Confidentiality

Home Standards Q&A Confidentiality

Would it be considered a HIPAA violation if a correctional officer looked at the information in an inmate’s medical records? Does NCCHC have standards that address this topic?

Standard H-02 Confidentiality of Health Records requires that the confidentiality of a patient’s written or electronic health record, as well as orally conveyed health information, is maintained. The responsible health authority should control access to the health records and health information. The RHA should maintain a current file on the rules and regulations covering the confidentiality of health records and the types of information that may or may not be shared.

Standard C-08 Health Care Liaison requires that a designated trained liaison coordinate the health services delivery in the facility on those days when no qualified health care professionals are available for 24 hours. The health care liaison may be a correctional officer or other person without a health care license who is instructed by the responsible physician in limited aspects of health care coordination. The health care liaison generally carries out the following duties: reviews receiving screening forms for follow-up attention; reviews nonemergency health care requests as instructed by the responsible physician; helps to carry out clinicians’ orders regarding such matters as diet, housing and work assignments; and maintains patients’ rights to privacy. The health care liaison does not deliver health care.

— From CorrectCare Volume 30, Issue 2, Spring 2016

Our administrators are having trouble deciding how to approach PREA Standard 115.15 Limits to Cross-Gender Viewing and Searches, in particular part (e), which addresses trying to determine an inmate’s genital status. The PREA standard states that it can be accomplished by conversing with the inmate, by reviewing medical records or as part of a broader medical examination. Our medical staff are stating that they are not to be involved in the process of determining genital status. Does NCCHC limit them in this way?

Concerning PREA, in NCCHC’s 2014 Standards for Health Services, standard B-04 Federal Sexual Abuse Regulations only requires written policy and defined procedures for how the facility will comply with this federal law. The situation you describe extends to other areas of the standards, particularly involving a patient’s right to privacy and confidentiality of health records. Medical practitioners may learn of an inmate’s genital status through routine medical examinations for medical purposes, such as during the initial health assessment. Health staff should not do an exam for the sole purpose of determining genital status.

NCCHC standard A-09 Privacy of Care requires that discussions among staff regarding patient care occur in private, without being overheard by inmates and nonhealth staff, and that clinical encounters occur in private, without being observed or overheard. Standard H-02 Confidentiality of Health Records requires that health records are stored and maintained under secure conditions separate from correctional records, and that health staff receive instruction in maintaining patient confidentiality.

However, local, state or federal laws may allow certain exceptions to the obligations of health care professionals to maintain confidentiality. The responsible health authority should maintain a current file on the rules and regulations covering confidentiality and a list of the types of information that may or may not be shared. Health staff should inform inmates at the beginning of the health care encounter when these circumstance apply. Otherwise, releasing confidential medical information to nonhealth staff would require the written consent of the patient.

— From CorrectCare Volume 29, Issue 1, Winter 2015

Where do we draw the line on what is considered “confidential” patient information? Health services conducted a urine toxicology screen of a prisoner and the results indicated the presence of an illicit drug. Is this protected medical information or should we notify custody? Do we just drop a hint, or do we name names?

Assuming that the test was for clinical purposes (and it should have been, as per standard I-03 Forensic Information), the results should be used for clinical reasons only. You may share with the appropriate officials your concern that the substance may be present in the prison so that they can look into the possible security breach. However, the inmate’s identity must be protected. To avoid conflict or pressure from custody, health services policies and procedures should address the role of health staff in such an event and the warden and custody staff should have a clear understanding of this role. (See A-03 Medical Autonomy and H-02 Confidentiality of Health Records.)
— From CorrectCare Volume 24, Issue 3, Summer 2010

It was recently brought to my attention that inmates working in our kitchen have access to information about medical diets for other inmates; therefore, they may know about an inmate’s medical condition. Do you have any suggestions on how to address this situation?

The most important consideration here is that an inmate who requires a medical diet actually receives the diet (see standard F-02 Medical Diets). Inmate workers perform a variety of duties in the kitchen, and it may not be possible to prevent knowledge of the fact that a particular inmate is receiving a special diet. However, the recipient’s confidentiality can be protected to some degree by limiting the information on diet cards to the type of diet ordered (e.g., low sodium, bland) and the duration without specifying the inmate’s condition or diagnosis.
— From CorrectCare Volume 23, Issue 1, Winter 2009

I am a nurse who works in a state prison. One of our inmates is getting married, and I have been designated as the health staff member to review his health record with his fiancée before the wedding. The inmate has given his written permission to do so. I am uncomfortable about this and the need to protect the confidentiality of health information. Can you provide any advice?

NCCHC standards focus on the health services provided to incarcerated individuals and do not address such issues as procedures for inmate marriages. This is the realm of state correctional and other authorities. Your concern about confidentiality is a simpler matter: Since the inmate voluntarily gave his consent for you to share his health information, the requirement is met from NCCHC’s standpoint.
— From CorrectCare Volume 19, Issue 3, Summer 2005

When an inmate says he’s going to kill someone and the mental health care provider (in this case, a psychiatric nurse practitioner) has that information, there are issues as to whether he should pass that information to the person who’s been threatened. This is covered in California law regarding "duty to warn." How is this covered in the jail standards concerning forensic information? Also, confidentiality issues are covered in the duty to warn law. Is confidentiality also covered in the standards?

All three sets of standards address confidentiality of health information (P-H-02, J-H-02 and Y-H-02). The situation you cite represents an exception. The right to confidentiality is not absolute and may be breached when there’s risk of serious injury or death to the patient, other inmates or staff. As you state, often state laws or regulations govern confidentiality of health information and the circumstances under which disclosure of certain information is permitted. The standard prohibiting collection of information for forensic purposes does not apply to your situation.

Most disciplines, including those affiliated with mental health, also require that such specific information be taken to the appropriate authority. Finally, it is good practice for the mental health clinician to tell the patient in their first encounter that certain issues cannot be kept confidential: “If you tell me that you are going to harm or kill yourself or someone else, or engage in behavior that jeopardizes the safety or security of the facility, I will need to tell the appropriate authorities.”
— From CorrectCare Volume 17, Issue 1, Winter 2003

My deputy warden and I would like to institute a statewide practice of identifying certain inmates with potential life-threatening conditions by using medical alerts on the back of their ID badges. I work part time in a state where this practice is in place and it works very well. As an accredited facility, is there anything that would preclude us from initiating this practice?

That depends on how you plan to carry out this program. Because of concerns about confidentiality of medical information, you could not, for example, use yellow bracelets for epileptics, pink lettering for mental health patients, red for HIV patients, etc. Someone seeing the medical alerts on the back of an ID badge should not automatically know what the problem is. On the other hand, if you make participation voluntary, inmates could choose whether they wanted to disclose their condition on a medical alert badge or not.
— From CorrectCare Volume 16, Issue 2, Spring 2002

Our QA group would like NCCHC’s position on the sharing of confidential patient information under the following circumstances: An inmate is given a urine tox screen by clinical services and is positive for an illicit substance such as cocaine, opiates, methamphetamines, etc. What information should be shared with the warden and/or designated custody control staff? The inmate’s name and substance(s) that tested positive? The inmate’s name and a hint that he should be tested by custody staff? No inmate identification, but the fact that illicit substance(s) are in the facility? No information?

In your scenario, I am assuming you work in a prison, and that the urine test, since it was done by clinical services, was for clinical purposes. The inmate’s results should be used for clinical reasons. The general concern that a particular substance may be in use in the facility may be shared with the warden or his designee in such a manner that the identity of the individual inmate is protected, but the issue regarding a possible serious violation of security regulations can be addressed. This type of situation should have been discussed with the warden when the health services policies and procedures were established so that there is a clear understanding of the role the health staff have and there is no pressure on health staff to reveal identifying details. The relevant prison standards are P-A-03 Medical Autonomy, P-H-02 Confidentiality of Health Records and P-I-03 Forensic Information.
— From CorrectCare Volume 15, Issue 4, Fall 2001; updated February 2010

Confidentiality

Newsletter Sign-up