QUESTION: Our hospital would like to allow students from local high schools, colleges or trade schools to “shadow” Medical Staff members and other health care professionals. We believe this will encourage students to enter the health professions and perhaps work at our hospital in the future. Would a job shadowing program violate HIPAA?
ANSWER: The HIPAA Privacy Rule has been in effect for over a decade. In that time, the federal government has not provided any formal or informal guidance regarding job shadowing programs. Also, we have not heard of any HIPAA investigations involving job shadowing programs. This is not to minimize the compliance issues associated with job shadowing programs. However, the government’s lack of action in this area suggests that the HIPAA risks of job shadowing programs can be successfully addressed.
The HIPAA Privacy Rule permits protected health information to be used and disclosed without patient authorization for the “health care operations” of a hospital. The definition of “health care operations” includes two provisions which could reasonably be viewed as including job shadowing programs:
(1) “general administrative activities” of the hospital; and
(2) “conducting training programs in which students, trainees, or practitioners in areas of health care learn under supervision to practice or improve their skills as health care providers.”
We believe that job shadowing programs could be viewed as part of the “general administrative activities” of the hospital. Such programs can increase the number of individuals interested in health careers and allow hospitals to build closer relationships with their communities. These would seem to qualify as important administrative activities of a hospital.
Another alternative is for a hospital to establish a “Health Career Assessment and Training Program” in a formal manner. The purpose of such a program would be to encourage individuals to choose health care professions as careers. This would bolster the argument that participants in the training program fall within the training language set forth in the Privacy Rule’s definition of health care operations.
To minimize risk, job shadowing programs could require that students sign an agreement by which they promise to keep the identity of any hospital patient and the medical condition or treatment of any patient strictly confidential. In addition, a sponsor from the hospital, either a physician or other health care worker, should sign an agreement to be responsible for the actions of the student.