Healthcare organizations have a duty to protect patients' private health information. To avoid situations where many staff improperly access a celebrity's records, organizations should implement trainings to increase security of electronic health systems. Staff should be trained annually on confidentiality policies and the consequences of violating patients' privacy. Special security measures may also be needed to protect high-profile individuals' information.

1. Confidentiality
Marlene Brooks
April 4, 2014
MHA690: Health Care Capstone
Week 1 Discussion 2
1

2. Reading the Report: Over 120 UCLA Hospital Staff Saw Celebrity Health
Records article, what training could you as a manager put into place to avoid
this situation?
Healthcare organizations are entrusted with the most private information of their
patients; they have a legal, moral, and ethical duty to protect all clinical and
research information by ensuring that security and privacy safeguards are in
place. They must implement a higher degree of control to prevent unauthorized
access sensitive information; this is especially true for electronic health record.
Health care professionals must be aware of high-risk groups and should also be
able to assess whether electronic systems include features and functionality that
may increase risk of inappropriate use and disclosure and offer additional layers
of protections for sensitive information.
2

3. What is Confidentiality?
• Confidentiality is the practice of permitting only certain authorized
individuals to access information with the understanding that they will
disclose it only to other authorized individuals as permitted by law. For
example, substance abuse information may not be released without specific
consent.
3

4. Training to Warrant a Higher Degree of Security in an Electronic
System
• Highly sensitive health data involve certain conditions, tests, and records of
vulnerable and high-profile patients and minors. Implementing security features
for such categories can present challenges because specific functionality may not
be fully evolved or present at all.
• Consistent and reliable methods for authenticating patient identity and linking
patients to their records warrant special security because they are essential to
delivering quality care and improving patient safety.
• There are variability and incompatibility of patient identification systems in
healthcare facilities, making it difficult to uniquely identify patients between
entities. A system of identifying patients between entities must exist for
interoperability to occur. 4

5. Training to Warrant a Higher Degree of Security in an Electronic System
continued
• Safeguarding patient information is critical to preventing identity
theft, medical identity theft, fraud, and abuse, and may be addressed through
improved physical and logical access control systems and constant vigilance.
Organizations requires strict policies and procedures governing the use of
physical media and portable devices to prevent theft and loss.
• Special circumstances may arise in which patient identification and access to
individual patient records may require anonymity and special
precautions, such as in the case of celebrities and high-profile individuals
privacy, domestic violence, child and vulnerable adult abuse, litigation, organ
donors, and prisoners. In such cases, the use of a record hold, a de-
identification mechanism, access restriction, or an alias should be created to
provide greater protection for a specific period of time.
5

6. Training to Warrant a Higher Degree of Security in an Electronic System
continued
• Health care must have products that offer security features that fits their need. It
must have the ability to limit access and provide screening controls to only those
staff working directly with the patient or those with administrative responsibilities
such as risk management and legal. Screening controls should include the ability
to redact sensitive information that should not be disclosed.
• User activity will be tied to a unique identification to reliably maintain an audit
trail of navigation, documentation, and other activities. Audit trails are essential in
tracking user activities such as document viewing, manual
printing, addendums, retracted and restored documents, and follow-up requests.
Document creation will be recorded, per user, with appropriate date and time
stamps for when the document was saved, posted, validated, and otherwise
amended. 6

7. How can this training on confidentiality be effective for the
employees?
• All staff members should have training at least once per year on
confidentiality especially when the staff has access to personal information.
This training should include HIPAA rules and regulations and the
consequences of not following them.
• Staff should know that there can be serious ramifications for violating a
patient’s privacy. All employees that have access to personal information
should be required to attend the annual training. During the meeting they
should be given an employee handbook that address confidentiality and the
employees should sign a copy for their personnel file.
7

8. References
• Associated Press (2008). Report: Over 120 UCLS Hospital Staff Saw
Celebrity Health Records. Retrieved from
http://www.foxnews.com/story/2008/08/06/report-over-120-ucla-hospital-
staff-saw-celebrity-health-records/
• McGowan, C. (2012). Legal Issues: Patients’ Confidentiality. Retrieved from
http://www.aacn.org/wd/Cetests/media/C1252.pdf
8