Ms N could not get the toddler off her mind after she arrived home from her job as a nurse in the pediatric intensive care unit (ICU) of a local children’s hospital. The nurse had been in practice and working at the hospital for a decade and yet had never seen someone with this child’s disease — it had all but been eradicated. In fact, over the past decade, only 8 instances had occurred in the large city where Ms N worked. The disease? Measles.
Ms N had always had mixed feelings about vaccinations, despite working in the healthcare field. In fact, she’d opted out of some vaccinations for her own 12-year-old son. She even belonged to some Facebook “anti-vaxxers” groups.
But what she’d seen in the hospital today had really shaken her to the core. The toddler had contracted measles overseas. Although his older siblings had been vaccinated, he was too young to receive any vaccines before the trip. The child was covered in a splotchy red rash, was in great pain, and had a high fever. Even a gentle touch to the child’s skin caused him to moan and cry.
Continue Reading
Ms N pulled her chair up to her home computer and signed onto Facebook. She pulled up the “Proud Parents of Unvaccinated Children” group and began typing about her experience. “For the first time in my career I saw measles this week. Actually, most of my coworkers and the ER docs saw measles for the first time as well. And honestly, it was rough. The kid was super sick—sick enough to be admitted to the ICU, and he looked miserable. You couldn’t touch him without him crying or moaning in pain. It was terrible. I think it’s easy for us nonvaxxers to make assumptions about these diseases, but most of us have never and will never see one of them.”
She wrote more about the child’s experience and how it was scary enough to almost make someone change his or her antivaccination stance, but she reiterated that she had not changed her own views on vaccinations.
Ms N’s name and place of employment were on her Facebook profile, so anyone in the group knew which hospital she was referring to. The parent of another patient admitted to the same hospital saw Ms N’s posts and became concerned that her child may have been exposed to measles. The parent took screenshots of Ms N’s posts, which she then shared to the hospital’s Facebook page. The hospital immediately issued a statement in response. “A patient treated at [children’s hospital] tested positive for measles. This is a highly contagious, vaccine-preventable infection. We know vaccination is the best protection against measles. We work closely with public health entities to continuously monitor highly contagious diseases in our local, national, and international communities. Our Infection Control and Prevention team immediately identified other children who may have come in contact with this patient to assess their risk and provide clinical recommendations. We have contacted all of those families. We are also aware that one of our nurses posted information on social media, and we take these matters very seriously. A thorough investigation is underway.”
Ms N was put on probation while the hospital launched its investigation. She was fired from her job 3 days later. The hospital said she had breached hospital policy and that her actions were in violation of the Privacy Rule under the Health Insurance Portability and Accountability Act (HIPAA) of 1996.
Legal Background
The HIPAA Privacy Rule was enacted in 2002 to protect the privacy of patients’ personal health information while simultaneously allowing the information necessary to provide quality healthcare to continue to flow through the medical system. It requires covered entities — including hospitals, health plans, and healthcare providers — to treat patient information as confidential.
While much of the public mistakenly believes that an individual can be sued for a HIPAA violation, this is not the case. The Unites States Department of Health and Human Services Office for Civil Rights (OCR) is responsible for enforcing the HIPAA Privacy Rule. From April 2003 to March 2019, OCR has investigated and resolved more than 26,683 legal cases by requiring changes to privacy practices and correcting actions by or providing technical assistance to HIPAA-covered entities. OCR has also settled or imposed civil penalties in 63 cases totaling $99,581,582. While a patient can file a complaint, this is a government-enforced rule and as such does not create a private cause of action by someone whose personal health information was compromised. Note, though, that related civil actions — such as for negligence or breach of privacy — may be taken by someone who has been harmed by a HIPAA violation, but it is not the HIPAA violation itself that creates a cause of action for a private party.
As a clinician, the greatest risk from committing a HIPAA violation is not being sued by a patient but losing employment. Numerous cases of healthcare practitioners being fired for violating their hospital’s privacy policy exist. Hospitals and practitioners can set their own standards for protecting patient privacy.
Protecting Yourself
It should go without saying that clinicians should never post about patients on social media, even in a “closed” group or on a personal “page.” Social media is the opposite of private.
The city where this event took place has a very high vaccination rate of almost 95%. Less than 10 cases of measles had occurred there in the past decade. Thus, because Ms N posted what the disease was with her place of employment listed on her profile, it was possible for the child to be identified even though his name wasn’t revealed. A person does not need to be mentioned by name in order to be potentially identified with current technology. If any personal identifiable protected health information (in this case disease, hospital, age group, and sex) is posted to social media without the consent of the patient, it is a violation of the HIPAA Privacy Rule.
An interesting note is that if this case had happened in one of the areas that are currently experiencing an outbreak of measles cases, it would have been much more difficult to identify the child due to the sheer number of cases. But the combination of a high vaccination rate and extremely low incidence in the city where this took place made it clear who the patient was.
Keep your social life and your work life separate, and only post to social media what you’d want (and is appropriate for) the whole world to see … because that’s exactly who may be seeing it.
Ms Latner, a former criminal defense attorney, is a freelance medical writer in Port Washington, New York.
