How Hospital Privacy Policies Are Inhibiting Medical Education

Education is undergoing a revolution

Each month 3.5 million students view videos produced by the Kahn Academy on topics ranging from calculus to chemistry and phyics to physiology, TedTalks have boldly branded their motto of “ideas worth spreading” to share solutions to the problems of today, and children and adults alike first search YouTube to learn to tie their shoes or fix a toilet.

Medical educators are working overtime to stay current in this education revolution

In a 2012 article in the New England Journal of Medicine, authors at Stanford University School of Medicine discuss the shifting paradigm in medical education from lecture-based to case-based learning during the pre-clinical first and second years of medical school. As an example of the captivating power of case-based learning, the authors share the following clinical vignette:

“A 37-year-old man was admitted to the hospital because of muscle pain and weakness. The patient had been well until the evening before admission, when mild diffuse myalgias developed. He awoke in the morning with diffuse muscle cramps and intense pain in his legs. . . . On arising to go to the bathroom, he felt unsteady and had difficulty walking. After he returned to bed, diffuse muscle pain persisted, with weakness in his arms and legs and numbness in his legs; he was unable to arise again.”

The authors then ask, “Do you want to learn more? That’s the power of the clinical scenario. The case’s discussant reflects on the differential diagnosis that might explain this acute onset of weakness and pain, including inflammatory, infectious, toxic, metabolic, and autoimmune processes.”

Imagine for a moment that this case-based scenario is not merely a fictional story created by educators at Stanford to captivate the mind of curious first and second-year medical students, but instead is the beginning paragraph to the “History and Physical” obtained by a third-year medical student. Suppose for a moment that this student rounds on the patient each morning, discusses management plans with the family, and writes progress notes summarizing the patient’s progress and treatment. On hospitalization day #4, the patient becomes febrile, hypoxic, and hypotensive, and is transferred off the medical student’s service to the ICU for intubation, mechanical ventilation, and blood pressure support. While no longer directly involved in this patient’s care, and no longer rounding on the patient each day, this curious student continues to use the electronic medical record to follow the patient’s hospitalization in the ICU, learning important principles of the medical management of similar critically-ill patients through this real-life cased based scenario.

One might imagine that this type of self-motivated and case-based learning would be applauded by medical educators and hospital administrators. Unfortunately, current hospital policies would suggest otherwise.

Hospital privacy policies are inhibiting medical education

A few weeks later, imagine the shock and anxiety of this motivated medical student when he gets a call from his medical school’s Dean of Professionalism and Accountability. He is told that he has violated the hospital privacy policy for curiously following the hospitalization of his patient after he was transferred to the ICU. Due to his accessing “personal information outside the ‘minimum necessary to do your job’, and/or outside your ‘professional need to know,'” a clear violation of hospital and school of medicine policy, this curious student is told by the Dean that he may be subject to “suspension…or expulsion from the” school of medicine.

Expulsion from medical school for using the electronic health record system to follow the hospitalization of his patient after transfer to the ICU? Seems a little unreasonable, doesn’t it? To think that a school of medicine or hospital would discipline, expel, or even sue a medical student for merely maximizing his opportunity to learn by following his patient in this real-life case-based scenario is not only ridiculous, but highlights a hypocrisy in current medical education in need of serious change.

The advances and improvements being made at every level of medical education are exciting, innovative, and revolutionary. The paradigm of lecture-based learning is being replaced instead with self-directed learning from carefully-crafted cases, allowing a student to better learn the symptoms, pathogenesis, pharmacology, treatment, necessary to become a capable physician. Unfortunately, however, soon after medical students are taught to think critically in a case-based format during their first and second years of pre-clinical education, they are discouraged and even penalized for applying their newly acquired critical-thinking skills as third- and fourth-year students when curiously following patients during hospitalization and even after discharge.

Do these strict hospital privacy policies really exist?

Students at the University of Utah School of Medicine, for example, must annually complete “HIPAA Privacy Training.” This training clearly states, “It is a VIOLATION OF UNIVERSITY POLICY to open or look at the protected health information (PHI) of ANY PERSON without a business ‘need to know'” and that “violations include getting into personal information outside the ‘minimum necessary to do your job, i.e. for personal reasons or out of curiosity…'” Furthermore, the training states that “privacy and security audits are periodically conducted to confirm compliance,” and “a log is kept of who accessed PHI and when.”

What are the consequences of violating such a policy?

The school of medicine student handbook states that “a HIPAA violation by a medical student is considered a breach of professional responsibility. As such, all violations will be referred to the Associate Dean for Professionalism, Accountability and Assessment for resolution.” The required training goes on to state that “sanctions for violations can include” anything from “verbal counseling and warnings” to “suspension or termination from the University of Utah, reporting to professional licensing or credentialing boards,” or even “civil and criminal charges up to $1.5 million or 10 years in prison.”

Are privacy policies equally restrictive at other hospitals?

I recently spoke with Jay Fackrell, privacy auditor responsible for monitoring privacy compliance at Intermountain Healthcare, one of the nations most-respected healthcare systems, with 22 hospitals and over 33,000 employees in Utah and Idaho. Jay confirmed that according to the current Intermountain privacy policies, a medical student using the electronic medical record to follow the hospitalization of one of his patients after transfer to another service or to another hospital would be in violation of the hospital privacy policy, and would be grounds for discipline. Interestingly, however, he recognized my rationale and agreed with my suggestion that hospital policy be modified to allow students to follow the hospitalization of their patients by continuing to access their records once transferred to another unit or another hospital, and suggested that I contact hospital administrators to request such permission for students through a simple addition to the Intermountain privacy policy.

Does HIPAA allow hospitals to create uniquely crafted privacy policies for medical students?

If hospital administrators such as those at Intermountain or the University of Utah agree to change the current policy and allow students to access their patient’s PHI following transfer or discharge, could such a change be made or would it be in violation of HIPAA? The official statement contained within HIPAA states,

“For uses of protected health information, the covered entity’s (hospital’s) policies and procedures must identify the persons or classes of persons within the covered entity who need access to the information to carry out their job duties, the categories or types of protected health information needed, and conditions appropriate to such access.”

As can be seen from this statement, HIPAA gives each hospital the authority to decide which classes of persons (i.e. medical students) can have access to PHI to “carry out their job duties” and “conditions appropriate to such access.” A change in hospital policy to allow such a change would clearly be allowed under current HIPAA guidelines.

A plea for change

The current reform in medical education must be accompanied by a reform in hospital policies to allow medical students to continue to learn from their patients free from fear of medical school expulsion or other disciplinary measures. Let me be clear, however. In no way am I suggesting that medical students should be egregious in accessing PHI and other confidential information contained within a patient’s health record. If anything, hospital policies should explicitly detail what information is and is not okay to access. My recommendation for such a policy would allow medical students to access the health record of patients for whom they have personally performed a physical examination or interview or on whom they have co-authored a physician note. Students must still comply with all other aspects of HIPAA and privacy policies including not accessing information on friends, family, coworkers, notable patients, or any patient in whose care they have not been involved.

The time has come for the next step in the revolution of medical education. Hospital administrators and medical school Deans must rise to the challenge and implement policies which maximize learning using the real-life case-based scenarios of the patients that occupy hospital beds each day. As a medical student feeling the nervousness and excitement of soon caring for patients, may I issue a plea for changes in hospital policies, such that instead of fearing expulsion from medical school on the grounds of my “curiosity,” that I may be empowered to learn from the physicians, nurses, pharmacists, and other providers that care for my patients in the future, and, most importantly, to continue to learn from the patients themselves.

If you too believe this change in hospital privacy policies will improve medical education, please share this blog post with others.