Hospital Patient Confidentiality: Security Breach Management Plan

Introduction: The Confidentiality Breach

Patient information, privacy, and security are at the heart of providing a high level of medical services. These issues are vitally important if patient confidence is to be retained, and to ensure that no potential harm comes to the patient. Hence, the information systems at any hospital should be managed in such a way as to retain the confidentiality of patient information, particularly where such information is still disseminated in hard copy form. Although the hospital prides itself on its ability to retain patient confidentiality, potential security breaches should be prevented where possible and dealt with immediately when unforeseen.

The issue of discarded printouts is very serious on a number of levels. There is no confidentiality if cleaning staff can simply take the printouts and read them. On a more serious level, discarded printouts are widely available once they leave the hospital — administrators no longer have any control over them in such a case. This is directly contrary to both hospital policy and general medical ethics. The role of the physician is to protect the patient, which includes protecting the patient's confidentiality.

Immediate Remedies and Reporting

As a first step, the issue should be reported directly to the night staff supervisor. Staff should not directly confront the cleaners, as that group may not have been aware of the seriousness of breaching confidentiality in this way. When superiors are made aware of the issue, the importance of shredding can also be highlighted.

Before training is arranged or other policies implemented, the high level of confidentiality compromise can be immediately addressed by introducing a shredding policy for discarded printouts. This should be implemented for all hospital wards. Short of prohibiting printing altogether, this is the most immediate remedy for the problem. However, training is also necessary to ensure that all personnel working at the hospital are aware of the vital importance of protecting patients' confidentiality.

The RSNA (2011) notes that a physician is primarily responsible for protecting patient information. Simply discarding printouts of confidential information certainly does not constitute the necessary protection. This is the physician's responsibility, along with the documentation of confidentiality policies throughout the hospital. Before these policies can be fully implemented, thorough training is required.

A specific policy must also be implemented when security breaches are observed. The RSNA (2011) suggests that security breaches should be reported right away. When a report is made, an investigation should be launched to address the security issue and eliminate the problem as soon as possible.

Staff Training Program

Training will occur for all staff members working within the hospital, at all levels of service. Hospital staff will be trained at three levels: medical personnel; administrative personnel; and temporary non-medical personnel such as cleaning staff. Information disseminated at these training sessions will include the importance of the Hippocratic Oath and how it relates to patient confidentiality. Sessions will also cover ways to handle observed security breaches, such as those that occurred at the hospital during night hours.

Specific policies should also be included in these training sessions, such as the general shredding policy and its rationale, as well as how to communicate security issues to patients. A policy for communicating confidentiality and security issues to patients must be implemented. All staff working directly with patients should engage in such communication and ensure that patients understand their rights regarding these issues. Medical staff should also make patients aware of their right to privacy and what to do when they suspect that their information has been inappropriately accessed or used.

Another important aspect of training is to ensure that all staff are aware of all confidentiality policies and requirements, especially when these change (MHA UAP Toolkit, 2008). For this reason, training sessions will be implemented on an annual basis. New staff members should also be trained as soon as possible after assuming their duties.

In addition, a policy of open communication between staff members and their superiors should be implemented, especially where confidentiality and security are concerned. Any suggestions or reports should be communicated directly to the staff supervisor, so that arrangements can be made for implementation and further training where necessary. To prevent any future breaches from occurring, all persons working within the hospital should be acutely aware of the importance of patient confidentiality at all times.

Conclusion: Team-Based Confidentiality Culture

The first important element of the breach is to understand that the cleaning staff might not have been aware of the hospital's confidentiality policy. Furthermore, the matter was not dealt with immediately because administrative and medical staff were not certain of the appropriate steps to take. Hence, training is a vital part of ensuring patient confidentiality. Another important element is that, while patient security is indeed the primary responsibility of the physician, it should also be a team effort. This underscores the need for integrated training at all levels of employment. All persons working within the hospital should therefore be made aware of the absolute necessity to maintain the privacy and security of patient records.

At the heart of implementation will be communication — not only among staff members, but also between staff members and their immediate and senior managers. All persons in the hospital at all times should be aware of current policies. When these change, immediate communication should inform all staff members of the particular change. When new staff members are appointed, they should be provided with a policy document and training at the earliest possible opportunity after assuming their duties. Furthermore, a policy of open communication should be maintained not only for reporting security breaches, but also for making suggestions regarding any part of the current policy document.

Importantly, both medical ethics and the law emphasize the importance of maintaining patient confidentiality at all times, unless doing so would cause harm to the patient or others. It is therefore important to implement policies that adhere as closely as possible to these requirements. Furthermore, directly communicating with patients regarding these issues will increase the confidence they have in the quality of services provided.

The main aim of the management plan is therefore to ensure that confidentiality breaches no longer occur and that they are prohibited in the long term. To accomplish this, teamwork is regarded as vitally important. All staff members are required to be aware of the importance of confidentiality and to report any inappropriate access of patient information.

References

Kolodner, R. (2007, Jun. 19). Statement. Retrieved from:

Maerian, L. (2010, Jul. 8). Feds propose rules to strengthen patient privacy rights. Retrieved from:

MHA UAP Toolkit. (2008, Sep. 2). Unlicensed Assistive Personnel Training Policy. Retrieved from:

Radiological Society of North America, Inc. (RSNA). (2011). Patient Privacy and Security of Electronic Medical Information. Retrieved from: http://www.radiologyinfo.org/en/news/newdetarget.cfm?ID=19