Doctors office using FRS

[iamhere300]

This past week I heard a docotrs office using FRS radios telling the doctors that patients are on the way back to them to see them. These nurse and the doctor are giving out patients social security numbers. My wife works in a hospital for a Indianapolis local hospital. I told her about this and she said this violates the HIPPA rule for health care.Doctors cannot give out this infomation.

Does your wife know how to spell HIPAA?

I mean really, if you are going to quote it, at least get the name right.

 

[iamhere300]

I'd be interested in the citation or analysis that leads to this conclusion.

It is all over google.

http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/incidentalu&d.pdf (and notice, not even a mention of social security numbers)

was found during a simple search.

Let me google that for you

 

[iamhere300]

Any patient infomation that is given out with out the written ok of the patient is in violation of the HIPPA rule. The infomation is being transmitted out to the general public by a two way radio. I have the doctors name and will be getting more infomation before I call them. These doctors office does not think about using the radios. These radios are not secure in any means. Sounds like the doctors office is not aware that these radios can be heard outside their building. Very funny that the local Taco Bell is using FRS for the drive thru."The chalupas are ready how many do you need"?

Google "incidental disclosure HIPAA"

I am sure you probably already tried this, but if you got the name wrong, who knows where you looked.

 

[iamhere300]

Wrong. Transmission of the information in any "clear" medium is not allowed. Ask your state dept of health about it.

Totally incorrect. Not even close.

Interestingly, when HIPAA was first implemented, many thought that cell phones would have to be encrypted, dispatch systems would have to be encrypted, even good old paging would have to be encrypted. Even in the FAQs for HIPAA it was brought up "did telephone systems need to be encrypted'. Funny stuff, and mainly started by salespukes.

But it is not.

 

[iamhere300]

No they are stupid for giving personal info such as an SS# over something like that!!

Totally. I would walk out. I would not quote HIPAA, but I would quote good old common sense.

 

[iamhere300]

coming from someone who works in a hospital that is nationally recognized by JCOH, all personal health information (PHI) must be protected whenever possible, and only given to others on a need to know basis. This includes discussing it publicly or in places WHERE OTHERS CAN INTERCEPT it. HIPAA does provide exclusions for certain settings, such as ER's where it isn't practical or possible to have a private "one on one" with a health care giver, or on the scene of a trauma incident, MCI, etc.

Ok, before I disect this too much, WHAT IS JCOH?

I find The Joint Commission (TJC), formerly the Joint Commission on Accreditation of Healthcare Organizations (JCAHO) and previous to that the Joint Commission on Accreditation of Hospitals (JCAH), but no JCOH.


I will look at the other agency, as I find no JCOH.

TJC is not federal law. It is the standard that many states use for accrediation, but many states use other organizations. Sort of like NFPA in the fire service. Not a law. Even some of the agencies that have been using them as accreditation have been going to different standards.

TJC also allows for "incidental disclosures" which is where you may want to look for guidance.

However, using an open, public broadcasting unsecured communication device for daily communications is clear and blatant negligence. Not to mention it may violate your state's statutes as well. A JCOH visit to this facility would find them in violation. You can't even leave patient census forms laying around, let alone anything with detailed PHI on it.

Here's what I would do: Record this traffic (which you are free to do, as FRS is considered 100 percent public) and pass it onto the local media and the agencies responsible, make an official complaint to them and I GUARANTEE it will stop.

This is about the WORST thing any health care provider can do is leave PHI laying around or broadcast it over open airwaves, especially on unlicensed radio services that anyone can intercept. If I were a patient and I found out my provider put my PHI over an unencrypted medium, radio, computer or written, I would sue them faster than you can say "privacy disclosure".

Summary of the HIPAA Privacy Rule

 

[iamhere300]

Hi Dave,

Actually, HIPAA doesn't discriminate...if patient info is disseminated by any means, it's a violation. It can be written, electronic (email), telephonic, and radio.

This was a huge point of contention years ago. Dispatch desperately wanted to convey to us crews in the field that a particular patient had XYZ communicable disease...but couldn't. The dispatchers got pretty creative, even tried coming up with "codes" that would be symbolic for certain communicable diseases. In the end, they lost...HIPAA was cited as the reason.

I absolutely agree; however, that the doc's office is foolishly using technology...to his/her disadvantage. I hope someone educates this practice, obviously it's attracting an audience.

Happy Holidays!

This is fun. So, what would HIPAA say about my Fire Department dispatcher giving me a complete medical history, over the radio, unencrypted, including anything about XYZ communicable disease? (man, I hate XYZ, it is truly bad stuff) LOL

Then we respond back to the dispatcher that first responders are on the scene, and giving more medical history back?

 

[MTS2000des]

Ok, before I disect this too much, WHAT IS JCOH?

I find The Joint Commission (TJC), formerly the Joint Commission on Accreditation of Healthcare Organizations (JCAHO) and previous to that the Joint Commission on Accreditation of Hospitals (JCAH), but no JCOH.


I will look at the other agency, as I find no JCOH.

TJC is not federal law. It is the standard that many states use for accrediation, but many states use other organizations. Sort of like NFPA in the fire service. Not a law. Even some of the agencies that have been using them as accreditation have been going to different standards.

TJC also allows for "incidental disclosures" which is where you may want to look for guidance.

Right, and TJC (which we refer to at my facility as JCOH in housw) will tell you that incidental disclosures are just that, supposed to be incidental- not neglecting PHI.

You are supposed to only give out PHI, which includes patient identifiers, in a confidential manner as possible. This is also clearly spelled out in HIPAA. Accredited health care organizations, and not morons, understand this and don't do stupid things like broadcast PHI over an unsecured comm network if something else is available, you know, like a wired telephone. Or an encrypted data network, which most medical offices usually have, unless you're in a third world country like the Dominican Republic.

Incidental disclosure does not mean careless disclosure. Giving PHI, including patient names, SSN's, insurance info- over a non secure medium on a daily basis is the equivalent of tossing paper records into municipal waste without putting them through a shredder.

At least that is how it's done at "accredited" health care facilities. YMMV. It's why it's always wise to ask around and investigate any health care provider and see what their privacy policy is and if they actually uphold it, before giving them your business.

 

[iamhere300]

Right, and TJC (which we refer to at my facility as JCOH in housw) will tell you that incidental disclosures are just that, supposed to be incidental- not neglecting PHI.

You are supposed to only give out PHI, which includes patient identifiers, in a confidential manner as possible. This is also clearly spelled out in HIPAA. Accredited health care organizations, and not morons, understand this and don't do stupid things like broadcast PHI over an unsecured comm network if something else is available, you know, like a wired telephone. Or an encrypted data network, which most medical offices usually have, unless you're in a third world country like the Dominican Republic.

Incidental disclosure does not mean careless disclosure. Giving PHI, including patient names, SSN's, insurance info- over a non secure medium on a daily basis is the equivalent of tossing paper records into municipal waste without putting them through a shredder.

At least that is how it's done at "accredited" health care facilities. YMMV. It's why it's always wise to ask around and investigate any health care provider and see what their privacy policy is and if they actually uphold it, before giving them your business.

Exactly my point. TJC in Texas is a voluntary standard. YMMV depending on the facility, but as long as it is a covered provider for HIPAA, HIPAA is the bottom line for the law.

 

[N4JKD]

I have never heard anything over FRS before. Haha... I have heard of people using them on road trips, but I dont see the point unless you are within 50 yards of each other.