Professional and Privacy Obligations in Unconventional Environments
In our current climate where many health professionals are delivering services from unconventional locations, such as their living rooms, a case from the Health Professions Appeal and Review Board provides some important lessons on privacy law obligations.
This case involved a dietitian seeing a client at a minimum security correctional institution (the “Institution”). This client was concerned that the dietitian violated his privacy and confidentiality by conducting his consultation in an open area in the prison and leaving his file open on the table.
The dietitian explained that on the date in question, all of the clinical offices at the Institution were in use. The Institutional Head had assigned her to conduct her appointments at a workstation in an open area, which was also used as a kitchenette for the staff to make their lunch. The dietitian advised the Inquiries, Complaints, and Reports Committee (the “Committee”) that the Institutional Head was responsible for ensuring appropriate space was available for the provision of confidential health services, she was not responsible for ensuring the space for her clinics.
When the client arrived for his appointment, the dietitian explained to him that she did not have a private space for their appointment and that if he was uncomfortable with this arrangement, it was his right to refuse to be seen and he could be rescheduled for her next clinic if he preferred. When the client did not give her a direct answer but followed her to the area, she assumed that she had implied consent to proceed with the appointment. At one point during the appointment, another inmate came into the area to clean it during the consultation, but she halted the consultation while the cleaner was within earshot.
After considering the complaint made by the client that the dietitian had violated his privacy by conducting his appointment in an open area, the Committee decided to provide the dietitian with a written caution regarding her professional obligation to take adequate measures to secure the personal health information of her clients.
The Committee found that although the meeting space arrangement was outside of the dietitian’s control, she was responsible for ensuring the confidentiality of her clients’ private health information.
The Committee found that the dietitian failed to recognize the challenges posed by the space and take steps to protect her clients’ confidentiality, for example by raising concerns with the Institution or by rescheduling her appointments for the day.
The Committee also noted that although it was not unreasonable for the dietitian to assume that she had the client’s implied consent when he followed her to the workstation, under the circumstances, the Committee believed it might have been better to obtain express consent to proceed.HPARB found that the Committee’s decision to issue the dietitian a caution with respect to her privacy law obligations was supported by the record before the Committee, and that this decision was reasonable.
A few lessons from this case:
Asserting that another person or entity (such as your employer or your video-conference provider) is responsible for ensuring adequate privacy measures will not absolve you of your own professional obligation to protect your client’s privacy
You should be exercising your own independent judgment to determine if adequate privacy measures are in place
Express consent with respect to privacy should always be considered as a best practice, and it should especially be practiced where there are unusual or unique circumstances giving rise to special privacy concerns
Delivery of services by telepractice is, in our view, a circumstance that gives rise to special privacy concerns. We would therefore recommend that you discuss these privacy risks with your client and obtain express consent to provide services via telepractice
