CLINICAL MATTERS

A few weeks ago, a medical intern set social media ablaze for all the wrong reasons. She posted a TikTok video of her experience at a public hospital while performing CPR (cardiopulmonary resuscitation) on a patient. The backlash was instant and massive. She got called out for clout-chasing and disrespecting the privacy of her patients. The video was eventually deleted and the outrage subsided, but it led to important discussions about patient confidentiality and professionalism which continue to be raised in this increasingly wired world. Shortly after, last Aug. 19, a new Monkeypox infection was detected and the person with Monkeypox reportedly complained that potentially identifiable information about him was publicly shared. Some people who knew him were able to figure out who he was based on these details.These two incidents show how poor handling of sensitive healthcare information can harm and stigmatize patients.

When I was a medical student in the late 1990s, cellular phones still had black and white low-resolution screens and no cameras. Taking a picture or a video of a patient entailed using an actual camera, and was difficult to conceal unless the patient was unconscious, unattended, or dead, and so you had to ask permission. Privacy guidelines for patients were not as clear cut, but confidentiality was already becoming an important topic as more and more academic institutions started setting up ethics review boards. 

When I did my residency and fellowship training in the US, the HIPAA (Healthcare Insurance Portability and Accountability Act) had just been enacted and enforced. HIPAA was made in response to the need for health insurance companies to access patient medical records in order to process claims. Unfortunately, this came with a risk of exposing private medical information to unauthorized access and use. In order to protect patients, HIPAA was instituted to make sure that sensitive health information was only accessed by those who needed the data and that those who accessed the data handled it in a responsible manner. Prior to HIPAA, there was little oversight and accountability on what happened to medical records after they were taken out of the hospital. A politician’s opponents who gained access to his medical records could easily create a scandal if that politician had, for instance, a sexually transmitted disease. HIPAA enforced physicians’ and the medical industry’s accountability. Though it isn’t perfect, having safeguards reduces the number of untoward incidents.

The sacredness of doctor-patient confidentiality in the Philippines is enshrined in the Philippine Medical Association’s Code of Ethics. It falls under privileged communication and is further protected by the Data Privacy Actof 2012. From a professional perspective, a doctor-patient relationship is one of utmost trust. Proper care of a patient cannot be done unless they are willing to divulge even the most intimate and private information to the physician. In cases of notifiable infectious diseases, private information should be carefully handled, and only the people and agencies that need to know the information should have access to it. Otherwise, the patient can be harmed by stigma and discrimination. For instance, people living with HIV can be discriminated against by the public when their status is exposed without their consent. Unfortunately, the public makes snap judgements and the proliferation of social media has amplified the harm from these violations.

On the flip side, many physicians, including myself, have been the victim of surreptitious recording by patients or their relatives without the physician’s consent. The ease with which a cell phone or other device can record conversations makes it tempting for patients and their relatives to do so without asking permission. Having done residency in the US where patients regularly file medical malpractice lawsuits, I am always on alert against such recordings and I also make the best effort to make sure everything I say is clear, unambiguous and supported by evidence. There are legitimate reasons for recording, such as if relatives with no medical backgrounds might be unable to remember the discussion otherwise or are unable to reliably relay it to others. However, any kind of recording of the patient-doctor encounter must always be done with both the doctor’s and the patient’s consent, and allowed by the hospital/institution. If the patient or the doctor or the hospital administration objects, then the recording should not be made. It should also be made clear what the purpose of the recording is, who can view it, and whether it should be deleted after a certain period of time. Unauthorized recording of a medical encounter is a violation of privacy of both the doctor and the patient and can be grounds for filing a criminal case under the Data Privacy Act.

Best practices for protecting healthcare privacy need to be common knowledge for the general public. This includes securing personal health information by locking away sensitive documents and password-protecting digital files. Shred sensitive documents before discarding them, making sure that any identifiable information is removed or destroyed. Do not allow anyone to record you or your relatives without your consent, especially in a healthcare setting. If you are posting information on social media, review your posts for any private information, and never disclose sensitive medical data about anyone without their consent. You can still be held liable even if you are just repeating or sharing sensitive information from another post.

Finally, especially for healthcare personnel, it is important to respect our patient’s privacy. Being sick is an extremely vulnerable state and our patients trust us to take care of them in a professional manner. This includes keeping their secrets, and being sensitive to how society may react to knowing the patient’s medical condition which can cause embarrassment or discrimination. In fact, this is just a natural extension of our Hippocratic Oath… To do no harm.