How firefighters unintentionally violate HIPAA and similar policies

A lawsuit has been filed against a firefighter in the State of New York for breach of confidentiality with medical information obtained on an emergency call. The lawsuit states that the firefighter disclosed “personal and sensitive confidential medical information” about the plaintiff at a party, shortly after an emergency call at the patient’s home.

On the surface, this seems outrageous. As emergency medical care providers, firefighters may be covered by HIPAA law or state laws that take an even harder line about confidentiality. Talking about a patient’s personal medical history at a party? Who would do such a thing?

Unfortunately, many people would, although probably without malicious intent.

Think about it: How many times have you told a story about a crazy or disturbing call to someone who is not on the job? You probably did not include the patient’s name when telling the story. But maybe you included other clues to that person’s identity – their address or their occupation or other identifying details.

How we violate HIPAA

HIPAA – the Health Insurance Portability and Accountability Act – went into effect in 1996. The law includes many provisions, but one of them is that it generally prohibits healthcare providers and healthcare businesses from disclosing private information to anyone other than a patient and the patient’s authorized representatives. This provision may apply to firefighters and paramedics, depending on the billing status for response. And perhaps more importantly, most states have medical confidentiality laws that preceded HIPAA and often hold providers to a higher standard.

So how does it happen that a firefighter might casually violate these laws? There are two ways:

1. Firefighters may not see themselves as medical care providers. Many don’t have advanced training and they usually don’t directly bill for services, so they may not feel that HIPAA and similar laws apply to them.
2. When telling stories, firefighters may feel that they do an adequate job concealing the identity of the person they are talking about. If they don’t use the person’s name, firefighters might feel that they have done enough to protect personal information.

But both these rationales have failings.

Although HIPAA might not apply in a given situation, there are likely other laws or policies in place that do restrict the sharing of someone’s personal information. And just as a matter of moral and professional conduct, we should not be casually talking about other people’s personal medical information under any circumstances.

And someone’s identity might be shared through other means than simply saying their name. Especially in smaller towns, people tend to know each other and can quickly guess who you are talking about simply from the location of the call or a description of the event.

Many people might tell themselves that they would never do anything to violate confidentiality of those they encounter on the job. But imagine this situation: You run into a close friend and that person says to you, “I saw the fire truck over on Maple Street yesterday. What was going on?” You might reply, “We had a medical call over there. An older guy who was living alone had a seizure and hit his head.” And then your friend responds by saying, “Oh no! Was that Tom Wilson’s house? I was just over there two days ago! Is he OK?”

Now what do you do? Do you confirm for your friend that the person he cares about is all right after having a seizure? Do you lie and say that it wasn’t Tom’s house? Or do you obfuscate at this point and mumble, “I really can’t talk about that.”

Of course, you shouldn’t be talking about it. But the fact is, you already are. And this person you are talking to is a good friend, a trustworthy person, right? Even so, sometimes things go too far before you even realize where they are going. How can firefighters do better in this regard?

How to talk about medical calls

The lawyer for the family in the New York case commented that he suspects the firefighter was not adequately trained on keeping medical information private. He’s almost certainly right about that. Many firefighters, both paid and volunteer, receive inadequate training on the requirements of confidentiality laws and standards of professionalism. This is demonstrated by continuous conflicts over photographs taken at emergency scenes, among other examples.

But awareness of law and policy are not enough. The solution to this problem is not to simply tell firefighters not to talk about the calls they go on when they are away from work. Firefighters need to talk about the incidents they respond to, and not just among those they work with. Firefighters also need the support of family members and close friends as they deal with the difficult things they experience on the job.

The key is learning how to talk about those calls. When talking about a medical call, it is not appropriate, or even legal, to include personal details about those involved – names, specific ages, addresses, details of medical or family history. Ultimately, these details are not even important in the aftermath. When processing difficult or challenging events, what is important is how you reacted and how you felt about it.

When the incident is framed in this way, there will be no concerns of confidentiality for those who received medical care. Instead, the concern for confidentiality will shift to the firefighters themselves who are allowing themselves to be potentially vulnerable in talking about their actions and their feelings. Knowing this, firefighters will choose carefully who they share their confidences with.

Proceed with caution

Few firefighters have malicious intent when they talk about things they have experienced on the job, but they do need to be careful. Like other professionals, firefighters can be subject to laws and policies regarding confidentiality. On a higher level of morality and professionalism, all firefighters should want to be good examples in this area.