Pt's FB pictures of me

[rse3]

I am a nursing student, and my dad is an ON/GYN. I recently helped him deliver a baby, and his pt took pictures of us and posted them on Facebook. I would like to have these pictures, as I hope to become a CNM, and would love to have a picture of my dad and me at my first delivery. (There are pics of us with and without the baby.)

Is it a HIPAA violation if I click on the "..." and save these pictures to my phone since she made them public on Facebook (we are not FB friends. I searched for her.) I really want these pictures, but want to have them legitimately. Thanks!

[sapphire18]

There's really no difference in looking for a pt in the obituaries than looking for them on Facebook. You got the pt's name through a "personal and private" interaction where the pt was vulnerable (as someone said earlier in the thread). I think people are being a little over-sensitive here..it's about common sense..not googling a famous pt? Really? I'm not sure how that is invading the pt's privacy if it is on the internet. Where there is no assumption of privacy.

[MunoRN, RN]

But again, and i can not stress this enough, you could be disciplined for this. You do not, did not know this patient outside of the facility. You searched this person after the fact, based on personal information (their name) that you obtained at the facility. That can be considered a violation of HIPAA.

Is it a HIPAA violation to look for someone's obituary? Sharing or otherwise exposing PHI, which is health or payment information connected to an identifier (ie patient name) is a HIPAA violation, simply knowing a patient's name is not. Using knowledge of someone's name or other information to access personal or privileged information can be a HIPAA violation, but accessing public information is not.

[nurseprnRN, BSN, RN]

True. But the way and venue in which you obtained the name counts. If you learned someone's name in a patient care situation, you can't go using it in other ways. It's true that the OP says she didn't write it down, she just remembered it, but that doesn't matter. If you have PHI you learned at work, and names are PHI, then you cannot use them for any other purpose, and that includes entering them into a search box in FB or other social media.

Looking at the obits or Just Married columns is different. Some may think the search feature in FB is a grey area or not comparable, but in today's litigious society I would err on the side of greater caution.

[MunoRN, RN]

True. But the way and venue in which you obtained the name counts. If you learned someone's name in a patient care situation, you can't go using it in other ways. It's true that the OP says she didn't write it down, she just remembered it, but that doesn't matter. If you have PHI you learned at work, and names are PHI, then you cannot use them for any other purpose, and that includes entering them into a search box in FB or other social media.

Looking at the obits or Just Married columns is different. Some may think the search feature in FB is a grey area or not comparable, but in today's litigious society I would err on the side of greater caution.

Facebook is just obituaries for people who aren't dead yet. Both are sources of publicly available biographical information about someone.

I'm still not sure how the search function is what makes the difference, apparently for both obituaries and facebook. Is it that you have to scroll through the names to find one your looking for to avoid bad conduct, or that you can't look for a specific name at all?

[ixchel]

Facebook is just obituaries for people who aren't dead yet. Both are sources of publicly available biographical information about someone. I'm still not sure how the search function is what makes the difference apparently for both obituaries and facebook. Is it that you have to scroll through the names to find one your looking for to avoid bad conduct, or that you can't look for a specific name at all?[/quote']

I understand what you are saying and do view intentionally looking for a person without their invitation, consent or knowledge after they were your patient is the exact same thing whether it be by print or electronic media. Both are intentional, with the outcomes of each being similar - gathering information beyond what your nurse/patient interaction presented and required.

If the information is public, is it acceptable to seek it?

Personally, I am leaning toward no. There's a boundary there, and I don't think snooping (even with innocent intent) is okay. But I can get a little prudish. I can admit that from time to time. ?

Does that answer what you are asking?

[BostonFNP, APRN]

I am of the belief that there is an ethical problem with the use of a patient's private health I formation for a personal reason, including simple curiosity.

[MunoRN, RN]

I am of the belief that there is an ethical problem with the use of a patient's private health I formation for a personal reason, including simple curiosity.

So that would include reading and/or looking for an obituary?

[BostonFNP, APRN]

So that would include reading and/or looking for an obituary?

If it's for a person reason, yes, as it does nothing but fulfill a need of the nurse not the patient.

[MunoRN, RN]

True. But the way and venue in which you obtained the name counts. If you learned someone's name in a patient care situation, you can't go using it in other ways. It's true that the OP says she didn't write it down, she just remembered it, but that doesn't matter. If you have PHI you learned at work, and names are PHI, then you cannot use them for any other purpose, and that includes entering them into a search box in FB or other social media.

Looking at the obits or Just Married columns is different. Some may think the search feature in FB is a grey area or not comparable, but in today's litigious society I would err on the side of greater caution.

I can't find anything to support that names by themselves are PHI. Protected health information is health or payment information that is combined with an identifier, the identifier by itself is not PHI as it contains no health information.

[NurseQT]

I think the issue is the *appearance* of gaining favor. There is no way for other students to know if she is or not, and in the sake of fairness, were I the instructor working with her clinical group, I would try to assign her to patients who did not have a family member tending to them. That's not always possible, but if it can be done, it should be. It reduces the animosity the other students might feel toward her if they do perceive that she is getting more access to better clinical experiences than they are. And if preceptor evaluation is part of their grading, it's pretty obvious that there is a huge issue with being graded in part by a family member.

The OP said she was in the delivery room with her preceptor AND her dad, not that her dad was her preceptor. When I was in school we had one hospital with four OB/GYNs that practiced there, they weren't employed by the hospital though. Nor did they give any sort of evaluations for the nursing students. If I was one of the OP's classmates I wouldn't feel slighted in the least, I would've thought it was pretty cool that she got to have that experience with her Dad and obviously the patient felt the same way since she snapped a pic of the OP and her dad together. Patients have a closer relationship with their docs than they do nurses, I wouldn't be surprised if the patient brings up the subject of the pics on her own at her 6 wk f/u. I know I would, but that's just me.

[Esme12, ASN, BSN, RN]

Interesting article....HIPAA and Social Networking Sites: A Legal Minefield for Employers.

Special HIPAA risks for employers

In addition to the reputational, intellectual property and other risks facing employers generally, employers that store, process, use or otherwise handle sensitive personal data — such as medical data — also face additional risks of liability for violation of data-privacy laws. Because an employer is liable for the conduct of its employees when the employees are acting within the scope of their employment, the employer could be held liable for an employee’s disclosure of another person’s health information on a social networking site.

Indeed, employers that are “covered entities” under HIPAA face direct liability for the acts of any member of their workforce that are inconsistent with the data privacy and security regulations issued under HIPAA.⁴ “Covered entities” include most health-care providers and health plans, and their “workforce” includes “employees, volunteers, trainees, and other persons whose conduct, in the performance of work for [them], is under the[ir] direct control, whether or not [the workers] are paid by the covered entity.”⁵ All such workforce members are prohibited, with limited exceptions, from using or disclosing individually identifiable health information (“protected health information,” or PHI) without a written authorization from the individual to whom the PHI pertains, and any such authorization must contain very specific language to comply with HIPAA.

Using a patient name that you KNOW from being involved in their care is using their protected personal information.

[Mulan]

Since no one on here is an expert in the interpretation of HIPAA, I think stating that a name is protected information is one's own personal opinion.

Death Ends the Right to Privacy, But Not Confidentiality - Health Care Ethics II