Reference no: EM133244517

Question - REAL-WORLD CASE

What, exactly, is deidentified information? This chapter and the accompanying figure 2.5 seem to provide a fairly clear answer. However, a tragic case demonstrates that the answer is not always straightforward. An 18-year-old male high school student lived in a community of approximately 40,000 people and was a member of the high school basketball team. He died after the car in which he was a passenger struck a tree in a high-speed crash. The young man's health records were disclosed without authorization by the provider and later used as a case study in a high school class discussion about driving safety. Although his name and other obvious identifiers such as date of birth and Social Security number were not used, because the nature of his injuries was unique, it was apparent to those who knew him and those who were aware of the accident that the records being used were those of the student.

It was concluded that no state law was violated, although a state law was subsequently passed requiring that healthcare providers have policies in place to limit "the use and disclosure of medical records, images, videos, or pictures intended to be used for medical educational purposes..." and it further requires protocols for written authorizations (Colby Stansberry Act 2010). Apparently no HIPAA complaint was filed either. However, this case brings into focus the 18th (and final) identifier: Any other unique identifying number, characteristic, or code, except for permissible reidentification. It is also a reminder of the actual knowledge provision: for information to be deidentified, the covered entity does not have actual knowledge that it could be used alone or in combination with other information to identify the individual. Here, the nature of the injuries alone made the individual identifiable. Although this case may not represent the norm with respect to deidentification, it highlights-through a tragic set of circumstances-that removal of all clearly stated identifiers may not deidentify PHI and that all 18 identifiers set forth in HIPAA including the final identifier, as well as the actual knowledge provision, must be carefully considered. 

Discuss how you might apply to AHIMA Code of Ethics to this case, specifically, which principles from the code apply to the situations and how might you prevent these violations from occurring in the future?