Blogging and HIPAA

Published

Specializes in Pediatric Pulmonology and Allergy.

If someone writes a nursing blog (or posts on allnurses) how can they avoid violating HIPAA if they write about patient scenarios? Not revealing your personal info or where you work is a start. Disguising patient details by changing the gender, age or history of your patient is another. But let's say that there are some people who read your blog who know who you are and where you work, and could conceivably figure out who you're writing about. Is it better not to write altogether? Do you need to ask permission before writing about a patient, even if you do not give out any identifying information?

Up Vote Up Vote ×

that is a good question? i still do not understand some of this hippa stuff, or are the facilities reading way to far into the law etc, One time i got in trouble for complaining to security because this person/patient i pressed charges against years before i worked there (because she hit me assault and battery nothing about her medical dx) was threatning me in the cafeteria

Up Vote Up Vote ×
Specializes in ER, Trauma.

That's the problem with laws and contracts. They get written by lawyers who seem to get paid be the word. The results end up being incomprehensible, perhaps that being the intent. Back on topic, I've never seen idle gossip on this site. All the posts have some educational component to them, and here they are between health care professionals. Patients are never identified. I feel comfortable that it would be hard for anybody to prove violation of the HIPPA laws here. Do lawyers have a similar website? Maybe we could ask them!

Up Vote Up Vote ×
Specializes in ER, ICU.

If the patient could be identified by the information, HIPPA flag down! If not, run with it.

Up Vote Up Vote ×
Specializes in ICU, Telemetry.

The point of HIPAA has been lost. HIPAA was originally designed to be something where you could not be denied coverage due to a pre-existing condition via insurance company A ratting you out to insurance company B when you changed jobs. We've fallen far, far away from that...

Up Vote Up Vote ×
Specializes in Peds/outpatient FP,derm,allergy/private duty.

Yes and part of HIPAA was also supposed to make sure that when the former employee had COBRA coverage which made custody of your medical records in the hands of several entities via electronic transfer privacy would not be endangered.

The whole thing has really gotten bizarre in some cases with the strangest things being called "HIPAA" violations but we can't unring the bell at this point.

Up Vote Up Vote ×
Specializes in Pediatric Pulmonology and Allergy.

Let's not call it HIPAA, then. Let's call it "patient privacy." Personally I believe in using common sense and not disclosing people's private information to anyone. When it comes to writing up a story on the internet though.. is it a violation of privacy? Even if I disguise details, once something is out there on the WWW there is the theoretical chance that someone will read it, recognize me, recognize the pt and put 2+2 together.

Would it bother you if someone wrote up a story about YOU (details disguised, no identifying info) and put it up on the internet for all to see? Or is the fact that the details are disguised enough to give you cover?

Up Vote Up Vote ×
Specializes in Critical Care, Nsg QA.

When in doubt, don't post. Simple.

Up Vote Up Vote ×

If you do not disclose your place of work on the blog, or any PHI (protected health information) about the patient. PHI is defined as the following:

  1. Names;
  2. All geographic subdivisions smaller than a state, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census:

    1. the geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people;
    2. the initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000;

      3. [*]All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death, and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older;

      [*]Telephone numbers;

      [*]Fax numbers;

      [*]Electronic mail addresses;

      [*]Social security numbers;

      [*]Medical record numbers;

      [*]Health plan beneficiary numbers;

      [*]Account numbers;

      [*]Certificate/license numbers;

      [*]Vehicle identifiers and serial numbers, including license plate numbers;

      [*]Device identifiers and serial numbers;

      [*]Web universal resource locators (URLs);

      [*]Internet protocol (IP) address numbers;

      [*]Biometric identifiers, including finger and voiceprints;

      [*]Full-face photographic images and any comparable images; and

      [*]Any other unique identifying number, characteristic, or code.

      As long as none of the above are mentioned, you are not in violation of HIPAA.

Up Vote Up Vote ×
If you do not disclose your place of work on the blog, or any PHI (protected health information) about the patient. PHI is defined as the following:

  1. Names;
  2. All geographic subdivisions smaller than a state, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census:

    1. the geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people;
    2. the initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000;

      3. [*]All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death, and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older;

      [*]Telephone numbers;

      [*]Fax numbers;

      [*]Electronic mail addresses;

      [*]Social security numbers;

      [*]Medical record numbers;

      [*]Health plan beneficiary numbers;

      [*]Account numbers;

      [*]Certificate/license numbers;

      [*]Vehicle identifiers and serial numbers, including license plate numbers;

      [*]Device identifiers and serial numbers;

      [*]Web universal resource locators (URLs);

      [*]Internet protocol (IP) address numbers;

      [*]Biometric identifiers, including finger and voiceprints;

      [*]Full-face photographic images and any comparable images; and

      [*]Any other unique identifying number, characteristic, or code.

      As long as none of the above are mentioned, you are not in violation of HIPAA.

      It was always a huge debate where I used to work whether those identifiers by themselves were PHI, or if they had to be associated with a medical condition.

      For example, Tom Smith. Did I just break HIPAA?

      Or do I have to say: Tom Smith, who has herpes.

      The point is that one of the items from the list has to be associated with their medical data. But that's where the debate was.

      Also, take note of the last item- "Any other unique... characteristic". This is the wide open variable. If you were in a really small town, and you are writing about the 15 year old who got pregnant, then it's an issue.

Up Vote Up Vote ×
Let's not call it HIPAA, then. Let's call it "patient privacy." Personally I believe in using common sense and not disclosing people's private information to anyone. When it comes to writing up a story on the internet though.. is it a violation of privacy? Even if I disguise details, once something is out there on the WWW there is the theoretical chance that someone will read it, recognize me, recognize the pt and put 2+2 together.

Would it bother you if someone wrote up a story about YOU (details disguised, no identifying info) and put it up on the internet for all to see? Or is the fact that the details are disguised enough to give you cover?

If anyone does enough detective work, they can figure out who you are talking about. I think the rule is that you, as the covered entity, should not disclose health information in conjunction with one of the identifying characteristics. Medical professionals deal with this all the time for educational purposes.

Up Vote Up Vote ×
Specializes in NICU, Post-partum.
If someone writes a nursing blog (or posts on allnurses) how can they avoid violating HIPAA if they write about patient scenarios? Not revealing your personal info or where you work is a start. Disguising patient details by changing the gender, age or history of your patient is another. But let's say that there are some people who read your blog who know who you are and where you work, and could conceivably figure out who you're writing about. Is it better not to write altogether? Do you need to ask permission before writing about a patient, even if you do not give out any identifying information?

The situation would have to be unique enough to where the patient could be identified.

That is going to be impossibe, especially if gender, age, etc, is changed.

No patient knows of how many such-and-such procedures are performed in a hospital any given day so even if a family member reads it and the same procedure was on their family member, if there is more than one in the hospital, they are going to be hard pressed to prove it was THEM that you were talking about.

HIPAA is not a complex mystery nor as far reaching as some claim on this board. To me, to protect patient's with HIPAA is a simple, not a complex task.

Up Vote Up Vote ×
+ Join the Discussion