The Law of Unintended Consequences

Clinicians (both physicians and nurses) must constantly be aware of PHI and where it may be visible to others who are not involved with patient care. This means that flowsheets used for charting can never be left where someone may inadvertently see them. Chart pages, ECG (electrocardiographic) printouts with patients’ names, labels, and other scraps of paper with any PHI must be destroyed, usually by a shredder placed at the main nurses’ station. This regulation means that the nurse must leave the patient’s bedside in order to dispose of the paper—yet more time away from the patient.

Conversations between patient and nurse, the very essence of nursing care, are virtually impossible in nonprivate rooms. Conversations between clinicians must take place in a location where they cannot be overheard. Clerks who are on the frontline of the intensive care unit (ICU) are faced with a barrage of requests for information from patients’ families and friends and must consistently reply that regulations prevent them from divulging any information about a patient, including whether or not the individual is even hospitalized.

In ICUs, where constant vigilance and communication are critical, the HIPAA regulations seem to be a countervailing force in the care of patients. Clinicians are left to ponder the rationale of HIPAA when other regulatory bodies have already been charged with protecting confidentiality. More importantly, clinicians’ ethics have always supported patient dignity and privacy (think of those hospital elevator signs of decades ago reminding clinicians to protect patient privacy in their conversations).

The recent efforts by many to make staff and ICUs more accessible to families have had to take a large step backward. Families are on the receiving end when clerks explain that they are not at liberty to release any information. In some hospitals, one family member is identified as the information source for all calls. That individual is given a password that allows the clerk or nurse to provide the individual with updates. While this is one solution, it also creates a burden on that one family member who serves as the hub of all information and places a special burden on blended or divorced families for whom consensus about who will be the central communicator is hard to achieve. Family members are now often reluctant to leave the bedside for much needed rest for fear that they will not be able to call for updates on the patient’s progress.

If the patient is not in a private room (the norm because of Medicare and health insurance policies that reimburse only for double occupancy) or if the ICU has an open design, the family must leave the patient’s bedside when physicians and nurses are discussing the care of another patient. In short, the new regulations, as they are being enforced, may serve to isolate the family from both the patient and the staff and reverse the important trend to family-centered care.

Healthcare facilities and hospitals have also borne a significant burden. The cost of implementing and maintaining the regulations has not been totally realized but could eventually reach into the billions of dollars. Some ICUs have been remodeled to accommodate the new regulations. The offices of ICU managers, previously accessible and visible to the staff (but usually containing patient information), must now be moved to areas where they are not visible or accessible. Not only are managers less accessible, other resources (such as medical journals, policies, and procedure manuals) that often reside in these offices are consequently less accessible.

Many ICUs do not have private rooms near waiting rooms where doctors and nurses can consult and inform family members in confidence. Therefore, family members must be taken some distance from the unit, or waiting rooms have been remodeled to accommodate private conversation.

Many critical care units contain strategically placed boards that list patients’ names and key information that indicate level of acuity and other important data (eg, “on IABP”). These boards act as an important street sign, giving instant information to healthcare personnel who may be urgently needed at the bedside. These boards must now be relegated to nonvisible areas of the ICU, rendering their usefulness virtually worthless. The loss of these boards along with the elimination of patients’ names from outside their rooms brings into question potential issues of patient safety.

The only apparent advantage related to the architectural changes demanded of hospitals by HIPAA is the instant obsolescence of the “doctors’ dining room” in the few hospitals where it still exists. There is certainly no need to provide physicians on staff with a special place to discuss patients when the entire staff is under the same stricture and admitting clerk offices are encased in plexiglass, taking on the appearance of a New York taxi cab.

Researchers are feeling the effects of HIPAA at every turn, even though no evidence exists that research jeopardizes confidentiality of patient information.¹ Healthcare practices have changed significantly during the last century, from care that was largely based on anecdotal knowledge to care that is evidence based. Guidelines, best practices, and critical pathways have evolved based on research to support them. These processes have improved patient care and outcomes.

Although research per se is not covered under the privacy rule, HIPAA erects significant new procedural barriers to the use of PHI in research. PHI is defined much more broadly by HIPAA than by any other regulatory body overseeing research. According to HIPAA, PHI includes patients’ names, addresses, dates of any kind (eg, birth, hospitalization, death), phone number, medical record number—identifiers that are often an integral part of a research study. HIPAA hinders researchers in their ability to recruit patients into studies, maintain accuracy of data collection, and obtain longitudinal data from subjects already enrolled. It also requires that patients sign legal documents that inform them that their medical information may not remain private if they participate in a study, unnecessarily raising patients’ fears about the risk of participating. If research is being conducted in a hospital, the organization must track and record all access to patient records, adding to the paperwork burden.

Increasing restrictions on the use of even the most needed and appropriate information may stifle the research process. HIPAA may lead to investigators who won’t want to do research, patients who won’t want to enroll, and hospitals who won’t want to support research.

It is clear that HIPAA is here to stay. The noise level surrounding its implementation may decrease as time passes, but critical care nurses and physicians need to be proactive in the meantime. Although certain areas of HIPAA are clearly black and white, much remains in a grey area due to ambiguous language and the reevaluation of circumstances resulting from the underestimation of unintended consequences. Nurses and physicians working in critical care are in a unique position to influence the ultimate implementation of HIPAA and can suggest possible solutions when they see situations or problems arise from the new regulations. In most cases, this means working with management and the designated person in the hospital charged with enforcing HIPAA regulations to identify problems immediately. Committees composed of staff members can be important in bringing potential problems and solutions to the forefront. Actively engaging patients and their families to solicit their feedback could also yield benefits.

Unintended consequences are more likely to occur when those involved are not actively assessing the situation and taking action to prevent potential problems—just the things that critical care nurses and physicians do best.