can be all sorts of things, and there may be better ways to solve the problem than involving the police.

Dr. Jafar Al-Mondhiry: At the end of the day, we have to ask ourselves about these competing obligations, first to the patient in front of us, but also to this whole legal framework that compels us to act as agents of the state, where fulfilling what the state requires may make us betray our our responsibility to care for the person who came to us for help. Without any political commentary, we have to acknowledge that we’re living in a new era where the lines between public and protected spaces – like healthcare facilities – are becoming blurred, and clinicians may be asked to report on matters once considered well outside of our purview.

Dr. Joel Geiderman: Many, many years ago in California, they passed a proposition called Prop 187 that would have required physicians to reports suspected what was referred to at the time as illegal aliens. And it was subsequently struck down by the Supreme Court, I believe, or at least one of the courts, and it never went into effect, but I personally would’ve committed civil disobedience and not reported people because again, that would only discourage people from coming to the emergency department who may really legitimately need care and not be able to seek it for free of all sorts of other recrimination, including deportation. And again, these things can lead to breakup of families and all sorts of things. So I think there has to be careful consideration of the effects. So my advice would be in general, I can’t sit here and tell people to break a law and I won’t. So I think in general, it’s good to follow a law unless you really feel that you have conscientious objection to doing so, in cases where you think a law is so morally fraught. Because I said during the period of the Third Reich in Germany, a lot of the activities that were mandated were considered quote-unquote legal, but were highly unethical. For instance, they had a euthanasia program that was required physicians to report patients who had congenital conditions or other undesirable characteristics and I believe 400,000 people were killed during a legal euthanasia program in the 30’s during the time when people would believe in eugenics and felt that these were traits that could be passed along and what were termed lives not worth living.

Dr. Jafar Al-Mondhiry: So let me leave at this, and keep it simple: we live in a world of laws and ethics, and the two will not always meet eye to eye.

Dr. Margot Hedlin: So now that we’ve gone through mandatory reporting, let’s turn to a different aspect of confidentiality: what if you want to use patient information for a lecture or social media post? Some clinicians share educational EKGs, pictures of rashes, or compelling patient stories on social media. Often this is meant to educate, and sometimes it’s…um, let’s just say it’s an x-ray showing an object stuck in the wrong place.

Dr. Joel Geiderman: There’s a big temptation now in social media for people posting things, and it’s sort of a wild west where it’s unregulated. A lot of institutions have adopted policies, and that’s a good way to sort of police that activity.

Dr. Margot Hedlin: There are guidelines that can help us here. If you’re thinking of sharing a patient’s story, you need their consent. As for clinical vignettes, remove all potentially identifying information. A useful rule of thumb that many institutions have adopted is a “pause-before-posting” – encouraging clinicians to reflect on the post’s professionalism and any confidentiality issues before putting it up.

III. Privacy vs education

Dr. Tamar Schiff: We’ve touched on some of the ways privacy and confidentiality issues can shine a spotlight on how ethical principles or approaches can sometimes conflict – there can be tensions between protecting one individual’s privacy vs ensuring the safety of another, maintaining a patient’s confidentiality vs protecting the general public. In that same vein, we’re going to spend the rest of the episode circling back to Dr. Brisson and the research he undertook with a team of medical students who wondered if it’s ok to keep tracking a patient in the electronic health record for educational purposes.

Dr. Gregory Brisson: So one of the students and I decided that we would survey our medical students. We asked our third year students, specifically, after a patient has left your service or you’ve switched to a new clerkship, do you ever go back and follow up on your former patients in the EHR? And what we found is that 96% of our third year students had tracked former patients, and, uh, 93% said they found this activity beneficial from a learning perspective. This surprised us. In reviewing this topic, we found that many academic medical centers didn’t have a policy to address this question. Our hospital didn’t. What we found was only a few schools had explicit policies, and they offered widely varying approaches, ranging from permission to prohibition. So what we did is we gathered a group of members from the ethics committee, from the hospital, and from the medical school and set out to explore the original question, which is: is it okay to track former patients in the EHR for educational purposes? We framed the ethical conflict as patient privacy versus medical education. You know, essentially how do we train exceptional physicians while respecting the privacy rights of our patients? What we did to explore these arguments was to talk to members of, you know, the ethics department, members of our hospital compliance department, we talked with patients to get their perspective. We tried to get a 360 degree view from everyone who’s a stakeholder in this question to determine what is the appropriateness of this action.

Dr. Tamar Schiff: So they started to lay out the specific issues at play in deciding whether tracking patients in the EHR was ethically justifiable.

Dr. Gregory Brisson: So the first argument in favor of tracking is that it improves training and therefore it benefits society. And we started with the idea that tracking former patients does have potential value because it overcomes those problems of contemporary medical education: shorter lengths of stay, time-limited clerkships, often interrupted trainees relationship with the patient before the diagnosis is made or treatment is completed and that limits the learning experience. So our hypothesis was tracking could improve clinical training by enabling longitudinal follow up. My father was a general surgeon and he never used electronic health records, but when I told him about this process of tracking, he said it made perfect sense to him. And he made an analogy to golf, which was his sport. He said, you know, if you don’t check to see where your ball lands, you can convince yourself that your drives always hit the fairway. And I thought that was a wise observation. Another aspect of improving training is that cognitive psychology has shown that having an emotional connection to a subject can augment memory formation. And I think that’s what happens when you’re tracking a patient who you’ve already gotten to know. And so I think we looked at this and said, if we can improve the quality of the physician workforce by enhancing training, that’s a compelling argument in favor of tracking, we all benefit. And then there’s also historical support for tracking, at least for patient-based learning, which has been valued since the origins of modern medicine. Osler said that, you know, “he who studies medicine without books sails an uncharted sea, but he who studies medicine without patients does not go to sea at all.” It’s hard to argue with Osler, right? At least in medicine, he’s our patron saint.

Dr. Tamar Schiff: And then of course there’s the flip side.

Dr. Gregory Brisson: We should talk about what the concerns are for tracking, because they’re significant. And we wanted to look at these from a very critical perspective because we know the stakes are high. So we focused on two arguments against the action of tracking former patients. The first is simply that because patients have a right to privacy, tracking ultimately compromises that right and we shouldn’t do it. It’s that simple. And the other was, it’s not really necessary to track former patients to train competent physicians. So let’s start with the first one. Patients have control over their own information and they may not agree with someone tracking the records. And what we found is the most challenging aspect of tracking is that it relates to the future. So think about this: When a patient consents to the healthcare team’s access to the EHR, they recognize that team members may see everything that’s already happened in their health to that point. What they may not recognize though, is that when tracking is allowed, they’ve unwittingly consented to those persons having access to future events. You know, for example, a third year student may have a former surgical patient who was discharged and then gets a sexually transmitted infection at some point in the future. And the student might encounter this issue when looking at the records a few months later to follow up on this patient’s recovery. I know the student wouldn’t share that information. They know they wouldn’t share that information. But the patient may simply not want them to know about it in the first place. This is private information not related to the educational objective. So that was the first argument that we needed to explore and truly convince people of the risk. The second is that it’s not really necessary to train a competent physician. You know, when you examine tracking, we realize that, you know, there really is little data on the value of it. There are a few observational studies that suggest some value. Also, the literature on the value of case-based learning is inconclusive. And then support for this argument is also historical. Think about this: modern medical training has produced generations of exceptional doctors in the era preceding EHRs, you know, many of our mentors and teachers. Osler was one of them, he could be used on both sides of the argument here too. And I think the argument here then would be, if the benefits don’t outweigh the harms, we shouldn’t do it.

Dr. Tamar Schiff:  As part of weighing these pros and cons – arguments for or against patient tracking in the EHR – Dr. Brisson’s team got patients’ perspectives.

Dr. Gregory Brisson: The consensus was not only should students be permitted to track, students should be required to do it. The reasoning was this: They said, you know, we know you’re going to train competent physicians, but they said, we want a doctor who will care for the whole patient and their illness, not just the disease. And they intuitively sensed that tracking would help foster that quality by connecting them to the patient. They also offered some insight into the kind of guardrails that you need around this process. What they said is, while they thought students should be doing this process, they also thought that students should ask patients for permission. To give patients the satisfaction of participating in the education of medical students, you know, to find some good in their illness, knowing that this student doctor is learning from them. And we felt like this is really incredibly valuable perspective from the people who have the greatest stake in this discussion.

Dr. Tamar Schiff: They also turned to their institution’s legal team for their input.

Dr. Gregory Brisson: They looked at the description of permitted disclosure of protected health information as described in the HIPAA privacy rule, and concluded that tracking would be permitted under the broad definition of what’s called healthcare operations, which includes things like education. This was great news, you know, I mean, what the opinion was from our legal team, which is conservative, was that the law permits this action. We were most encouraged if there hadn’t been wholesale violations of HIPAA by our entire third year medical school class. And I would say this though, that it’s never been challenged. Legal opinions are just that until someone chooses to challenge them and then it would truly be tested. And to my knowledge, it has not been tested.

Dr. Tamar Schiff: And here’s what Dr. Brisson’s team concluded.

Dr. Gregory Brisson: Even though they can do it, how they do it matters. And it’s not without limits. Tracking is a privilege that really demands proper stewardship. So we needed an approach to tracking that was ethically appropriate. So to address this question of how do we do it better knowing that all the students are doing it, we started with the most basic technical question: where do you keep your list of former patients? To do it ethically and legally, we needed a process that was secure. So now at our institution, we ask our students to set up a custom list of former patients that’s housed within the EHR. Now we call that their educational registry. It’s literally just a list of former patients that a student follows longitudinally within the EHR for educational purposes. The next step was to address how do you access these records? Because, you know, when they entered the chart of former patients, they needed to know how to navigate these records. It’s different than reviewing the chart of an active patient in the hospital because they’re really just following up on a specific issue. They’re not exploring the entire record. So that’s why we developed a set of guidelines. There are four of them that are relatively straightforward to enable our students to perform this activity. The records of former patients need to be treated with the same privacy and confidentiality as the records of active patients. So you don’t print a list of patients from your registry and leave it in the cafeteria, or don’t wander away from the computer with your registry up on the screen. The second guideline was that students should ask patients or their surrogates for permission to track them. And on this guideline, we agreed strongly that without patient’s permission really eliminates that absolute choice between education and privacy. And more than that, it emphasizes for the student their ethical duty to the patient and gives them firsthand experience managing an ethical issue. So if we tell our students, explain to the patients what you want to do to follow their records and ask for their permission, and suggest a simple script, something like, “You know, it’s been a pleasure taking care of you. If it’s all right, I’d like to follow up on your medical record and see how you’re doing. Would that be okay?” We also allow one student to get permission for other members of the team, and this was really a practical compromise to avoid patients being bombarded with multiple tracking requests on the day of discharge. The third guideline was that students are permitted to track only those patients with whom they’ve had a meaningful clinical relationship, and they need to have legitimate educational intent. The final guideline that we proposed was that students should confine their review to the minimum information that’s necessary, and they should only track patients for the minimum length of time necessary to achieve the educational benefit. And again, this compromise was meant to minimize the interference on the rights of patients. Ultimately it’s intended to provide both a secure platform and an ethical framework to track former patients. And, you know, like all guidelines, we don’t imagine they account for all possible scenarios that may occur in clinical training. So we tell students to use the guidelines along with their clinical judgment and we’re always available as members of the ethics committee or the faculty to talk to students when they have questions.

Dr. Tamar Schiff: And this framework can be just as applicable to independently practicing clinicians.

Dr. Gregory Brisson: I think a physician who’s been properly trained on the ethical issues related to the conflict between training or education versus patient privacy should feel confident to be able to track former patients. And you can imagine that there are certain specialties where that may be more likely to happen than others. For example, I’m an internist, all of my patients I follow longitudinally, so tracking to me would not have even been on my radar screen because I, in a sense, track all of my patients. 

Dr. Tamar Schiff:  Dr. Brisson drove home why these kinds of deliberations are so crucial.

Dr. Gregory Brisson: I also think, too, that it promotes a good discussion of the role of ethics. You know, ethicists are rarely the most popular people in the room. And as you can imagine, when we first brought up this issue, there were a number of eyes rolled and they’re like, oh, now you’re gonna involve the attorneys and it’s only gonna lead to problems. And well, of course I can understand the way they feel, and we didn’t know where this was gonna lead. But at the same time, that’s the role of our profession and ethics in particular is to, you know, explore from within and shine light on issues and clarify things. Better that we do it than if somebody from outside of medicine, a patient perhaps, learned this was happening and asked us what did we do about this to ensure that it was done properly and we wouldn’t have a proper response. So I think it’s a wonderful learning tool about the, you know, the importance of self-regulation and the value of ethics. And I love in particular that it gives medical students a chance to manage an ethical issue primarily. They’re the only ones that can manage this issue because it directly relates to them and their relationship to the patient. That is somewhat unique in the medical student relationship with the patient, where they’re part of a team that typically manages that relationship.

Dr. Tamar Schiff:  And, while Dr. Brisson and his team worked with their institution to build their approach, remember that each institution will have different policies.

Dr. Gregory Brisson: There are several hospitals we identified that specifically said you are not allowed to look into the electronic health records of patients who’ve been discharged. Some even say you can’t look at the electronic health records of patients who’ve been transferred off your service to a different floor. 

Dr. Tamar Schiff: So, as always, you should make sure to be aware of your own institution’s specific policies on this.

IV. Conclusion

Dr. Tamar Schiff: To wrap up, privacy and confidentiality concerns are a part of everyday clinical practice. And knowing how to proceed when tricky issues arise can sometimes be difficult. While this episode only touched on a few of the considerations related to this topic, we hope that what we reviewed can be helpful in thinking more about these scenarios.

Dr. Joel Geiderman: My other advice is when you’re in a quandary, seek help either from your legal counsel or et cetera, but that’s why it’s also good to be prepared in advance and think about these subjects before you’re confronted with them.

Dr. Tamar Schiff: You should always be familiar with your local laws and, as Dr. Geiderman said, turn to additional resources at your institution for necessary support. Ultimately, while we sometimes don’t think through issues of privacy and confidentiality explicitly, they’re another important layer for trainees and clinicians to consider in providing holistic care.

Dr. Gregory Brisson: People will find that it’s a really welcome dialogue about issues that, you know, sort of nag us, but never rise to the level of, you know, immediate discussion because we’re all so focused on a person’s potassium or their EKG findings, but this is so important. 

Dr. Jafar Al-Mondhiry:  Thanks for tuning in!  We know these topics can stir up more questions than answers, and we look forward to hearing more about your experiences with privacy & confidentiality. Please continue the conversation with us online at our facebook page, on twitter or “X”, or email us directly. Find show notes and contact information for us on our website:  coreimpodcast.com

If you enjoyed listening to our show, and you’re not duty-bound to keep your opinions private, please give us a review on itunes or whichever podcast app you use; it helps other people find us.  We work really hard on these podcasts so we’d love to hear from you.  Let us know what we are doing right and how we can improve.  And as always opinions expressed in this podcast are our own and do not represent the opinions of any affiliated institutions. Finally, special thanks to all our collaborators on these episodes, all of our illustrators, moral and executive support from Shreya Trivedi, and most importantly thanks to you, our listeners!

References

• American Medical Association: Code of Medical Ethics. Privacy in Health Care.
• US Department of Health and Human Sciences. Summary of the HIPPA Privacy Rule.
• Open Notes. US Federal Rule Mandates Open Notes.
• Fairchild A, Bayer R, Colgrove J. Privacy and Public Health Surveillance: The Enduring Tension. American Medical Association: A Journal of Ethics. December 2007.
• Center for Disease Control. Sexually Transmitted Infections Treatment Guidelines, 2021: Supporting and Confidentiality.
• NYC. gov. Laws Governing Tuberculosis Care in New York City.
• Houry D, Sachs CJ, Feldhaus KM, Linden J. Violence-inflicted injuries: reporting laws in the fifty states. Ann Emerg Med. 2002;39(1):56-60.
• Diyaolu M, Ye C, Huang Z, et al. Disparities in detection of suspected child abuse. J Pediatr Surg. 2023;58(2):337-343.
• Najdowski CJ, Bernstein KM. Race, social class, and child abuse: Content and strength of medical professionals’ stereotypes. Child Abuse Negl. 2018;86:217-222.
• Sachs C. Mandatory Reporting of Injuries Inflicted by Intimate Partner Violence. American Medical Association: A Journal of Ethics. December 2007.
• Cuevas E. People are becoming wary of hospitals, leaving waiting rooms empty and doctors concerned. USA Today. Feb 7 2025.
• Schweikart S. Should Immigration Status Information Be Considered Protected Health Information? American Medical Association: A Journal of Ethics. Feb 7 2025. Jan 2019.
• Farnan JM, Snyder Sulmasy L, Worster BK, et al. Online medical professionalism: patient and public relationships: policy statement from the American College of Physicians and the Federation of State Medical Boards. Ann Intern Med. 2013;158(8):620-627.