|
by Linda Erceg, RN, MSOctober 2001
Many of us remember the staff meeting before campers arrive when information,
including information about health history, is shared. The scope of that
sharing has been the subject of growing discussion. Policies at both federal
and state levels about disclosure of confidential information are often
confusing in their application to camp, a nontraditional healthcare setting.
The purpose of this article is to examine the disclosure of health information
about individuals in the camp setting.
The "Privacy Rule" (Standards for Privacy of Individually Identifiable
Health Information) came about because of HIPPA (the Health Insurance
Portability And Accountability Act of 1996). The Privacy Rule became effective
April, 2001 and must be implemented no later than April, 2003. It does
the following:
- Gives patients more control over their health information
- Sets boundaries on the use and release of health records
- Establishes safeguards that health care providers must achieve to
protect the privacy of health information
- Holds violators accountable with criminal and civil penalties if they
violate privacy rights
- Strikes a balance when public responsibility requires disclosure of
some forms of data for the public health
For patients, it:
- Enables patients to find out how their health information is used
and disclosed
- Limits release of information to the minimum reasonably needed for
disclosure
- Gives patients the right to examine and obtain a copy of their own
health records and request corrections
Scope of the Rule
The regulation impacts (a) how personal health information moves among
and within entities involved with meeting health needs; (b) what clients
are told about this; and (c) the controls they have in the process. "Covered
entities" are agencies which use electronic means to transfer data
about individuals' health. Given the growing use of computers and fax
machines to electronically transfer data - to complete a camper's health
form, to submit workers' comp claims, to fax a health form to a treating
emergency room - there is need for the camp community to make note of
this regulation.
In addition, the Privacy Rule addresses confidentiality of health information
within an entity, regardless of electronic capability.
Clarify the Camp Policy about Privacy of Personal Health
Information
The rule acknowledges that healthcare providers need access to information
about the people for whom they provide direct care. But it raises a question
about other people or entities. Determine your camp's current way of handling
protected health information (PHI). Remember to consider:
- Who receives completed health forms and who has access to those forms
before camp starts?
- About what health concerns are kitchen staff typically informed? Why
are they told? Specifically who is told - just the head cook or the
entire kitchen staff? Could that pool of people be more limited without
jeopardizing safety?
- What health challenges are shared with cabin staff?
- Who in the specialized areas of camp - waterfront, ropes course, horseback
riding, tripping, etc. - are told about health challenges? Why are they
told?
- Under what circumstances does PHI leave camp? How is the privacy of
that information monitored?
- What individuals have access to all and any PHI? Who has limited access
and how is that access limited?
- When a person leaves camp - whether on a day trip or at the end of
their camp session - how is their health history secured? Who makes
decisions regarding the disposition of that information?
- How does one gain access to PHI?
The Privacy Rule directs entities to define their policy and make that
policy generally known to clients as well as implement "reasonable
steps" to limit use of protected information within the entity and
in regard to requests it may receive from other parties. Information must
only be released to those with a clear "need to know."
Consent and Authorization
According to the rule, a provider who has a direct treatment relationship
with a given individual - such as the camp physician and camp nurse -
is to obtain written consent regarding the use and disposition of the
individual's health information.
Think about your camp's practice and consider talking with your legal
counsel. Consider revising the health form's paragraph to include disclosure
authorization for securing payment and/or for health care operations.
In doing so, individuals - our staff, campers and their parent/guardian
- may request restrictions to a camp's disclosure policy and retain the
right to revoke consent. For instance, language in your permission form
could be modified to read (new material in bold): "I agree to the
release of any records necessary for treatment, referral, billing, or
insurance purposes..."
The Rule's Concept of "Minimum Necessary Information"
The Privacy Rule acknowledges that healthcare providers need free access
to individual health information and in no way seeks to limit that access.
In the camp setting, for example, the camp nurse has free access to health
forms; camp staff generally do not.
In this situation, the rule directs entities to limit access to the minimum
necessary or to that which is reasonable. What is meant by "minimal,"
"necessary," and "reasonable" is left to the discretion
of the entity - camp, in our case. Because of this, the scope of what
a given camp discloses may vary from other camps but, in all cases, only
the minimum should be relayed.
This raises a question when campers and staff are referred to out-of-camp
providers such as clinics, hospitals, dentists and chiropractors. The
camp retains a responsibility to satisfactorily determine that the provider
is using PHI only for the purpose for which their services were engaged.
Oral Communication
We often use oral communication to convey health information about people
at camp. This rule directs us to provide "reasonable safeguards"
so oral information is limited only to those who need to hear the information.
For example, the camp nurse may talk with a cabin counselor about a camper's
care but would do so in a setting which limits - if not eliminates - who
else listens to that conversation. Camps should also review screening
practices of Opening Day to evaluate who is hearing what about whom during
the process.
With Regard to Minors
As is the current practice at camp, the Privacy Rule recognizes parents/guardians
as the representative of a minor. Consequently, the parent/guardian can
sign statements of consent and/or authorization in the child's name. In
addition, the Rule also recognizes another person acting in loco parentis.
This is a position that many camps assume with regard to campers.
Parent access to health information about their child is another aspect
of this discussion. According to the rule, individuals have "certain
rights with respect to their personal health information, including the
right to obtain access to and to request amendment of health information
about themselves." While there's no clear directive about "access,"
it would seem prudent to consider the implications if parents and staff
ask to see their health record. Adapt record-keeping practices as needed.
Marketing: Opportunity or Not?
As to be expected, the Privacy Rule states that an entity may not release
PHI to an agent for the purpose of product marketing. Nor should a company
provide health promotion, preventive care and/or wellness programs for
camp staff and/or campers based exclusively on specific products used
with the population. This probably has more impact upon year-round camps
with employee health programs or camps that focus on a specific health
challenge (e.g., weight management, asthma, diabetes). If the camp's support
is identified at the time of enrollment - for example, a camp program
sponsored by [name the company] - and a parent chooses to enroll a child,
it is expected that the sponsor company impacts the nature of the program.
However, if the camp promotes itself with no affiliation, then it should
not inadvertently market a product by having that product exclusively
used in the program (e.g., a given line of food items used at a camp which
focuses on weight management).
What Should a Camp Do?
In view of the Privacy Rule becoming effective last April but compliance
scheduled for April 2003, consider the following action plan:
- Determine how health information is currently handled at camp, who
has access to it, and why. Then develop a policy statement which reflects
current camp practice. Pilot the policy next season and revise it with
input from appropriate sources.
- Talk with legal counsel regarding "red flags" which surfaced
as a result of reading this information.
- Monitor clarification and development of the Privacy Rule via the
U.S. Department of Health and Human Services. Information available
online at http://aspe.os.dhhs.gov/admnsimp/final/pvcguide1.htm.
Several areas are already targeted for clarification, and interpretive
guidelines will continue to surface.
Many camps will probably note the need to clarify their internal practices
more than the external ones. We tend to act in a manner which protects
our campers and staff from external intrusion, but we are more cavalier
about our internal practices.
Camp health services have expanded in scope, and campers and staff have
more complex health needs than ever before. The need to consider privacy
is a timely matter and we have a window of opportunity during which to
carefully consider the topic. Open that window.
Originally published in the 2001 Fall issue
of The CampLine.
|
