Introduction to Patient Confidentiality and Hipaa

Introduction to Patient Confidentiality and HIPAA

Historically, patient confidentiality has been considered a sacrosanct value in the healthcare professions: this value has long been considered a necessary condition for the ethos of trust and full disclosure which must prevail if care is to be effectively delivered to the patient (Norman, Aikins, & Binka, 2011). Further, with respect to the nursing profession in particular, this value has been understood as a crucial prerequisite for the trust which is necessary for a meaningful nurse-patient relationship. For example, without an environment of trust, most aspects of Watson's (2011) nursing theory, which addresses certain fundamental aspects of nursing, would virtually inapplicable.

However, despite the importance of patient confidentiality, contemporary developments in healthcare informatics threaten to severely undercut this value. On the one hand, such technologies make information available like never before; and not only does this greatly enhance the quality of information flow between various healthcare professionals, it also alleviates what Reinhardt (2010) has bemoaned as the general "opaqueness" of the healthcare system and thus empowers patients to play an active role in their own care. On the other hand, though, the enhanced capacity for general information flow directly implies an increasing difficulty with treating any particular information as sacrosanct and confidential.

As Flores (2005) has indicated, "nurses stand at the forefront in the resolution of the dilemma of patient privacy versus health care expediency" (para. 1). In part, this is due to the fundamental role of the nurse both in providing optimal care to the patient and serving as advocate for the patient (American Nurses Association, 2001): the provider role corresponds to the value of expediency, whereas the advocate role corresponds to the value of confidentiality.

Given this context, one of the main purposes of the HIPAA legislation is to address this contradiction of values. However, its success at fulfilling this purpose has been ambiguous. HIPAA contains a Privacy Rule; this provision "gives individuals the right to obtain their own medical records" (Flores, 2005, para. 4); and conversely, it also prohibits healthcare providers from "releasing PHI (personal health information) without permission" (para. 5). In addition, the "law also directed the U.S. Department of Health and Human Services (USDHHS) to develop privacy rules including, but not limited to, the use of electronic medical records" (para. 1). At face value, this would seem to suggest that HIPAA should have some efficacy with respect to addressing the threat to confidentiality posed by developments in healthcare informatics.

However, as the USDHHS (as cited in Moore et al., 2007) itself has understood it, the purpose of HIPAA's Privacy Rule is