Privacy and confidentiality in emergency medicine: obligations and challenges.

Respect for privacy and confidentiality have been professional responsibilities of physicians throughout recorded history. This article reviews the moral, religious, and legal foundations of privacy and confidentiality and discusses the distinction between these two closely related concepts. Current federal and state laws are reviewed, including HIPAA regulations and their implications for research and care in the emergency department. In the emergency department, privacy and confidentiality often are challenged by physical design, crowding, visitors, film crews, communication, and other factors. These problems are reviewed, and advice and guidelines are offered for helping preserve patients' dignity and rights to privacy and confidentiality.

Consider the following scenarios:

You have been asked to participate on a team that will design your new emergency department to accommodate an ever-increasing patient load. Space is limited. As you embark on your assignment, what are the considerations that must be given to privacy and confidentiality? How do you balance the need to take care of the most patients in the most efficient manner with the patients' right to confidentiality and privacy?

A member of your Board of Trustees with a daughter who is an aspiring actress on television has just landed a guest appearance on ER. The trustee would like to know if his daughter can observe several of your shifts in the emergency department to prepare for the role. What is your response?

You receive a call from a pharmacist and discover that a prescription you have written for hydrocodone has been altered from 6 pills to 60. When you try to call this patient to discuss this with him, you are told that he is an airline pilot and he is out of town. What is the proper course of action?

A distraught and overwrought mother calls your emergency department in search of her 21-year-old daughter who resides at home but hasn't returned at the usual time. The patient is unconscious from a suspected overdose at a rave party and is under your care. What should you tell this mother?

Your Chair inquires about a patient you saw the other night who is the Chair's next-door neighbor. How much information should you share?

Respect for privacy and confidentiality have been professional responsibilities of physicians throughout recorded history [1]. References to these are found in the Hippocratic Oath, religious texts, and virtually all modern Codes of Ethics [2]. The federal Health Insurance Portability and Accountability Act (HIPAA) privacy rules implemented in 2003 focused significant attention on privacy and confidentiality, but these are hardly new concepts or expectations. These duties are affirmed not only in the United States, but also internationally. Virtually all physicians are taught from the time they enter medical school that there is a sacred duty to “protect the patient's secrets” [3].

Despite these obligations, there are daily challenges to protecting privacy and confidentiality in the unique setting of the emergency department. The brief scenarios at the beginning of this article illustrate a few of the dilemmas that arise hundreds, if not thousands, of times a day in US emergency departments. To meet these challenges as they arise, the emergency clinician must have a firm understanding of the moral and legal underpinnings of the duties to protect privacy and confidentiality. In addition, it is important to understand the limits of these duties. This article focuses on these issues, examines some of the challenges that are presented in the emergency department, offers practical advice, and suggests solutions to common problems.

Privacy versus confidentiality

This article addresses issues of privacy and confidentiality. Although the concepts of privacy and confidentiality are closely related, and the two terms are often used interchangeably, several differences between them are worth noting. Privacy is the broader of the two concepts; it has at least four primary uses—physical seclusion, protection of personal information (“informational privacy”), protection of one's personal identity, and the ability to make choices without interference [4]. In relationship to the notion of physical seclusion, privacy is the right to a zone of personal space, and access to that space is controlled by the person who holds the right to it. Related to this right is the human instinct for modesty—the desire to protect one's intimate body parts (defined differently in various cultures) from being exposed against one's will, consent, or knowledge.

The concept of confidentiality is narrower in scope; it refers to the protection of personal information and, in the context of medicine, the duty not to disclose information that has been conveyed to the health care professional without the patient's approval. Confidentiality is synonymous with informational privacy. This article addresses issues of the physical privacy of patients and of the confidentiality of patients' personal information. Decisional privacy, the ability to make and act on one's personal choices (related to the bioethical principle of autonomy), is also an important concept in emergency medicine; it is addressed elsewhere in this issue in the article by Dr. Moskop entitled “Informed Consent and Refusal of Treatment: Challenges for Emergency Physicians.”

Foundations

Moral foundations and limits of privacy and confidentiality

The concept of human dignity has a long history in philosophy and ethics [5]. Simply stated, to respect human dignity is to recognize that human beings have special, intrinsic moral worth, and one should act with careful consideration for their interests, goals, and choices. Among the basic interests of individuals are control over one's physical environment, including protection from unwanted intrusion by others into one's personal space, and control over one's personal information, including protection of that information from unwanted disclosure to others. By protecting these basic human interests in physical privacy and confidentiality, physicians show respect for the dignity, autonomy, and well-being of their patients. The nearly universal recognition in medical oaths and codes of ethics of duties to protect patient privacy and confidentiality is a powerful indicator of the moral significance of these concepts.

Without a significant measure of control over their physical environment and their personal information, human beings would be severely hampered in their ability to make and act on important life decisions, such as the ability to make decisions about medical treatment for a major illness. By protecting physical privacy and confidentiality, physicians enable their patients to exercise meaningful personal autonomy.

Finally, open communication between patients and physicians is essential to an effective therapeutic relationship. Physicians need to know about patient health behaviors and symptoms and need to conduct intimate physical examinations to formulate accurate diagnoses and to provide effective therapy. To disclose sensitive and potentially embarrassing personal information and to permit intimate physical examination, patients must trust that their physicians will keep that information confidential and protect them from any unnecessary or inappropriate bodily exposure. The etymology of the English term confidentiality suggests this expectation because it is derived from the Latin word confidere, “to trust” [6]. By protecting physical privacy and confidentiality, physicians establish a relationship of trust that promotes effective therapy and maximizes patient well-being. This relationship of trust also encourages patients to seek health care, without fear or apprehension, when they need it.

Privacy and confidentiality are important moral values in health care, but they are not always the most important values. Instead, moral principles, practical exigencies, and legal rules typically recognize and dictate that, in specific circumstances, privacy or confidentiality may be overridden by even more important moral considerations. Protecting physical privacy and confidentiality are best understood as prima facie duties, that is, duties that must be honored unless there exists a stronger conflicting moral duty [7]. Duties that may conflict with respect for privacy or confidentiality include duties to act expeditiously to provide benefit and protect the patient from harm, to protect third parties, and to obey the law. When prima facie duties conflict in a particular situation, physicians may confront difficult moral judgments about which duty should take precedence; this results in the classic ethical dilemma. To reach a conclusion and resolve the dilemma, physicians must consider the reasons for and against alternative courses of action, such as the magnitude and probability of benefits and harms expected from the different alternatives, and choose the best overall course of action.

Religious foundations of privacy and confidentiality

Privacy is a paramount value in the Jewish tradition. In the Torah, Bilaam, an enemy prophet of the ancient Jewish people, on seeing a Jewish encampment from a hilltop perch declared, “How goodly are your tents, O Jacob!” (Numbers 24:5). The Talmud explains that the tents of the Jewish people are goodly because they are carefully arranged so that no looks into his neighbor's dwelling [8]. Jewish law asks people to avert their gaze if they see someone engaging in a private activity, even an innocent activity that is not being concealed. The Talmud is replete with even a construction code of sorts that includes specifications on how windows should be placed and how walls between neighbors should be built. Neighbors were to be as careful as possible not to look at each other's activities in their common courtyard.

The Old Testament Book of Genesis calls attention to the human instinct for modesty in some of its earliest verses (Genesis 3:10). Adam and Eve discovered their nakedness in the Garden of Eden and sought to shield themselves even from God. Orthodox Judaism also demands a strict dress code that emphasizes modesty.

Confidentiality is emphasized in Jewish law as well, as exemplified by laws that forbid gossip and by the biblical admonition, “Thou shalt not go up and down as a talebearer among the people.” Nondisclosure of private facts is also a requirement (described in numerous commentaries and regulations) as in the proscriptions against disclosing judicial deliberations or reading someone else's mail.

Christianity also emphasizes these values [9], as does Islam, which places a particularly high priority on modesty. Any tradition that respects life, liberty, and personal integrity should place a high value on privacy and confidentiality and should respect and honor modesty.

Legal rights and limits of privacy and confidentiality

Federal constitutional law

The US Constitution does not explicitly mention a right to privacy. Late in the nineteenth century, however, an influential and oft-cited law review article by Warren and Brandeis [10] argued that inherent in the Constitution was a fundamental right of privacy, a right to be left alone in one's person and property. The US Supreme Court eventually recognized the concept of the right of privacy in the mid-twentieth century, when the court inferred a right of privacy from the “penumbra” of other rights in the constitution (the 1st, 3rd, 4th, 5th, 9th, and 14th amendments) protecting persons and property from government intrusion [11]. This right of privacy was seen as limiting the ability of government to regulate medical choices, including reproduction. In this regard, the evolution of the constitutional right of privacy was curtailed late in the twentieth century when the court looked not to this right, but instead looked to the liberty interest of the 14th Amendment's due process clause to delineate the ability to refuse medical interventions [12].

In 1998, in Wilson v Lane [13], the Supreme Court ruled that a lawsuit for invasion of privacy could be brought against reporters who accompanied police into a suspect's home during the filming of a television show. This ruling could be relevant to intrusion cases involving commercial filming activities in emergency departments.

State confidentiality and privacy laws and legal sanctions for breach or disclosure

Because of their special role as patient fiduciaries, physicians possess highly personal information that their patients have entrusted to them. Physicians who disclose confidential information without permission to unauthorized individuals may be liable for the tort of breach of confidentiality. This tort is recognized as a breach of the special fiduciary role that physicians assume in caring for patients. Physicians have been held liable for breaches of confidentiality for unauthorized disclosure of patient information [14].

Not all disclosure of health care information is subsumed under the physician-patient relationship. If an unauthorized individual breaks into a physician's confidential files and obtains patient information, that individual would not be held liable for breach of confidentiality because the patient information was never given in confidence to that individual. Instead, the individual could be liable for the tort of invasion of privacy.

State common law and statutes have long recognized a tort of invasion of privacy [15]. The form of the tort of invasion of privacy that applies to medical privacy is that of intrusion on seclusion. One who intentionally intrudes on the private affairs or concerns of another may be liable for invasion of privacy, if the intrusion would be highly offensive to a reasonable person [16]. This tort may apply to situations such as filming a patient without the patient's permission.

Additionally, state statutes restrict access to medical records to individuals who need access to treat the patient and individuals who may need access for health care quality improvement or for regulatory purposes. These laws typically provide civil penalties for unauthorized access. State statutes also may give a higher degree of protection to certain kinds of medical information; examples include HIV test results, genetic test results, and mental health records.

There are also state regulations administered by licensing boards that judge breach of confidentiality as a professional violation subject to medical administrative sanctions. State laws have recognized confidentiality of information obtained in the medical encounter to be so important as to make an exception so that such information may be privileged, and a defendant may prevent a physician from testifying about the information in a court of law, the so-called testimonial privilege.

Federal statutory law—HIPAA

New federal privacy regulations authorized by HIPAA went into effect April 14, 2003. These regulations apply to all US practitioners and health care institutions that electronically transmit statutorily defined protected health information (PHI) [17]. They apply to virtually all US emergency physicians because of the electronically based modern emergency practice environment that includes patient registration, medical records, and billing systems.

PHI is defined as individually identifiable health information that is transmitted by or maintained in any other form or medium, and that relates to past, present, or future physical or mental health or conditions of an individual; the provision of health care to an individual; or the payment for the provision of health care [17]. PHI includes names and any information that identifies or reasonably could be believed to identify an individual, including unique identifying numbers, such as Social Security numbers, medical record numbers, and health plan numbers [18]. Items considered PHI are listed in Box 1.

Names

All geographic subdivisions smaller than a state, including street address, city, county, precinct, zip code and equivalent geocodes except for the initial 3 digits of a zip code if, according to current census data, the geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people, and the initial three digits of a zip code for all geographic units containing 20,000 or fewer people are changed to 000

All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death, and all ages over 89 and all elements of dates (including year) indicative of such age except that such ages and elements may be aggregated into a single category of age 90 or older

Telephone numbers

Fax numbers

Electronic mail addresses

Social Security numbers

Medical record numbers

Health plan beneficiary numbers

Account numbers

Certificate/license numbers

Vehicle identifiers and serial numbers, including license plate numbers

Device identifiers and serial numbers

Web Universal Resource Locator (URL)

Internet protocol address number

Biometric identifiers, including finger or voice prints

Full-face photographic images and any comparable images

Any other unique identifying number, characteristic or code

From Department of Health and Human Services. 45 CFR (Code of Federal Regulations), 164.514 (a) (b). Standards for Privacy of Individually Identifiable Health Information, 2002.

HIPAA requires practitioners and institutions to adopt and implement privacy policies and procedures, and to notify individual patients of their privacy rights, including information on how their information is used or disclosed [19]. Generally, HIPAA requires patient permission for information disclosure, although patient consent is not required for disclosure of personal health information for purposes of treatment, payment, and health care operations. HIPAA also provides exceptions to the requirement for patient consent for disclosures that are legally required, such as judicial or administrative proceedings, or as required by abuse, neglect, or domestic violence reporting; public health purposes; research; and worker's compensation proceedings.

For violations of HIPAA, sanctions for disclosures made in error range from $100 for each violation to a maximum of $25,000 per year. Criminal penalties for intentional or malicious disclosure range from $5000 to $250,000 and from 1 to 10 years imprisonment [20].

The practical effect of HIPAA in the emergency department has been to eliminate patient names and identifiers from easily viewed areas, such as patient wall rosters and status boards; to require passwords and the ability to audit access to patient information systems; and to require patient permission for disclosure of information to individuals who call to seek information about the patient. HIPAA regulations allow disclosure without patient consent when an emergency exists or the patient lacks decision-making capacity, and the physician determines that sharing information with a family member or other individual is in the best interest of the patient [21]. The HIPAA regulations are the most extensive and uniform standards affecting the privacy practices of emergency physicians, and they are expected to continue to influence the way emergency physicians use and transmit confidential patient information.

Legal limits of privacy—state statutes and common law

There are limits to the legal protection of confidentiality, including long-standing exceptions in state laws for the purpose of protecting the public health. This is true for infectious diseases, including sexually transmitted diseases. Patients diagnosed with tuberculosis, meningitis, or gonorrhea may have confidential information disclosed to state public health officials to warn others who may be at risk for these diseases as a result of patient contact.

Other state statutes require physicians to report confidential information to protect patients and the public from violence. Statutes require the reporting of patients who are suspected to be victims of child abuse and require or permit the reporting of domestic and elder abuse. Many states have statutes that require the reporting of gunshot wounds or wounds suspected to be the result of a violent crime.

State laws also provide for some special situations where traditional protections for confidentiality may be suspended, such as employees who submit for physical examinations for worker's compensation claims, where employees may not be able to restrict their employer from finding out information material to the purposes of the examination.

Even the testamentary privilege is not absolute. In some states, defendants cannot assert the testamentary privilege in homicide trials. These states have balanced the need to protect patient confidentiality against the countervailing values of societal protection and criminal punishment for capital crimes.

The duty to protect individuals at risk for infectious disease was extended to a duty to protect individuals from other risks of patients in the landmark Tarasoff case [22]. In this case, a psychiatrist was found liable for not warning a woman who was at risk of harm from the psychiatrist's patient and was ultimately killed by the patient. The court held that the duty of confidentiality ends where public peril begins. The duty to warn, later expanded to the duty to protect, extends to “third parties,” individuals who are not the physician's patient. The physician is now recognized to owe a duty to such third parties who may be at risk from the physician's patient. Many state courts have adopted the Tarasoff reasoning. The challenge for the emergency physician is to protect patient confidentiality while balancing the duty to protect the public and to warn and protect third parties at risk.

Clinical considerations and applications

Design

Today, many emergency departments are vestiges of a recent time when emergency medicine did not even exist as a unique specialty. In the 1970s, “emergency rooms” arose out of hospital “receiving wards,” where unsophisticated and ill-equipped ambulances or police cars delivered sick and injured patients to large spaces (or wards), separated by curtains, to be cared for by interns with little experience or training. In those days, even much inpatient care was delivered in large wards (multiple bays, sometimes separated by curtains) rather than in semiprivate or private rooms. As a result of this history, the spaces in which emergency department care is being provided in many hospitals in the twenty-first century do not reflect any real planning for current patient needs or any semblance of respect for privacy.

Newly designed emergency departments should address the privacy needs of patients just as elsewhere in the hospital. Because real estate is an expensive or limited commodity in most locations, there may be a temptation to sacrifice privacy to meet other goals, such as maximizing the number of beds or for ancillary needs. Difficult choices may arise in designing emergency departments, and practical solutions should balance all needs as equitably as possible. It would do no good to maximize the number of private rooms if one knows a priori that this would result in other patients being cared for in hallways. A multipatient bay out of public view would be preferable. Even when space is readily available, the nature of emergency department care requires that at least some patients—the most acutely ill—need to be in a space where staff can see them easily. A special problem arises in the triage area, where patients need to give their medical history privately, but the triage nurse also may need to watch for other patients who are arriving. By its nature, the waiting room may compromise confidentiality, especially for well-known individuals; dividing the waiting room into various sections may help mitigate this.

Optimal design includes a maximum number of individual treatment rooms, usually arrayed around a central nurses' station. One effective design uses rooms with three solid walls and a fourth wall comprising sliding glass doors [23]. This design maximizes acoustic and visual privacy (a curtain can be pulled behind the doors for privacy to achieve the latter). Rooms should be large enough to accommodate at least one seated visitor. Trauma bays, which may be designed to treat more than one patient, should have curtains to separate the gurneys and to avoid exposure of an unclad patient to individuals who are not involved in the trauma resuscitation (eg, police, visitors).

Many emergency departments in the United States are experiencing overcrowding, often as a result of inadequate inpatient capacity, especially monitored beds. When overcrowding occurs, there may be no alternative other than to board multiple patients in the same bay or to place patients in hallways, where they may have to wait for long periods. Under these circumstances, movable privacy screens should be deployed as often as possible, especially when performing procedures, such as electrocardiograms [24]. Other measures—some as simple as positioning of gurneys that must be in hallways so as not to face each other—also should be taken to minimize unnecessary exposure.

It may take years, if ever, for institutions to build adequate emergency department and inpatient capacity to relieve the current crowding. The situation is likely to get worse as financially weak hospitals close their emergency departments or entire facilities, and the population grows and ages. Individual physicians can help relieve this problem by being efficient, using resources including time-consuming diagnostic procedures judiciously, and minimizing other wait times when possible.

Observers

In many institutions, students may appropriately observe and learn in the emergency department environment. Observation of and participation in clinical care are essential aspects of medical education. Because the presence of students in the emergency department serves socially valuable educational functions, most institutions consider general consent to treatment in a teaching institution sufficient to constitute consent to treatment and observation by students. Often acknowledgment of this consent is buried somewhere in the “conditions of admission” forms patients sign during registration. Some authors have stated that explicit consent should be obtained from patients for the presence of students [25]. Most patients agree to the participation of students in their own medical care despite potential threats to their privacy [26], [27], [28], [29], [30]. When possible, patients should be informed of the identity and role of all caregivers, including residents, interns, and students. Although consideration should be given to patient requests that students not participate in their care, it need not be guaranteed that such requests be honored. Decisions should be based on practicality and reasons for the request.

Others sometimes may request permission to observe care in the emergency department. Some examples of other potential observers include high school students considering health careers, chaplains, pharmaceutical representatives, journalists, and actors. Whether or not these individuals should have access to the treatment area at all is open to question because the potential for breech of privacy is inherent in the design of any emergency department. In general, the greater the potential benefit to society, the more lenient in granting permission one can be. By this standard, permitting actors or pharmaceutical representatives to observe in the emergency department is probably not justified. For observers who do not play a role in medical care, the patient's consent should be obtained. For patients unable to consent, a “reasonable person” test may be used to determine whether it is morally permissible for an observer to be present by asking the question, “Would a (hypothetical) reasonable person object to the presence of the observer?”

Visitors

Visitors may provide important comfort and support to patients in the emergency department. It also should be recognized, however, that certain visitors may be unwelcome to the patient. Emergency physicians should allow visitors into patient care areas only with the permission of the patient, although there is a reasonable assumption of consent when a patient arrives accompanied by a friend or family member. For patients unable to consent, a surrogate ideally should give permission before allowing visitors, although common sense should prevail. Next of kin generally are allowed to see uncommunicative patients by reasonable request and after proper identification. While in the clinical area, visitors should be instructed to remain in the room with (or at the hallway bedside of) the patient they are visiting. Visitors should be restricted from unauthorized areas of the emergency department, where they inappropriately may observe other patients or PHI [24].

Law enforcement

Law enforcement officials at times are appropriately present in clinical areas. They may be present in the emergency department by staff request to provide physical protection to emergency department staff, patients, and visitors from a potentially violent patient or visitor. Law enforcement officials also may transport injured or ill patients to the emergency department from the scene of an accident or crime. They may play a role in the collection of forensic evidence, interviews, or other aspects of investigation of a potential crime. Each of these activities may justify the presence of law enforcement officials in the emergency department, yet also may threaten the privacy of emergency department patients. Unless acting under legal mandates (eg, court orders), law enforcement officials generally should visit or observe emergency department patients only with their permission [31]. Law enforcement activities should not be allowed to interfere with patient care. As with other visitors, law enforcement officials should not be allowed unauthorized access to PHI of other emergency department patients.

Commercial filming and videotaping

The issue of the commercial filming of patients in hospitals has come to the fore as a result of the proliferation of reality television shows that are based on this practice [32], [33], [34], [35], [36], [37], [38], [39], [40]. Emergency medicine and its practitioners have been in the vanguard with regard to participation in these programs and efforts to regulate and control them. Controversy exists as to the acceptability of filming patients in the emergency department in critical situations or without their permission, although the preponderance of opinion now seems to be against this practice.

Commercial filming usually, but not always, is for programs that fall into the reality television category, which aim to capture the drama and terror associated with patients who arrive in the emergency department during life-threatening or limb-threatening injuries or illnesses, or with sensational or gory presentations (eg, a limb that has been caught in a cement mixer). Some authors have called into question the appropriateness of even approaching such patients for permission to be filmed [32], [40]. Even if the patient does consent, the validity of consent and whether it can be considered informed under such circumstances is suspect. Emergency department patients also may feel obliged to consent and may be subject to coercion by television personnel who are bound by a different sense of duty and ethics than are physicians.

Some producers, with the permission of participating hospitals, have adopted the practice of filming patients before obtaining permission but not broadcasting the film unless the patient subsequently grants permission. Critics of this approach point out that by the time the patient is asked to grant consent (or refuse), their privacy already has been violated by the presence of the film crew within an area where the patient has a “reasonable expectation” of privacy [32]. In addition, there are no assurances that others would not view the film or that it would not otherwise be misused in the future.

Proponents who defend the practice of filming emergency department patients in the foregoing fashion argue that these shows serve an educational role and help demystify medical care [34]. They also argue cynically that privacy and confidentiality are routinely violated in the emergency department, and filming simply can be viewed as an extension of this practice and is acceptable.

In more recent years, medical societies and regulatory bodies have taken positions that recommend sharp curtailment or elimination of commercial filming in emergency departments. The American College of Emergency Physicians (ACEP) policy states that “ACEP discourages the filming of television programs in emergency departments except when patients and staff members can give fully informed consent before their participation” [41]. The Society for Academic Emergency Medicine (SAEM) takes a stronger stand, saying, “Image recording by commercial entities does not provide benefit to the patient and should not occur in either the out-of-the-hospital or emergency department setting” [42]. An American Medical Association (AMA) Code of Ethics opinion also requires prior consent of the patient for filming except when the patient is “permanently or indefinitely incompetent” [43]. A 2004 Joint Commission on Accreditation of Healthcare Organizations standard requires that “consent is obtained for recordings or filming made for purposes other than the identification, diagnosis, or treatment of the patients” [44]. Finally, lawsuits may have a chilling effect on commercial filming in emergency departments, as several hospitals and producers have been sued for invasion of privacy in relationship to such filming.

Mandatory reporting

Mandatory reporting laws require health care providers to report specific confidential information to governmental agencies or authorities. Mandatory reporting laws exist to cover the following types of circumstances: (1) to protect a patient from further harm caused by a perpetrator; (2) to protect members of the general public from harm by a violent/criminal act, an accidental injury, or a communicable disease; (3) to help law enforcement solve crimes or prevent future crimes; or (4) for epidemiologic and statistical purposes.

Mandatory reporting of criminal acts in an attempt to protect other potential victims is noncontroversial in most cases, especially for extremely violent acts or when there is a specific threat. Disclosure to law enforcement officials is permissible under certain circumstances, including in response to legal orders, such as court orders, warrants, or subpoenas, to assist in the identification or location of a suspect, fugitive, witness, or missing person, or when responding to a law enforcement official's request for information about a crime victim. Disclosure also is permissible and sometimes required when a person's death may be the result of criminal activity, when PHI may be evidence of a crime that occurred on hospital property, or when necessary to inform officials about the nature of a crime or the location of victims or the perpetrator [45].

Reporting of infectious diseases and various types of injuries or deaths has historical precedence and in most cases, is noncontroversial. The Centers for Disease Control and Prevention maintains a Public Health Information Network, which contains data regarding national reportable conditions. National reportable infectious conditions are listed in Box 2. States regulate the reporting of certain conditions to public health officials. Although there is some variation in conditions that mandate reporting, certain conditions are commonly recognized as reportable conditions. Examples of widely recognized reportable conditions include traffic crashes, penetrating trauma, residential fires, occupational injuries, suicide, falls, poisoning, and drowning. Although these disclosures may be considered breaches of physician-patient confidentiality, they may honor duties to maintain public health and the safety and protection of other individuals and groups.

AIDS

Anthrax

Arboviral neuroinvasive and non-neuroinvasive diseases

Botulism

Brucellosis

Chancroid

Chlamydia trachomatis, genital infections

Cholera

Coccidioidomycosis

Cryptosporidiosis

Cyclosporiasis

Diphtheria

Ehrlichiosis

Enterohemorrhagic Escherichia coli

Giardiasis

Gonorrhea

Haemophilus influenzae, invasive disease

Hansen's disease (leprosy)

Hantavirus pulmonary syndrome

Hemolytic uremic syndrome, postdiarrheal

Hepatitis, viral, acute

Hepatitis, viral, chronic

HIV infection

Influenza-associated pediatric mortality

Legionellosis

Listeriosis

Lyme disease

Malaria

Measles

Meningococcal disease

Mumps

Pertussis

Plague

Poliomyelitis, paralytic

Psittacosis

Q fever

Rabies

Rocky Mountain spotted fever

Rubella

Rubella, congenital syndrome

Salmonellosis

Severe acute respiratory syndrome–associated coronavirus (SARS-CoV) disease

Shigellosis

Smallpox

Streptococcal disease, invasive, group A

Streptococcal toxic shock syndrome

Streptococcus pneumoniae, drug-resistant, invasive disease

S pneumoniae, invasive in children <5 years old

Syphilis

Tetanus

Toxic shock syndrome

Trichinellosis (trichinosis)

Tuberculosis

Tularemia

Typhoid fever

Vancomycin-intermediate Staphylococcus aureus

Vancomycin-resistant S aureus

Varicella (morbidity)

Varicella (deaths only)

Yellow fever

From Centers for Disease Control. Nationally Notifiable Infectious Diseases, United States, 2005. Available at http://www.cdc.gov/epo/dphsi/PHS/infdis2005.htm. Accessed April 16, 2005.

Mandatory reporting of certain types of suspected abuse is morally justified and widely accepted in the United States. Examples include elder abuse and child abuse, both of which involve vulnerable individuals who are not in a position to defend themselves. In these cases, adopting a paternal stance (ie, acting in loco parentis) rather than honoring autonomy is appropriate and justified to prevent harm.

Laws mandating the reporting of seizures and domestic violence engender more controversy [46], [47], [48]. The ethical dilemma in both situations is whether it is acceptable to breach the confidentiality of patients who do not want these conditions reported in an effort to prevent harm to them or other members of society. Proponents of reporting domestic violence, which is mandatory in a few states, believe that it is justified to stop this scourge and to protect vulnerable victims—either the one in question or a potential different future victim. Proponents who argue for mandatory reporting of seizures do so to limit the dangers of someone having an automobile accident as the result of a seizure, causing serious injuries or death to themselves or others. An argument in common against reporting in both of these situations is that they may discourage people from seeking care when they need it or not being open and honest about their conditions if they do [46]. In the case of domestic violence, victims may fear or actually experience retaliation from abusers. Other unwanted consequences could be family separation, loss of a job, deportation, or other outcomes that may be less acceptable than solutions that could be worked out without police involvement. In the case of seizures, critics of mandatory reporting argue that the risk of having an accident above baseline is minimal, and that the loss of driving privileges that can follow reporting can have severe consequences on someone's life, such as compromised ability to work, loss of independence, social isolation, limited participation in the community, and diminished self-worth [48]. At present, there is no consensus in the ethics community over these two issues. The ACEP has issued a policy statement opposing mandatory reporting laws for domestic violence.

Duty to warn

As previously stated, physicians have a duty to warn individuals or groups when information indicates that they are at significant risk of harm posed by a patient. This duty to warn has been upheld in multiple cases by US courts. National policies including those written by the AMA and ACEP and language in HIPAA also recognize that disclosure of PHI may be appropriate in cases in which there is a potential threat to the public or to an individual [49], [50], [51], [52]. This may include disclosure to individuals or law enforcement officials [53]. Based on the authors' collective experience, this duty to warn seldom applies in the emergency department setting, however. A rare example is the patient described in this article's introduction, the airline pilot who had altered his prescription for a controlled substance. In this case, involving law enforcement is morally justified.

Communication

Requests for information

Emergency physicians frequently receive requests for patient information. Such requests may be from interested parties by telephone, e-mail, or in person. Such inquiries for patient information raise important questions regarding confidentiality. The most important task in such situations is to obtain permission from the patient to disclose information. If patients are agreeable to such disclosures, physicians are permitted to release information. Ideally, the identity of the inquiring individual should be confirmed. Institutions should maintain policies for responding to inquiries, including mechanisms for obtaining patient consent for release of information and for ascertaining the identity of the caller (eg, by returning a telephone call) [54], [55]. Unless the caller's identity is established, and the patient or a surrogate gives consent for release of information, telephone inquiries for individual patient information generally should not be honored. Occasionally, the limited release of information over the telephone may be justified (eg, relatives may be entitled to basic information about loved ones who are unable to communicate, when travel to the emergency department is not possible). In these cases, the “patient's best interest” standard should be applied. Even in such unusual circumstances, efforts should be made to identify the caller and to release only essential information.

Requests for patient information from the media may be encountered. Generally, media requests should be handled by the hospital's public relations department, who should divulge information only with patient permission. Some institutions confirm that a particular patient has been transported to the hospital and may provide information about the patient's general condition (eg, “critical,” “stable”). Patient permission for release of this information should be obtained when possible. Inquiries by law enforcement officials should be handled in accordance with legal requirements.

Communication among health care providers

Communication within the emergency department, although essential, increases the risk of breaches of patient confidentiality. This increased risk often begins in the waiting room, where patients may be interviewed by the triage nurse within auditory range of others, or when waiting patients or family members are called by name to be brought back to the treatment area. Confidentiality also may be compromised accidentally when patients are discussed by name in open spaces in the emergency department or when caregivers are on the telephone. Care must be taken to avoid this accidental compromise of confidentiality. It is also important that charts and other written materials are not left out in the open, where visitors can see them. White grease boards, or “status boards,” that display the names of patients and their chief complaints to keep track of them, previously a common staple in emergency departments, are no longer allowable. In many departments, these have been replaced by computerized tracking systems that serve the same purpose. These tracking systems need to be situated so as not to be visible to the public and should have log-on and time-out features.

Communication with health care providers outside of the emergency department, when necessary, is permitted and even essential. An obvious example would be conversations with the patient's physician, consultants, or residents. Such communication should occur in appropriate secure settings and not in open spaces such as hallways, dining areas, stairwells, or elevators [56]. Conveying patient-specific information (or dictating charts) over the telephone should be done in a secure space where the conversation cannot be overheard.

Conveying information that is nonessential or to individuals without a need to know is not permissible. In emergency medicine, there is often an urge to discuss cases involving well-known figures or sensational stories with colleagues, friends, or relatives. Such discussion is legally and morally wrong. It is also important not to discuss the care of hospital employees with supervisors or other employees within the hospital without the patient's permission.

Habitual patient files

It is a long-standing and common practice for emergency departments to keep files of patients who are suspected of seeking drugs—most often opiates or benzodiazepines—for nontherapeutic purposes, including recreation, abuse, or resale [57]. Such files have been termed habitual patient files (HPFs). Less appropriate and in some cases pejorative terms for these files include “frequent flyer files,” “repeater files,” “turkey files,” “kook books,” and “special needs files.” Despite the facts that some think it is unwise to maintain such files, and their efficacy in altering patient behavior has never been established, their common use mandates an examination of the confidentiality issues arising from their existence.

In the event that a decision is made to establish and maintain an HPF in a particular department (a decision that should be made or sanctioned by the Chair and others in authority), emergency physicians should be familiar with state and federal laws that regulate their use. It is recommended further that a hospital or other health care attorney with expertise in confidentiality issues should be consulted to ensure that a particular process conforms to these laws.

HPFs are permissible and may be justified if the goals of using them include protecting patients from harm as the result of drug abuse, preventing the inappropriate use of valuable emergency department resources, or protecting society from harms caused by the resale of ill-gotten drugs or the actions of intoxicated individuals [24]. HPFs also may contain specific treatment plans, usually worked out in advance with managing physicians, for patients with chronic pain conditions. Such plans may contain instructions as to which drugs are permissible or not permissible to use or have other details of “contracts” worked out with patients and their pain managers.

Under HIPAA and other regulations, it is permissible for physicians to share PHI with other physicians for the purposes of treatment. Other members of the health care team also may be permitted access to patient information on a need-to-know basis. In general, such sharing should occur within a single institution. PHI should not be shared between institutions via the telephone or other means. Inappropriate release of information contained in HPFs could result in fines or other penalties.

HPFs should be kept in a secure location, preferably locked, and should be viewed in private. Access should be limited to authorized personnel who have a need to know, and browsing of the file should not be permitted. One of the authors has previously described an electronic HPF (stored on a server) with password protection and the ability to access the files from many sites within a single department [57].

Electronic communication devices

Telephone answering machines, fax machines, personal computers, e-mail, personal digital assistants, and cell phones all present challenges to confidentiality. Telephone messages regarding culture results, addenda, or other information should not be left on answering machines, which may be accessed by others. The patient should be asked to call back and should be able to identify himself or herself with appropriate information when calling back. Also, to ensure adequate privacy and that a patient feels comfortable conversing, speaker phones should not be used by either party unless mutually agreed on during the call.

Fax machines also pose risks. A fax should be sent only when one is reasonably sure that it will be received in a secure location by an authorized party. Departmental fax machines that receive faxes also must be kept in a secure location. If reports are periodically automatically faxed or e-mailed to patients' private physicians, databases must be maintained to be sure contact information is kept up to date.

When information containing PHI is sent via a personal computer, personal digital assistant, or e-mail, it must be encrypted if it passes beyond a secure firewall. All devices should be set to require a password to log on and should time-out when not in use.

Cell phones offer busy emergency physicians the ability to communicate more efficiently and can reduce the amount of walking during a busy shift. Care must be taken, however, not to discuss patients by name when not in a private location. Cell phones with concealed digital cameras in them present risks to privacy and confidentiality. Use of these devices by patients or staff to record a patient's images or information about them, especially covertly, is unethical. It may be useful to post signs forbidding the use of these devices for these purposes in the emergency department waiting room and treatment areas.

Research and education

Research

Research often requires the use of PHI. The use of PHI for research and educational purposes is restricted, however, by HIPAA. If PHI can be deidentified, specific written consent is unnecessary for the use of such information. If the use of PHI is necessary, specific written consent for research use should be obtained. In certain sensitive research areas, such as genetics, a certificate of confidentiality may be a useful tool to relieve researchers from any obligation to release identifying information about research subjects [58]. Various techniques for unlinking research records from identifying information have been used successfully to protect privacy of research subjects [59].

Noncommercial photography

Patient images may serve valid and useful functions in research and education. Images may be used to contribute to documentation, diagnostic tests, treatment, and quality assessment; for education of health professionals and the public; and for research purposes. Each of these uses has different objectives and slightly different standards for consent for use.

Images used for documentation of medical care may contribute directly to patient welfare. Standard institutional measures to protect the medical record from inappropriate access should be sufficient to protect the confidentiality of such images. The use of teleradiology has raised important issues about privacy and security issues. The use of PHI in this setting must conform to HIPAA standards, including appropriate encryption of data and security standards for access to PHI [60].

Patient images also may be used for quality improvement and medical education, such as the practice in some emergency departments of videotaping trauma resuscitations [61], [62], [63], [64], [65]. Although such images may be valuable to improving patient care, the patients taped typically do not benefit directly from their own taping and may be unable to consent to the taping. Most institutions consider the use of such images for educational purposes to be acceptable, however, provided that only health professionals directly involved in the practices under analysis and in the quality assessment process have access to these images. The HIPAA privacy rule does not require specific patient authorization for using patient information for quality improvement purposes. Some institutions have chosen to provide general notification of such practices, such as signs posted in the emergency department or information in general patient consent documents.

Several organizations have developed policies to provide guidance regarding the use of patient images. A policy developed by the AMA asserts that “informed consent should be obtained before filming whenever possible. If it is not possible to obtain consent from the patient before filming, then consent must be obtained before the film is used for educational purposes” [66]. This AMA policy allows surrogate consent for the use of a film only in the case of minor children or permanently incompetent adults. This policy does not specify whether patient consent should be written or verbal. A position statement by the SAEM states, “Image recording should undergo a dual consent process. The first addresses privacy issues associated with the actual recording of the image. The second addresses confidentiality issues associated with distribution and use of those images” [67]. The International Committee of Medical Journal Editors has stated that “identifying information should not be published in written descriptions, photographs, or pedigrees unless the information is essential for scientific purposes and the patient (or parent or guardian) gives written informed consent for publication” [68].

Special populations

Emergency physicians often treat patients who are unable to protect their own interests, including children, patients with mental and physical impairments, prisoners, and dying patients. These patients entrust themselves, or are entrusted by others, to the care of emergency physicians, and physicians have a duty to act in their best interests, including safeguarding their privacy and confidentiality.

A limited exception to confidentiality applies to patients who lack decision-making capacity. In caring for these patients, physicians must share information with the patient's legally authorized surrogate to obtain consent for treatment. Emergency physicians also have a responsibility to inform family members of patients who die in the emergency department about the patient's condition and treatment and to report appropriate information about the death to the proper legal authorities. For all of these patients, physicians should guard against disclosure of information to unauthorized persons.

Patients in particular dependency relationships, such as students or prisoners, also merit special protections because they may be unwilling or unable to speak up to protect themselves. This situation may present special problems when these patients are asked for permission to violate their privacy (eg, via photography) or to disclose personal information. Unless there is a compelling reason to do so that is in the patients' own best interest, they should not even be approached for permission.

Addressing the confidentiality requests of adolescent patients can raise difficult questions for emergency physicians. Adolescents may ask that their parents not be informed about their medical condition or treatment. Unless the patient is legally emancipated, however, parental consent for treatment may be required. Many states allow minors to consent to treatment for specific conditions, including pregnancy, sexually transmitted diseases, and substance abuse. In such circumstances, physicians may be required to keep confidentiality, unless they conclude that disclosure is necessary to prevent serious harm to the patient.

Summary

Ensuring and preserving patients' privacy, confidentiality, and modesty are long-standing professional obligations of physicians rooted in tradition, religion, ethics, law, and philosophy. At their core, the philosophical underpinnings of these obligations are the recognition of the dignity and worth of patients as individuals and the inherent right of human beings to control their own affairs. Despite the structural problems in carrying out these duties in the crowded, rushed, and often open environment of the emergency department, emergency personnel should strive to do so.

These duties are not absolute, and physicians and other heath care professionals should understand when it is acceptable, and even desirable, to override them because of conflicting, greater duties. In the final analysis, however, circumstances requiring a breach of confidentiality are rare, and circumstances justifying the invasion of physical privacy are even rarer.