The privilege of privacy must be maintained even when it does not seem intrinsically obvious. A patient’s family, friend, or spiritual guide, for example, has no right to medical information regarding the patient unless the patient specifically approves it, except if the patient is unable to provide that guidance because of their medical circumstance. In that circumstance, health providers must exercise their judgment based on their assessment of the involvement of that particular person with the patient’s health. This may seem obvious but often can be overlooked, such as when a health care giver receives a call from a concerned relative inquiring about the status of a patient. The response may be a natural attempt to reassure and inform a caring individual about the patient’s status. However, for her own reasons, the patient may not want certain individuals informed of her medical condition. Thus, confidentiality has been breached. It is wise to ask patients about who may be involved in decision making and who may be informed about their status. If a health care giver is unclear of the patient’s wishes regarding the person requesting information, the reply should indicate that the patient’s permission is necessary before discussing her status.When trying to contact patients for follow-up of medical findings, it is never appropriate to reveal the reason for contact to an individual other than the patient.
Record Keeping Health care professionals are part of record-keeping organizations. Those records are used for multiple purposes in medicine and are a valuable tool in patient care. There is an increasing tendency for ancillary organizations to collect, maintain, and disclose information about individuals with whom they have no direct connection (13). Health care professionals must be aware of this practice and its ramifications. Patients sign a document, often without understanding its meaning, upon registering with a health care institution or insurance plan. That document waives the patient’s privilege to suppress access and gives insurers, and often other health care providers who request it, access to the medical record. The consequences of such disclosure for patients can be significant in terms of insurance coverage and potential job discrimination (14). Even with health care reform, this continues to be a concern because individuals may have shifts in the pools of insurance available to them and the costs may vary. This concern must be weighed against the need for all health care providers involved with an individual to be informed about past or present diseases or activities that may interfere with or complicate management. The use of illegal drugs, a positive HIV test result, and even a history of cancer or psychiatric illness are all exceptionally important to health care providers in evaluating individual patients. When revealed to outside institutions, these factors may affect the patient’s ability to obtain medical care, insurance, or even credit. Everything that is written in a patient’s record should be important to the medical care of that patient, and extrinsic information should be avoided.
It is appropriate for physicians to discuss with patients the nature of medical records and their release to other parties so that patients can make an informed choice about such release.
The Health Insurance Portability and Accountability Act (HIPAA) was enacted in 1996 and the effective compliance of the “privacy rule” was instituted in April 2003, and this rule imposed additional requirements for access to patient records for clinical research and guidelines for protecting electronic medical records. Although the intent of the act was laudable, the extent to which privacy will be improved is unknown, and the potential harm to the public from failure to do critical database research because of its costly requirements may be greater than any benefit. The considerable confusion and misunderstanding of the rules associated with the act are potentially harmful to patients. The exceptions from the requirement to obtain patient authorization to share health information include areas such as patient treatment, payment, operations (quality improvement, quality assurance, and education), disclosure to public health officials and health oversight agencies, and legal requirements (15). One widely misunderstood feature of the act was whether protected health information could be sent via fax, e-mail or mail to another treating physician (which is allowed) (16). It is important that researchers understand the inﬂuence of these rules in all settings; preplanning for clinical database research to include consent for research database efforts when the patient first enters the office or institution will make this critical research possible (17). The security of medical records is a concern not just for individual patients and physicians but also for health systems and researchers.