HIPAA Compliance- posting patient names on assignment board

[ivorybunny]

I was wondering if anyone has heard about this or is experiencing this as well. I work on a cardiac tele unit with 52 private rooms. It's a very large unit and it has two distinct nursing stations. On each nursing station there is a board by the secertaries listing the room number, patient's name- it's also our way of listing what nurse and tech has assigned to them. We use to list the patient's last name, and if there are two people with same last name we would add a first initial. Now we are being told that it's not HIPAA compliant to list patient's name on the board. We now have to list the first 3 letters of their last name and the first initial. Now, what I don't understand is that anyone can call the hospital and find out if so-so is admitted, unless they chose to be a no-info patient. How is this any different? We are not listing any more type of identifying information other than a name which has multiple purpose- quick reference, let's the docs look and see where their patient's are, let's people know who the nurse is for a specific patient. What do other places do to display information? Any ideas how to make this better- I mean, a better way to display our assingments?

[mamamerlee, LPN]

The question here is whether or not these boards are easily visible to anyone just passing by. If they are, then they fall under the HIPAA guidelines.

Personally, I think it starts to get a little crazy at times.

[Up2nogood RN, RN]

What's really frustrating is we do not have ANY type of Pt assignment board. Just a piece of paper sitting on the desk by the charge with nurse/pt assignments. So we make copies for staff to carry around, I usually keep my brain on the back of it. All the info is in the computer but it's a PITA to log in everytime just to see one thing then log back out if you walk away from the screen.

[Kymmi]

I understand why you'd think the way you do about anyone being able to call and ask if so and so is in the hospital but think about this situation. Mr X is here to visit Mrs X and as he is walking past the nurses desk and he notices the board says Mrs. XYPSOET is in room 404. Now the last name XYPSOET is not a common name and Mr X knows someone with that last name. He now knows that Mrs. XYPSOET is a patient where as before he did not know because he knows her from a AA meeting he attends but doesnt know her as a friend because they really arent friends....he just knows her....so yes....if its easily visible to people other than hospital personnel who have a right to know that info it is a violation.

[HeartsOpenWide, RN]

We have these boards but we just use first and last initials.

And no, no one can just call and ask if some one is admitted. Your hospital is committing a violation.

[nursel56]

Almost every facility I've ever been to has a dry erase board with names and assignments. In fast paced units, how do you more effectively keep up-to-date info about nurses, pending tests and discharges? Since most ERs do not have walls separating one bed from another, a total stranger can learn the intimate details of your sex life or other private subject matter discussed with the doctor or nurse. What bed number you occupy seems like small potatoes in comparison.

What about 4 bed wards? How is it that your roommate and their visitors can hear every single detail about you when the doctor comes in? What if the door is open to your room and someone you know glances in and sees you in there? I can see using initials on the board, but honestly-- the things that people are now designating HIPAA violations just defy common sense.

[Kymmi]

Nurse156---first off I apoligize if I offended about the AA analogy..that wasnt my intention...I was just trying to come up with a way to express that someone might not know someone else is in the hospital but they see the name as they walk past the board....I do not know how the meetings are run but thanks for the info.

Second ---I totally agree with all your points because I've asked the same thing about the non private rooms, ER and so forth and I have never gotten a good answer (from adminstration) about why those do not violate privacy acts but I did ask about the names on the board because a few years ago we ended up having to remove the boards from our ICU and it was explained to me by the powers that be just as I explained it here. So I dont totally get what makes one a violation and another thing not I was just answering based on what I was told by those in higher places.

Once again I apoligize for anyone that I might have offended when I referred to AA...I was NOT attempting to offend and I guess it was a bad example to use.

[ivorybunny]

We have these boards but we just use first and last initials.

And no, no one can just call and ask if some one is admitted. Your hospital is committing a violation.

Unless if a patient is indicated NO INFO- we are allowed to give a room number- no other information is made available. When someone calls asking what room Mr. Smith is in- we are allowed to give that information. We, however, must have a pin # before giving out any information regarding condition, testing, etc. I was unaware that confirming a patient was admitted was a HIPAA violation. This is something I will have to look into. Thank you.

As for the boards- there is no other identifying information on the board- just a last name (well, use to be) not even male or female. So I didn't really understand how that's a violation. Thanks for all the comments. Keep 'em coming- I'm really curious how other facilities are doing this.

[core0]

I was wondering if anyone has heard about this or is experiencing this as well. I work on a cardiac tele unit with 52 private rooms. It's a very large unit and it has two distinct nursing stations. On each nursing station there is a board by the secertaries listing the room number, patient's name- it's also our way of listing what nurse and tech has assigned to them. We use to list the patient's last name, and if there are two people with same last name we would add a first initial. Now we are being told that it's not HIPAA compliant to list patient's name on the board. We now have to list the first 3 letters of their last name and the first initial. Now, what I don't understand is that anyone can call the hospital and find out if so-so is admitted, unless they chose to be a no-info patient. How is this any different? We are not listing any more type of identifying information other than a name which has multiple purpose- quick reference, let's the docs look and see where their patient's are, let's people know who the nurse is for a specific patient. What do other places do to display information? Any ideas how to make this better- I mean, a better way to display our assingments?

Have them show you the specific rule that you are violating. It doesn't exist. there are tons of self appointed HIPAA experts out there who "know" all about HIPAA. Many of them are willing to charge you large amounts of money for finding and fixing non-existent violations. The specific problem you are dealing with is directly addressed in the guidance section put out by HHS:

"For example, a hospital visitor may overhear a provider's confidential conversation with another provider or a patient, or may glimpse a patient's information on a sign-in sheet or nursing station whiteboard. The HIPAA Privacy Rule is not intended to impede these customary and essential communications and practices and, thus, does not require that all risk of incidental use or disclosure be eliminated to satisfy its standards."

From here:

http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/guidanceallsections.pdf

page 5

HIPAA is not meant to endanger the patient by increasing incidents of misidentification. After all its RIGHT NAME not right initials or random three letters we've chosen to recognize the patient.

Tell the "expert" to show you a specific part of HIPAA that is violated or go back to their fabric covered cubby and let people do some work.

David Carpenter, PA-C

[core0]

We have these boards but we just use first and last initials.

And no, no one can just call and ask if some one is admitted. Your hospital is committing a violation.

Incorrect. Once again this is an excellent example of changing policy without understanding it.

From HHS:

"(3) Uses and Disclosures with Opportunity to Agree or Object. Informal permission may be obtained by asking the individual outright, or by circumstances that clearly give the individual the opportunity to agree, acquiesce, or object. Where the individual is incapacitated, in an emergency situation, or not available, covered entities generally may make such uses and disclosures, if in the exercise of their professional judgment, the use or disclosure is determined to be in the best interests of the individual.

Facility Directories. It is a common practice in many health care facilities, such as hospitals, to maintain a directory of patient contact information. A covered health care provider may rely on an individual's informal permission to list in its facility directory the individual's name, general condition, religious affiliation, and location in the provider's facility.25 The provider may then disclose the individual's condition and location in the facility to anyone asking for the individual by name, and also may disclose religious affiliation to clergy. Members of the clergy are not required to ask for the individual by name when inquiring about patient religious affiliation."

You have to give people the ability to opt out. Most facilities have as part of their general consent to treatment an opt out. You cannot give out their condition without permission but you can certainly tell people they are present in the hospital if the have aquiesced.

David Carpenter, PA-C

[NRSKarenRN, BSN, RN]

a hospital customarily displays patients' names next to the door of the hospital rooms that they occupy. will the hipaa privacy rule allow the hospital to continue this practice?

answer:

the privacy rule explicitly permits certain incidental disclosures that occur as a by-product of an otherwise permitted disclosure—for example, the disclosure to other patients in a waiting room of the identity of the person whose name is called. in this case, disclosure of patient names by posting on the wall is permitted by the privacy rule, if the use or disclosure is for treatment (for example, to ensure that patient care is provided to the correct individual) or health care operations purposes (for example, as a service for patients and their families). the disclosure of such information to other persons (such as other visitors) that will likely also occur due to the posting is an incidental disclosure.

incidental disclosures are permitted only to the extent that the covered entity has applied reasonable and appropriate safeguards and implemented the minimum necessary standard, where appropriate. see our section on incidental uses and disclosures. in this case, it would appear that the disclosure of names is the minimum necessary for the purposes of the permitted uses or disclosures described above, and there do not appear to be additional safeguards that would be reasonable to take in these circumstances. however, each covered entity must evaluate what measures are reasonable and appropriate in its environment. covered entities may tailor measures to their particular circumstances.

[meandragonbrett]

We have a white board with Adm. date, last name, surgeon, what ICU consult for ICU management, and the day/night nurse. Nobody has ever said a word. All of our ICUs do it this way. Joint Commission just recently visited and had nothing to say either.

Some people in administration like to think up new and creative policies and are quick to pull "Joint Comission or HIPAA says..."