This began as a conversation between nurses who happen to be editors. The question: Some cases reported in the media disclose information about an injury from a disaster, sporting event, or an incident that occurred in a place without the privacy laws we take for granted, such as in a foreign country. What should be done when writing a case study when there is no way to obtain written consent?

This was part of my contribution to that discussion: "What is reported in the media, such as name, age, mechanism of injury, initial impression at the scene, and perhaps initial stabilizing treatment, is already out there. However, a case report would want to delve more comprehensively into non-public information. For that, if the patient is actually identified or identifiable, the author(s) should obtain consent from the patient or other person legally able to give it and anonymize the name and identifying/identifiable details unless permission to disclose them is specifically granted."

Another editor said, "Permission should be obtained or the details of the case should be removed (de-identified). The fact some information has appeared in the news or social media does not negate our ethical duty to protect the privacy rights of patients ..."

What about HIPAA?

You will note this piece is not titled, "... without violating HIPAA." The Health Information and Portability and Accountability Act (HIPAA) does deserve attention.1 You should definitely heed its constraints.

HIPAA applies specifically to persons or entities involved in delivering or paying for healthcare, such as, hospitals, medical offices, insurance carriers, and their business associates like attorneys and risk managers.2 A patient signs a release to allow the flow of this information to these persons or entities. HIPAA provides for very large fines if a staff member of any of these entities discloses, even inadvertently, personal health information (PHI) without a release.

However, there are other reasons to remove PHI completely that have nothing to do with HIPAA per se: Journals also have rules about privacy that usually center on, "No identifiable details or photos for persons or institutions without written consent." There could be legal action pending, or some action could start in a year-or years later. In the case of a lawsuit, PHI may be part of trial or discovery, or may be sealed by order of the court. The Board of Nursing could find a complaint against your license based on something overheard in line at the store or in the elevator at work. Or there could be personal costs for people whose privacy is shattered.

How much to anonymize?

The way to do this is fairly simple: Change all identifying information. It is so tempting to tell a complete story that we sometimes put in details that do not add to the lesson. If you are telling a story about how and why a new nurse made a medication error, details about the hospital, location, or patient diagnosis, age, or gender might not matter. Stick to the important facts involved in the points you want to make.

Would more details help you set the stage for your drama so your audience will identify with it? Sometimes, and this can become tricky. Your patient can have a different age, gender, job, or family; the accident can happen in a different season and a different mechanism of injury. Likewise, you should change identifying details of any staff members mentioned in case studies to protect their privacy and include staff members only if they are critical to the narrative.

Your charge is to make the lesson clear but the dramatis personae unrecognizable even to the original actors.

REFERENCES