38

The curriculum for the nursing program at my university regularly requires the student to write a detailed account of their HIPAA-protected medical information.

The assignments usually require posting the information on a discussion board that is open to 55 students and all nursing school professors from five campuses across Texas. We are then required to reply to and discuss two other students' HIPAA-protected information. Some assignments require us to reveal private information of family members, including mental health issues and conflicts within the family.

I spoke with my professor about the first assignment, which involved a three-generation genogram. She told me that I should feel better about it because that particular assignment would only be shared with multiple professors and a small group of students. The rubrics for these assignments include loss of points for using example information instead of the student's personal information.

I am appalled that these highly educated and experienced professors would trample all over the students' HIPAA rights while teaching us the importance of strict adherence to HIPAA. The practice seems to be common and entrenched in Texas nursing schools. The information we are revealing is not given voluntarily, it is a requirement.

I can't afford to be the crusader who takes this problem to the top. I want to graduate. Is there an organization that addresses this type of problem?

Improve this question
8
  • 3
    Do they give any justification for this? This has the feel of a research project with subjects "forced" to participate.
    – Buffy
    Jun 19, 2022 at 14:30
  • 4
    Buffy, this is based on the premise that the best way to learn is by personally relating to the concept being studied. I agree with that reasoning. The problem is that we are required to share that information with all teachers and fellow students. We are intelligent people. We can apply that concept without being forced to reveal private personal details in a discussion that is posted online for all eternity.
    – Susan Taylor
    Jun 19, 2022 at 14:54
  • 3
    Even if one is only revealing small bits of information, I think revealing private information of family members is not to be done.
    – Terry Loring
    Jun 19, 2022 at 15:33
  • 14
    Couldn't you make up all the information (in a believable fashion)? What means do they have to check it? Perhaps cover this in your question?
    – Peter Mortensen
    Jun 19, 2022 at 23:37
  • 15
    Just a tip: if that is your real name, do start using a pseudonym.
    – RedSonja
    Jun 20, 2022 at 7:18

5 Answers 5

Reset to default
41

In your case, HIPAA does not apply. You are not divulging patient information, but you are made to divulge information about yourself and others. Since the university is not a medical provider, HIPAA does not apply, and they make you divulge. But it is certainly an intrusive practice that raises privacy issues.

I can see that using yourselves as sample cases is useful for your education. Therefore, I would not expect help from professors and your dean.

The university administration might see things differently, especially since they have access to lawyers who would warn against engaging in dubious practices. This would be my first attempt. Approaching it as a group and asking to keep your names secret would be a prudent measure. Your strongest point is being asked to report incidents of venereal diseases and mental diseases in your family. While it just happens that none of your family is suffering from this, you should not be asked to share this information with other students.

If it is a public university, you can threaten with talking to your representative or with the trustees ex oficio. If it is a private university, you can threaten to bring it to the attention of trustees.

Improve this answer
5
  • 3
    A reference to back this up: HIPAA only applies to covered entities - health care providers, insurers, etc. Your nursing program isn't a covered entity. hhs.gov/hipaa/for-professionals/covered-entities/index.html
    – ceejayoz
    Jun 21, 2022 at 13:47
  • While the setting may not be in scope for HIPAA, the fact that the information would be covered is highly indicative that there's a problem
    – Chris H
    Jun 22, 2022 at 12:18
  • For whatever it is worth, in the EU and UK this is "Special category data" under GDPR and processing of such data is only allowed if you match one of nine conditions (article 9). None of those apply to the scenario where the educational institution processes the data of family members. From an EU perspective it's completely unbelievable that someone could freely store and collect such data as long as they aren't a "health company".
    – David Mulder
    Jun 22, 2022 at 14:52
  • IANAL, but I find it very unlikely that HIPAA doesn't apply. The list you linked to is indicative, not comprehensive (note the "including" and not "restricted to"). For instance, the kind of entity I work for—a company that provides genetic analyses as a service to hospitals—isn't mentioned, but I can assure you we are most certainly required to abide by HIPAA rules. More importantly, if the university is requiring such data, then they become an entity holding such data, storing (and therefore "processing") such data, and so are almost certainly a "covered entity".
    – terdon
    Jun 22, 2022 at 22:31
  • The question was actually about ethics, not the law.
    – RBarryYoung
    Jul 8, 2022 at 19:01
17

This is concerning indeed. The issue is far from my area of expertise, but some ideas that come to mind are:

  1. Are you part of a student union? Ask them for help.

  2. I think your focus on whether the practice is unethical may be misguided, since it may well be illegal (which would make it much easier for you to argue against it). Consult a lawyer about this.

  3. Ask about legality on law.stackexchange.

  4. Contact national or regional associations of nurses to ask for advice/help with this issue.

Good luck!

Improve this answer
2
  • 2
    The law SE site is indeed a good place to ask something like this. They'll be able to explain things like (for example) the requirements around the secure storage and access control for personal medical information that might not be followed here.
    – bta
    Jun 20, 2022 at 20:11
  • If the OP wants to post on Law.se, though, they should make sure that it's a "general" educational question and not a request for individualized legal advice.
    – EJoshuaS - Stand with Ukraine
    Jun 21, 2022 at 14:54
12

YES it is unethical, regardless of whether it is legal. This is not only a violation of privacy, but also a threat of long-term harm (lowering your grades and thereby affecting your future) should you not comply. For your own protection, do not provide real personal data about yourself. As suggested by a commenter, make up any sensitive information that you feel should not be shared. They have absolutely no moral right to force you to reveal real information to other people who do not have legal access to it in the first place. Secondly, as suggested by another answer, seek help from others, including course-mates who are uncomfortable with this demand, and from the university excluding the faculty, such as the board of directors and the whistleblowing department if any. (But if you do not trust even these people to keep your complaint confidential, then do not even take this second step. Your own safety has the highest priority.)

Improve this answer
9

My best guess is that this is under the jurisdiction your office of equal opportunity. A lot of medical information relates to mental illness, gender and reproductive health. Student organizations? Dean of students?

Improve this answer
1
  • 3
    By the way, I read the posting as indicating that each student was required to divulge essentially all their medical history. If they are able to pick and choose that might be unintrusive. Or less intrusive. Dean of students might still care.
    – Terry Loring
    Jun 19, 2022 at 15:29
-1

This is clear nonsense, perpetrated by people who might be the best-qualified in their own fields but still, have little understanding of and prolly less interest in privacy.

Nursing school assignments require real data but equally obviously, there could never be a reason for that data to come from students; much less from today's or any other particular cohort… unless not the data itself, but learning the methods of gathering the data was what mattered.

If there was, that would be to say that information about today's student cohort was more relevant than the last… That might be true if science had moved on, and how could that movement be guaranteed in any collection of student data?

What details about however many students in today's group could be statistically significant?

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .