Introduction
Some patient-sustained injuries require law enforcement notification upon presentation to a medical facility (most commonly the ED). One example is purposefully inflicted injuries on children. Not all self-inflicted injuries require reporting, such as accidentally lacerating one's finger with a knife.1 Laws about the notification of law enforcement vary state-to-state and across the US territories according to the type of injury or abuse.1 When a law enforcement professional (LEP) arrives in the ED or in another area of the medical facility to interview a patient, they may utilize a body-worn camera (BWC). BWCs have become a common practice throughout the US but have simultaneously heightened concern for maintaining patient confidentiality.2-4 While healthcare professionals (HCPs) focus on providing care, LEPs protect the public and gather evidence to investigate a possible crime.2-5 Because of the increased use of BWCs in the clinical setting, the division of priorities highlights the need for hospital-wide policies to provide guidance and formal parameters to ensure the patient's right to privacy.2-6
Video recordings by patients, families, and visitors have become much more common and may occur without the patient's or the HCP's consent or knowledge.5 This article reviews several areas regarding protected health information (PHI) and the use of video and areas of concern for exchanging PHI with LEP at the bedside.
HIPAA
The Health Insurance Portability and Accountability Act (HIPAA) is a federal law passed by Congress in 1996. It protects sensitive patient health information from disclosure without the patient's consent or knowledge. The Office for Civil Rights within the Department of Health and Human Services (HHS) oversees the Act and included input from HCPs during its development.7,8 Covered entities were mandated to evaluate practices and enhance protections to limit unnecessary or inappropriate access to patients' PHI.8 Standards were enacted to protect and limit access to information in electronic health records (EHR), including physical safeguards on computers and workstations.7
The Privacy Rule and PHI disclosure
In 2000, 4 years after Congress passed HIPAA, the Privacy Rule was enacted.8 The Privacy Rule set a national standard for healthcare providers to simplify administrative work by reducing costs, improving data accuracy, and managing billing and referrals.8 The Privacy Rule assured that individuals' PHI is appropriately protected while allowing the flow of information needed to provide high-quality healthcare.8 The Privacy Rule permits covered entities to disclose PHI to law enforcement officials, without the individual's written authorization, under specific circumstances, including court orders; court-ordered warrants; subpoenas; or information to identify or locate a suspect, fugitive, material witness, or missing person.8 Other permitted disclosures may include: if the patient is a victim or suspected victim of a crime or the person dies under suspicious circumstances.8
American Hospital Association disclosure guidelines
Covered entities (individuals or entities that transmit PHI for transactions for which HHS has adopted standards) must account for all known disclosures of PHI outside the covered entity, with certain exceptions.9 When disclosures are made to an agency or official, such as pursuant to a subpoena or warrant, or in the case of reporting a death to a medical examiner, the disclosures must be documented according to the hospital policy.9 Staff should consult the legal department if there is any question about what information is released.
Law enforcement at the bedside
The law enforcement role can vary in different types of healthcare settings. A typical function is to provide physical protection to the staff, patients, and visitors.10,11 Other times, LEPs can be present to investigate or collect evidence of a crime.10 Each state has rules regarding notification of LEPs for current crimes or events.1 For instance, all US states and territories require reporting child abuse.1 All states except four (New Jersey, North Dakota, South Dakota, and New York) and two territories (Guam and American Samoa) require the reporting of abuse of an older adult or a vulnerable person.1 Injuries sustained from a gunshot require reporting in all but five states.1 HCPs must be familiar with their state's or US territory's reporting requirements.
When an officer presents to see a patient, they customarily ask permission to visit.12 The patient has the right to agree to or refuse the visit.12 If the patient refuses to speak with law enforcement and the LEP wants to obtain PHI, the state's process for obtaining the information through the court system must be followed.12 If the request falls outside the institution's established hospital policies, contact the institution's legal department.
LEPs and BWCs
The use of BWCs by LEPs has become commonplace in response to heightened evidence of racial disparities.13 The activation light on the BWC is the only indication that it is recording the conversation with both video and audio.14 Given the introduction of BWCs, HCPs should automatically assume conversations are being recorded if an LEP is performing a patient interview.14,15 Each state has laws governing video and audio recordings and what notifications must be made to other parties or posted for public knowledge.16 At the time of this writing, the use of BWCs by LEPs varies per state, ranging from no mandate to a full mandate requiring all parties to consent to video.17
Hospitals do not control LEPs' use of BWCs at the bedside.4 Some have held discussions and conducted research regarding BWC use by LEPs.3,4,15 Nurses should know that the patient has a right to privacy during the recording but that the BWC will record conversations and care.3,4 The goal of the LEP video is to obtain information about the possible commission of a crime.3,4,15 If the LEP requests detailed information, follow the institution's policies and contact the institution's legal department if necessary. The goal of nurses should be to provide safe, expedient care and as much privacy as possible. The nurse may maintain conversations with the patient and other HCPs, such as physicians, technicians, or pharmacists, and refer the LEP to the legal department to obtain specific patient information.3,4,15
Suspected criminality
Law enforcement personnel frequently arrive at the bedside to explore the possibility of criminal activity when a patient has allegedly been involved in a traumatic event.1 An attempt to investigate the alleged event and gather evidence by talking with the patient can occur if the patient gives permission.9 The goal of LEPs is to rapidly initiate the investigation because the accuracy of the information degrades with time.6 HCPs have the right to provide care while evidence is collected, raising concern for the protection of PHI.4,10,11 If the HCP is unsure how to manage the clinical setting and provide protection of PHI, contact the institution's legal department. Many situations occur in the clinical environment, and laws vary from state to state. Therefore, the prudent measure is to contact your risk management or legal department for guidance in an uncertain situation.
Unconscious patients or patients in custody
Federal regulations stipulate requirements to release PHI to LEP if the patient is unconscious and not in custody.18 The institution's legal department should be contacted before the release of PHI of an unconscious patient to LEPs if there are any questions.
When a patient is comatose or unable to provide informed consent and no surrogate decision-maker is available, the organization may record, film, or photograph patient-care activities.19 For instance, if an unconscious patient arrives with large wounds, pictures of the wound may be taken on a facility-based camera and placed into the patient's EHR without the patient's consent.
If the patient arrives in lawful custody, disclosures to the LEP should be limited to the minimum necessary.8 The LEP may remain at the bedside during care but should not interfere with patient care.3,4 If the healthcare team wants to talk to the patient privately, the officer can be asked to step away from the bedside; however, the detaining officer does not have to comply with this request. The HCP should be aware that the officer's primary duty is to protect the public from harm, as the patient may appear harmless but may be dangerous. Also, if the patient is in police custody, family members' contact should only be made through law enforcement avenues. Notifying significant others of the patient's location may endanger the staff and visitors.
Photography or video recorded by patients or visitors
Questions are raised regarding the increased prevalence of video recordings by patients or family members when patient care is rendered.5 Some have voiced concern regarding video or photography capture without the HCP's awareness.5 According to The Joint Commission, having a nurse obtain consent is not required for recordings performed by a patient's family members or friends when the recording by a patient or family member does not interfere with patient care and does not capture other patients or PHI.19 An HCP can verbally consent to be recorded if requested by a patient or family member.19 Institutions should provide and enforce policies for the use of video and have the policy displayed prominently for patients, families, and visitors to read. The ability to record healthcare while it is being provided is at the discretion of the healthcare facility.3-5 HCPs should be vigilant in watching videos taken, especially in emergency settings. Patients and visitors are more prone to want to capture "exciting" images to share with family or friends.5 All HCPs should follow the medical facility's policies and if questions or concerns arise, refer to the legal department for guidance. The facility must comply with PHI mandates and provide guidance to visitors regarding the attempt to retain video and the need to perform erasure to comply with HIPAA and state privacy laws.3,4
Visitors and families do not have the same restrictions and are often unaware of the HIPAA rule, which applies to covered entities.5 The HCP must maintain privacy for their patients by closing curtains and doors and should avoid holding patient discussions in a public area.
Videos or photographs by HCPs
Obtaining informed consent from a patient or family member is required any time recordings, films, or other images of patients are used for purposes other than the identification, diagnosis, or treatment of the patient per The Joint Commission.19 Examples requiring consent may include but are not limited to performance improvement, education, and promotional literature.
Organizations are required to have a written policy that describes the following:
* The specific care, treatment, and services that require informed consent;
* The circumstances that would allow for exceptions to obtaining informed consent;
* The process used to obtain informed consent;
* Documentation of informed consent in the patient record.19
The institution's policy must also address circumstances under which images of patients may be obtained via cameras and cell phones, how such images may be used, when informed consent is required, and how unauthorized access and use will be prevented.19 If any patient recording or image is used for other than identification, diagnosis, or treatment, informed consent must be obtained from the patient or family.19 Policies should also address instances in which patient images are made on cameras or cell phones and how the images may be used. Staff should never use personal devices to obtain photos or videos of patient care.19 Organizations should work with risk management and legal counsel to determine any applicable state or federal requirements.
Instances in which consent may not be required include the documentation of abuse or neglect; for the safety or security of patients, HCPs, and visitors; patient identification; and clinical conditions monitored via video surveillance.20 If an image is used for educational purposes, the image must be stripped of any direct patient identifiers.19 If a video is used for research, the recordings must be approved by the institutional review board and included in the consent/authorization documents.19,20
Concerns in the healthcare setting
Police presence may be justifiable and desirable to gather evidence from crime victims and provide safety.10,11,21 Confusion may occur between HCPs and LEPs for several reasons. First, most HCPs are unaware that hospitals do not have the authority to mandate LEP use of body-cam video.3,4,22 Second, regulatory requirements apply differently to LEPs and HCPs, meaning the same rules do not govern LEPs. Due to the growing number of visits by LEPs to the hospital setting, research to promote best practices for interactions between LEPs and HCPs is needed.3,4,15,21,22
Nursing considerations
Before an LEP comes to the bedside, ensure the patient agrees to their presence and is draped appropriately. HCPs generally do not realize that HIPAA applies to covered entities but not always to visitors. For example, visitors are allowed to photograph family members or significant others. Privacy issues can arise when other patients are accidentally included in the photograph.5 Reminding visitors of other patients' privacy rights sets limits on videophotography.5 Attempting to ban cell phone or laptop use completely may not be realistic, but reminding visitors and patients of others' right to privacy is tenable and realistic.5 HCPs must enforce the protection of PHI and the observance of the institution's policies. Institutions should ensure clear communication of the hospital's policies to HCPs, patients, and visitors for video and camera use in the clinical setting. Institutional rules regarding the use of video should be prominently displayed and enforced. Hospital Compliance Officers may include the legal department, security, LEPs, and HCPs when developing policies governing the clinical use of video. These policies should conform to the state and federal requirements, provide clear guidelines for all parties, and provide clear regulations for patients and visitors. Institutions are required to abide by HIPAA, but the institution may also apply more stringent rules for using video in their facility.
If an LEP requests information, the HCP should contact the hospital or administrative supervisor on duty, who will notify the institution's legal department. When LEPs are interviewing a patient, the HCP should assume video recording may occur.
There are several considerations to increase compliance with regulations. One is for HCPs to sign up for the Office of Civil Rights updates to stay apprised of current privacy and security mandates.23 The inclusion of policy updates into current policies and procedures is important.23 Demonstrating good faith efforts to promptly solve any violations and developing a system to identify any violations is helpful.23 And, regular education sessions to ensure HCPs receive up-to-date materials are beneficial.23 Lastly, minimizing the likelihood of a privacy or security breach by raising HCPs' level of awareness is advantageous.23
Conclusion
Complex situations in healthcare facilities may require the involvement of LEPs and their use of BWCs. The increasing use of audio and video recordings in healthcare settings requires HCPs to stay abreast of their institution's policies to ensure patient-care privacy and PHI confidentiality. When a situation causes doubt, referring to the facility's legal, security, or risk management departments for guidance is good counsel. With technology constantly evolving, establishing policies or processes that HCPs understand is essential for protecting patients' rights and increasing cooperation with LEPs.
REFERENCES