9.3 Security: Privacy and Informatics

Protected Health Information

Any individually identifiable health information that is transmitted or maintained by a covered entity or business associate is protected health information (PHI). This information includes demographic information (e.g., name, address, birth date), medical histories (including medical record number), test results, and health insurance information. Healthcare workers have a responsibility to ensure the privacy and security of PHI to protect the confidentiality, integrity, and availability of this information. Nurses can ensure they are protecting patients’ information by using a password to log into the computer, logging off after each interaction, ensuring no one unauthorized is viewing the computer screen, and taking care when having conversations where patient information may be shared. All PHI is protected under the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act. Healthcare workers must understand the regulations and policies surrounding PHI, including the minimum necessary standard, which requires healthcare workers to only access and disclose the minimum amount of PHI necessary to perform their job duties. By understanding the importance of protecting PHI, healthcare workers can help to maintain patient trust and promote the safe and effective delivery of healthcare services.

Health Insurance Portability and Accountability Act

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that was enacted in 1996 to protect the privacy and security of patients’ health information (U.S. Department of Health and Human Services, 2018). The regulations of HIPAA apply to covered entities, including healthcare providers, health plans, and healthcare clearinghouses, as well as their business associates. The law requires covered entities to implement administrative, physical, and technical safeguards to protect patients’ PHI from unauthorized access, use, or disclosure (Figure 9.8). Also, HIPAA gives patients the right to access their PHI, request corrections to their PHI, and receive an accounting of disclosures of their PHI. Healthcare workers must understand and comply with HIPAA regulations and policies to protect the privacy and security of patient information and avoid potential legal and ethical consequences (American Medical Association, 2024; ANA, 2015). Another initiative to help protect PHI has been recommended as a best practice standard from The Joint Commission. This initiative involves the patient assigning a code word upon admission to a hospital. Anytime a loved one or family member calls the facility for an update, the nurse must request they provide the assigned code word in order to receive information about the patient’s status. This is just one example of the many ways healthcare facilities are attempting to ensure the privacy of PHI.

Figure 9.8 Protecting the privacy of patient information is the responsibility of all healthcare providers. Nurses must ensure they take the necessary steps to adequately protect patient’s information. (data source: Ponemon Institute, 2010 Benchmark Study on Patient Privacy and Data Security; attribution: Copyright Rice University, OpenStax, under CC BY 4.0 license)

If a patient expresses concerns about information captured using technology in the healthcare setting, a nurse can have a conversation to address their concerns and provide reassurance. The nurse might start by acknowledging the patient’s concerns and asking for specific details about what they are worried about. For example, the nurse might ask if the patient is concerned about their PHI being shared with unauthorized individuals or if they are concerned about the security of the facility’s technology systems. Once the nurse has a better understanding of the patient’s concerns, they can provide information about the facility’s policies and procedures for protecting patient privacy and ensuring the security of technology systems. The nurse can explain the measures that are in place to protect patient information, such as using secure networks and encrypting data. They can also discuss the importance of patient privacy and reassure the patient that their information is only accessed on a need-to-know basis. Finally, the nurse can ask the patient if they have any additional questions or concerns and provide resources for the patient to learn more about the facility’s technology policies and procedures. This conversation can help the patient feel more comfortable with the use of technology in their care and build trust between the patient and health care.

Telehealth

In telehealth, electronic communication technologies are used to provide remote healthcare services, including consultations, monitoring, and education (ANA, 2020; National Council of State Boards of Nursing [NCSBN], 2020). Nurses play an important role in telehealth delivery by providing triage, assessment, education, and care coordination to patients who are unable or prefer not to access care in person. Nurses who specialize in telehealth must be knowledgeable about the technology and equipment used as well as the legal and ethical issues related to remote healthcare delivery. They also need to be skilled in communication and patient education to ensure that patients receive safe, effective, and patient-centered care (ANA, 2020; NCSBN, 2020). As the use of telehealth continues to grow, nurses who are proficient in telehealth technologies and practices will be in high demand and play a critical role in expanding access to care and improving patient outcomes (Figure 9.9).

Figure 9.9 Telehealth provides a means of improving access for both patients and providers. (credit: “190605-N-AW702-012,” by Navy Medicine/Flickr, Public Domain)

Telehealth can improve access to health care in rural settings where patients may not have a primary care provider. The use of telehealth applications also means rural residents do not have to take on the expenses of traveling to urban centers for care. During the COVID-19 pandemic, the use of telehealth as a component of care was essential and demonstrated both the benefits and challenges of its use.

Meaningful Use

An essential component of nursing practice in today’s healthcare environment is meaningful use of technology, ensuring technology being utilized in healthcare settings is done so purposefully and with the intention of improving outcomes. Nurses use various technologies, such as EHRs mobile devices, telehealth, and clinical decision-support systems (CDSSs), to improve patient care, safety, and outcomes (ANA, 2018). Nurses who understand and use technology effectively can enhance their practice and improve the quality of care they provide (Lee & Mills, 2018). Meaningful use of technology also requires nurses to be knowledgeable about legal and ethical considerations related to technology use, such as data privacy, security, and confidentiality. Nurses must also stay up to date with new technologies and be able to adapt to changes in technology and software applications.

Documentation

Technological advances have improved connectivity and access to information and resources in healthcare settings. Computers used to access an EHR can be found in patient rooms, on wheeled carts, in workstations, or even on handheld devices. Nurses and other healthcare workers are able to quickly obtain results from point-of-care testing or share images to consult with colleagues (Figure 9.10).

Figure 9.10 Electronic health records are essential tools in healthcare settings. Nurses play key roles in collecting data and transmitting it to the healthcare team. (credit: “Winn Army Community Hospital Pharmacy Stays Online During Power Outage.jpg,” by MC4 Army/Flickr, CC BY 2.0)

Point-of-Care Testing

In point-of-care testing (POCT), diagnostic testing is performed at or near the patient’s bedside, rather than in a centralized laboratory (Bellartz et al., 2022). This approach allows for rapid diagnosis and treatment decisions, which can improve patient outcomes and reduce healthcare costs. In the nursing profession, POCT is becoming increasingly important as it allows nurses to quickly assess and monitor patients as well as to make informed decisions about their care. For example, blood glucose monitoring is a common type of POCT used by nurses to monitor patients with diabetes.

Other types of POCT include tests for infectious diseases, such as influenza and strep throat, and tests for cardiac biomarkers, such as troponin. While POCT can provide many benefits, it is important for nurses to be trained in its use and to follow appropriate quality control measures to ensure accurate results. Additionally, nurses must be knowledgeable about the limitations and potential sources of error associated with POCT.

Technology in Patient Education

Technology can play a vital role in providing and supporting patient education in health care. To provide patients with access to their medical records and educational resources, EHR systems and patient portals are used. These resources can include videos, audio recordings, interactive graphics, and written materials that can help patients better understand their conditions and treatment options. Mobile applications and wearable devices can be used to help patients track their health status, monitor symptoms, and adhere to treatment plans (Buvik et al., 2019; Välimäki et al., 2016). Telehealth and remote monitoring technologies can provide patients with access to healthcare professionals and educational resources in real time. This is particularly important for patients who are unable to attend in-person appointments due to distance, mobility issues, or other barriers (Rickard et al., 2019). Virtual education sessions, webinars, and group discussions can also be held using videoconferencing software to promote patient engagement and collaboration. Technology has the potential to enhance patient education and improve health outcomes by providing patients with timely and accessible educational resources, increasing their engagement in their own care and promoting better communication between patients and healthcare providers. However, it is important to ensure these technologies are accessible to all patients, including those with limited digital literacy, and that they are designed in a way that meets patients’ needs and preferences. And, while patients are free to use their personal devices to communicate with their healthcare team, healthcare professionals must always use the device provided by the organization to communicate with their patients. Using personal devices creates a breach in the security and confidentiality of the patients’ private health information.