Am I going to be booked for HIPPA violations?

April 16, 2012 2:34 PM

Part of my job involves conducting phone surveys for public health/medical research. My employer wants me to start using the Emergency Contact info in the electronic health record to increase our response rate. This weirds me out. Help!

I'm a research assistant for a group working at a children's hospital. Part of my job involves calling people and asking them to do follow-up surveys. My success has been limited, and my boss, a physician at the hospital, told me to call the people listed as Emergency Contacts in the electronic health record and ask for an updated phone number for the subjects. I said I wasn't comfortable doing it, and that if I, as someone's emergency contact, was called about something like this, I'd be really freaked out. Some of the parents I've talked to have been worried by my calls, and they were the ones to sign the consent forms, so I imagine the reaction from the ECs to be even worse. (I.e., "Oh my God, what's wrong? Is she okay? Do I need to come to the hospital?") My boss brushed me off, saying that it was fine, and that the emergency contacts were used to stuff like this because, as part of a low-income community, their family members are often moving/ gaining and losing phone service.

This still squicks me out, and more importantly it seems like it might be a HIPAA violation, especially if I stick to the script and identify myself as being from the Center for Scurvy* Research and I'm calling because a year ago, Child's Parent agreed to participate in a survey about Child's scurvy.

How do I address these concerns? Do I go to HR? The IRB? Is there a relevant section of HIPAA law that addresses a situation like this? Or am I beanplating it, and should I just do as my boss says?

*Not actually what we study.

posted by anonymous to law & government (9 answers total)

Your hospital should have a department called something like Privacy & Corporate Compliance. They would be the best people to talk to about a HIPAA concern like this.
posted by strangely stunted trees at 2:53 PM on April 16, 2012 [1 favorite]

It's definitely questionable, but people don't really get arrested for HIPPA violations and HIPPA is so generally vague that unless you are egregiously violating PHI privacy, you probably wouldn't get into trouble at all.

That said, you should have a compliance officer in your organization as mentioned before and you should call that person if nothing else than to try and get an out. You will not be making friends with your boss though.
posted by Kimberly at 3:10 PM on April 16, 2012

I said I wasn't comfortable doing it, and that if I, as someone's emergency contact, was called about something like this, I'd be really freaked out.


But you're not the person with a kid who's been in the hospital. I don't think you can use your own imagined reactions in all situations. If people do lose phone service, how would you get reach them? I think you might give it a try, after finding out about the privacy regulations. You're only asking for current contact information, not asking the EC to take the survey, right?
posted by Ideefixe at 3:55 PM on April 16, 2012

Yes, you can talk to your compliance officer - and if you have access to your research project's Institutional Review board protocol, take a look at that. Your IRB probably required that you be very specific about which information from the health record you would access and how you would use it. You may find that you're actually covered and thus have no worries, or else you'll have a concrete thing you can point to and say "We can't do this based on our protocol, so let's put in an IRB modification to let us do this." At that point, the IRB will give you the green light or else tell you for sure that you can't do this.

My research study does not have access to emergency contacts, but for what it's worth, as a research coordinator and an IRB member, I'd feel this probably was not kosher unless the protocol and consent form very clearly said "We may get your emergency contact person from your medical records and call them if we can't reach you."

Otherwise you are potentially alerting the emergency contacts to the child's "scurvy" without the parent's consent and that is not generally okay.
posted by Stacey at 3:58 PM on April 16, 2012 [1 favorite]

I work in this area (health information privacy), though not in the US. In my jurisdiction it would be an absolute no-no.
posted by Sebmojo at 4:07 PM on April 16, 2012

In any healthcare setting, anything that is remotely questionable with regards to health information privacy should absolutely go to the compliance office for review. With regards to your situation, I'd be very surprised if this were permissible unless the patients have signed a consent form allowing you to contact the emergency numbers as "alternate contacts." Based on the information you've provided, they are only to be contacted for emergencies. Contacting the emergency number to track down the patient to provide them with information that could affect their health could be justifiable (even then, I'd double check). Contacting them in the interest of the physician's research project not so much.
posted by waterandrock at 4:39 PM on April 16, 2012

Call your IRB rep and HIPAA privacy officer and float the idea to them. Tell them that it was suggested by someone on your team and you're uncomfortable with it. Any change in your protocol will have to be approved by them anyway. If they can talk it out with you, it may save having to submit an amendment to the protocol, and you'll have official word that it's not an option.
posted by vitabellosi at 6:42 PM on April 16, 2012

Is this a formal research study? Does your hospital have a Research Ethics board?

The study that I interview for had a very rigourous formal application to the Research Ethics Board, including a full description of our recruitment strategy. We're not allowed to change our ads or recruitment unless we get approval.
posted by jb at 9:48 PM on April 16, 2012

This would be a considered a serious breach of ethics at my institute unless A. parents had previously consented that the emergency contact info could be used for the purpose of the study or B. an amendment describing the plan to use this contact info for the study was submitted to the institutional ethical review board and approved. It does not sound like these things have happened. This is something you should push back on- although your boss may be annoyed in the short term, you could be saving him/her from the long-term career damage that an ethics violation could do (imagine if you called an emergency contact, and they freaked out, then they complained to the hospital administration? The entire study could get shut down or at least delayed for investigation).
posted by emd3737 at 4:59 AM on April 17, 2012