Are curtained dividers a setup for a lawsuit?
Caring for patients with little privacy other than thin curtains in a crowded emergency department seems to fly in the face of the requirements of the Health Insurance Portability and Accountability Act (HIPAA). But what are the actual liability risks of this practice?
A patient cannot bring a lawsuit directly under HIPAA, because the federal statute does not provide for a private right of action. "Because of this, even if the person believes that the provider has violated HIPAA, the person would still need to bring the claim under state law," says Helen Oscislawski, JD, a health care attorney at the Lawrenceville, NJ, office of Fox Rothschild, who has substantial experience with HIPAA compliance.
Complaints go to HHS
Under HIPAA, patients are able to submit their complaints alleging that a violation has occurred to the U. S. Department of Health and Human Services (HHS) Office of Civil Rights. Otherwise, the patient would need to look to state law to see if there is an actionable complaint, since standards vary by state as to what is "actionable" and what is not. "I have yet to hear of a case where overheard comments through dividers amounted to a breach of duty, but that is not to say that such a case has never been filed or may never be filed," Oscislawski says.
In fact, there have been a recent smattering of cases with plaintiffs bringing lawsuits based on state law claims for negligence, and they have successfully argued that the failure to adhere to a HIPAA standard is evidence that the provider breached its duty to keep a patient's information confidential, she says. "This makes proving negligence a lot easier," Oscislawski says.
Jeffrey Freeman, MD, clinical assistant professor of the Department of Emergency Medicine at University of Michigan Health System in Ann Arbor, says, "Although curtains may present a visual barrier, and we all know that this is no more guaranteed than the typical hospital gown, they provide minimal barrier to sound."
In fact, the perception that there is a barrier may increase the likelihood of conversations or private information being overheard, adds Freeman. Patients may be reluctant to provide medical information or undergo physical examinations, and physicians may be reluctant to be complete due to privacy concerns, he adds. In addition, privacy curtains often are used in areas that otherwise would not be considered rooms, including hallways and alcoves.
There have been a few, limited studies on the effects of privacy barriers in the emergency department, notes Freeman.1-3 "These studies confirm that patients feel their conversations are overheard when privacy curtains are the barriers between patients," Freeman says. A small percentage of patients withhold medical information or refuse part of the physical examination because of privacy concerns, according to the research.
"Although patients often perceive that their privacy is being respected with curtains, we know in fact that occasional oversights occur and personal information and privacy is not ensured," says Freeman. "This is more likely to occur in larger or crowded institutions, where chaos and larger numbers of staff, trainees, and visitors increase the chance of privacy blunders." For example, in large, busy EDs, it is not unusual for patients to be boarded next to nursing and physician stations behind curtains. "Although this may improve supervision of patients, it also virtually ensures that conversations can be overheard," says Freeman.
Although Freeman says he is not aware of specific legal suits that have arisen directly from these issues, he points to the potential for state civil penalties for breaches of privacy, administrative sanctions from licensing boards, and federal penalties for violation of HIPAA. "These could include monetary and criminal penalties," says Freeman. "Poor patient satisfaction with privacy and confidentiality also may increase the likelihood of action if medical negligence also is perceived."
Take 'reasonable' steps
Under HIPAA, "incidental disclosures," such as those that occur when two patients are in adjacent rooms or cubicles, do not automatically amount to a privacy violation. "However, if reasonable steps could have been taken to minimize the chances of the incidental disclosure from occurring, then the ED group or hospital may be at a greater risk that they could be subjected to lawsuit if the wrong set of facts were to unfold," Oscislawski says.
An example of "bad facts" would be an ED patient told of a new positive test for a sexually transmitted disease (STD) while another patient, or person visiting another patient, happens to overhear the information and also happens to know the patient's spouse well. "If that information is then communicated back to the spouse by the person who 'incidentally' overheard the STD diagnosis, you can imagine how that situation can go from bad to much worse for the patient as a result of his or her privacy not being adequately protected," says Oscislawski. "These kinds of facts set the ED up for potential lawsuits."
For a typical ED, what would be considered "reasonable steps" to prevent patients from overhearing protected health information (PHI)? "Almost anything that the provider can implement as an attempt to minimize incidental disclosures is fair game," says Oscislawski. "Room dividers are tough. Absent major construction, there is not a lot you can really do to diminish this without significantly interrupting the ED workflow."
The guidance from the Department of Health and Human Services on HIPAA is that physical safeguards to protect PHI must be "reasonable" and "appropriate," she notes. "The guidance also specifically says that the HIPAA privacy rule does not require private rooms nor soundproofing of rooms," she says.
Curtained room dividers in an ED would be considered "reasonable and appropriate," Oscislawski says. In addition, if the department is not too busy, the triage nurse may consider putting patients at the farthest point in the ED away from each other, until that becomes impossible due to capacity being filled up. "However, the reality is, as we know, EDs are generally maxed out, overcrowded, and do not have this luxury," Oscislawski says. "Thus, the only other answer would be to put up more solid barriers. Yet, this is not mandatory if it is not cost-effective for the hospital."
Consider using thicker curtains, Plexiglas or similar auditory barriers, or sliding glass doors that improve auditory barriers while allowing visual oversight, suggests Freeman. "Specific rooms may be designated for private conversations or examination, moving patients in and out temporarily as needed," he adds.
HIV status is higher risk
As for what EDs could possibly be sued for, any situation is a potential risk because people have individual thresholds for what they are willing to consider a privacy breach, Oscislawski says. "That said, I would think that cases where there is sensitive information being discussed, like an STD, drug test results, HIV status, and communicable diseases, tend to have a higher risk because of the potential implication to that patient if such highly sensitive information were to be overheard by the wrong person," she adds.
Sheila M. Sokolowski, JD, a health care attorney with Fulbright & Jaworski in Austin, TX, says, "Generally, an individual would have to sustain some sort of harm in order to sue, but it is not clear what harm might be sustained from simply another overhearing private information."
On the other hand, in Texas and several other states, HIV test results have greater protection than other types of health information, she notes. "So if HIV status is what is at issue in Texas, there is no need to show harm to recover an award from a person who unlawfully disclosed that information, though if harm is shown, actual damages could also be awarded," Sokolowski says. "As for disclosures of other types of health care information, the individual might be able to maintain an action for defamation, but truth is a complete defense to defamation."
If ED nurses or physicians speak too loudly when there is a lack of privacy, this generally would be considered an incidental disclosure, Oscislawski says. "However, as noted above, under HIPAA ED physicians and other staff must take reasonable precautions to minimize such incidental disclosures," Oscislawski says "Therefore, staff should be reminded not to yell and to be careful in particular when highly sensitive information is involved."
- Barlas D, Sama AE, Ward MF, et al. Comparison of the auditory and visual privacy of emergency department treatment areas with curtains versus those with solid walls. Ann Emerg Med 2001; 38:135-139.
- Mlinek EJ, Pierce J. Confidentiality and privacy breaches in a university hospital emergency department. Acad Emerg Med 1997; 4:1,142-1,146.
- Moskop JC, Marco CA, Larkin GL, et al. From Hippocrates to HIPAA: Privacy and confidentiality in emergency medicine — Part II: Challenges in the emergency department. Ann Emerg Med 2005; 45:60-67.
For more information, contact:
- Jeffrey Freeman, MD, Clinical Assistant Professor, Department of Emergency Medicine, University of Michigan Health System, Alfred Taubman Health Care Center, 1500 E. Medical Center Drive, Room B1 354, Ann Arbor, MI 48109-0303. Phone: (734) 615-2765. Fax: (734) 936-9414. E-mail: firstname.lastname@example.org.
- Helen Oscislawski, JD, Fox Rothschild, Princeton Pike Corporate Center, 997 Lenox Drive, Building 3, Lawrenceville, NJ 08648-2311. Phone: (609) 895-3310. Fax: (609) 896-1469. E-mail: HOscislawski@foxrothschild.com.
- Sheila M. Sokolowski, JD, Fulbright & Jaworski, 600 Congress Ave., Suite 2400, Austin, TX 78701. Phone: (512) 536-5271. Fax: (512) 536-4598. E-mail: email@example.com.