The challenges of health privacy: From the ER to virtual care
“Do you smoke? Drink alcohol? Use drugs like cocaine?”
While these questions may make you uncomfortable in public settings, they are commonly asked in emergency departments and hospital hallways. Despite health privacy becoming a larger focus in medical training, the less-than-ideal conditions make it a challenging concept to put into practice.
“Privacy was not a concept that was touched upon during my training,” says Dennis Desai, who started his residency training in the 1980s and is now senior physician advisor, quality improvement and eHealth, and deputy privacy officer with the Canadian Medical Protective Association (CMPA).
Justin Morgenstern, an emergency physician in Ontario, has a similar perspective: “When I trained, emergency departments were generally crammed into a corner of the hospital that was not designed for them … so we essentially made spaces out of curtains.”
But privacy is essential for proper care. “Privacy ensures that the patient is comfortable telling us the things we need to know, from drug use to sexual history,” Morgenstern explains. But it needs to be balanced with priorities, such as prompt treatment.
Medical trainees are taught health privacy guidelines and hospital-specific policies prior to the start of placements that outline the importance of practical steps that can be taken: safeguarding patient health records, not misplacing lists of patients and logging out of computer workstations after use.
Privacy laws vary from province to province. In Ontario, health privacy is primarily governed by the 2004 Personal Health Information Protection Act (PHIPA). One of PHIPA’s primary purposes is “to establish rules for the collection, use and disclosure of personal health information about individuals that protect the confidentiality of that information and the privacy of individuals… while facilitating the effective provision of health care.”
However, the layout of emergency rooms can result in a pattern of unauthorized disclosures. “Open concept” layouts and computer monitors pose risks and can lead to systemic privacy breaches.
“Privacy as we teach it in medical school is theoretically nice but practically impossible,” explains Morgenstern. “We have always taken privacy very seriously in the emergency department and it has become a lot better over the years. However, when taking care of patients, privacy rules cannot interfere with patient safety.”
And, he says, “No one is perfect – some of these practices are probably privacy breaches that we should clean up in medicine. The reason why these propagate through the years is that there is poor role modelling by teachers to trainees.”
Morgenstern adds that the potential for conflict between privacy and care extends beyond hospital visits. For example, if a patient is discharged and an important result from bloodwork is ready a few days later, can a message be left in shared home voicemail? Is the potential privacy breach worse than not leaving a message and potentially delaying treatment?
Desai describes privacy as a question of reasonableness – are the steps that are taken appropriate under the circumstances?
He notes that design features in a hospital greatly affect privacy. “We want to make it easy to have private spaces” for physician-patient discussions, Desai says. But empty rooms that would allow for these discussions often do not exist or are not available. Other design flaws include computer monitors directly facing patient areas and large “tracking boards” showing patient census information such as name, age and other identifying information.
In 2015, the privacy commissioner in Prince Edward Island ruled that the disclosure of patients’ personal information – including patient name, age, specialist consults and mental health admissions – in the emergency room on large monitors legible by members of the public is an unreasonable invasion of personal privacy. The commissioner ordered the tracking board to be used in a way that would respect patients’ personal privacy, recommending that the information on the board be out of visitors’ sightlines or to remove patient names.
A 2018 study found the refurbishment of a maternity unit ER with individual walled cubicles instead of curtained cubicles improved patient perceptions of overall privacy and confidentiality to 89 per cent from 21 per cent and reduced patients overhearing conversations about other patients to 9.8 per cent from 49 per cent.
A survey of emergency physicians that same year showed that three-quarters of surveyed physicians sometimes altered or shortened medical histories and physical examinations if patients were treated in a hallway.
As emergency rooms are built or renovated, design decisions are incorporating security, wayfinding, visibility of patients, efficiency and privacy. As an added benefit, designs that promote privacy can have broader effects; for example, keeping patients in separate rooms can be beneficial from an infectious disease perspective.
The emergency department at the Cortellucci Vaughan Hospital in Ontario, newly constructed and scheduled to open early this year, was designed for “compassionate care.” Patients arriving by ambulance are offloaded in private and treatment rooms include “breakaway glass doors that can be quickly removed to allow for more staff or equipment, obscured to ensure patient privacy or clear to provide health care providers with direct line of sight.”
The shift to virtual medicine has added additional challenges, Desai says, from ensuring the platform, devices and transmission used are secure to considering the physical surroundings of both the patient and healthcare provider. Anyone near a screen may be a part of the conversation – a technician fixing the computer, children learning from home or a family member eavesdropping. Even if a patient is aware that the agenda for the appointment includes imaging results for a liver ultrasound, the patient may not be expecting to have a frank discussion about alcohol or drug use with children within earshot. As a result, Desai suggests that healthcare providers outline the topics at the outset and ensure the patient feels comfortable discussing delicate topics.
Desai says a new generation of healthcare providers, who have had more training on privacy than in the past, might be able to better safeguard rights in both physical and virtual healthcare environments.
Apart from renovations to create individual rooms and discussion of an agenda with patients, interventions that can improve perceptions of privacy and patient satisfaction include reorganization of space to provide patients an area away from staff work areas, limiting unnecessary visitors into ER treatment areas and ethics and privacy training for staff.
“(Younger healthcare providers) are now aware of information that your staff supervisors may not have, which is an odd situation. But that is the way it is with privacy – especially with electronic devices,” says Desai. “You may need to think of a respectful way to bring this up with (your superiors) and make them aware of the privacy issues as it may not be top of mind for them.”
Morgenstern agrees: “It can be difficult… but if you see an issue, it is your responsibility to speak up,” either through formal pathways, such as an incident report, or informal conversations with a mentor.