Soapbox Friday! Yay! Two issues have reared their ugly heads this week, and I think it’s time for a gentle reminder that it’s imperative that we all understand the importance and limits created by certain laws and codes. I am talking about the HIPAA Privacy Act and the International Code of Breast-Milk Substitutes. One is a federal law that carries with it fines and imprisonment, the other is a code that some organizations require their members to follow, otherwise they can be stripped of their certifications. In both cases, the need to uphold these standards trumps any marketing considerations.
HIPAA Privacy Act
The U.S. Department of Health and Human Services has a really helpful summary of the act, and in the introduction, it broadly defines HIPAA as:
The Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”) establishes, for the first time, a set of national standards for the protection of certain health information. The U.S. Department of Health and Human Services (“HHS”) issued the Privacy Rule to implement the requirement of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).1 The Privacy Rule standards address the use and disclosure of individuals’ health information—called “protected health information” by organizations subject to the Privacy Rule — called “covered entities,” as well as standards for individuals’ privacy rights to understand and control how their health information is used. Within HHS, the Office for Civil Rights (“OCR”) has responsibility for implementing and enforcing the Privacy Rule with respect to voluntary compliance activities and civil money penalties.
Make sense? Sound fair enough? The big thing is the “control how their [the individuals’] health information is used.” Basically, not disclosing personal information in an improper manner. The other big issue with HIPAA is that there is a huge amount of misunderstanding about who this covers. Doctors and nurses and midwives in a hospital setting are obvious. Hospitals are required to have all employees trained in HIPAA compliance. Outside of that system, things may seem a little less obvious. But, again, from the Summary (emphasis mine):
Every health care provider, regardless of size, who electronically transmits health information in connection with certain transactions, is a covered entity. These transactions include claims, benefit eligibility inquiries, referral authorization requests, or other transactions for which HHS has established standards under the HIPAA Transactions Rule.6 Using electronic technology, such as email, does not mean a health care provider is a covered entity; the transmission must be in connection with a standard transaction. The Privacy Rule covers a health care provider whether it electronically transmits these transactions directly or uses a billing service or other third party to do so on its behalf. Health care providers include all “providers of services” (e.g., institutional providers such as hospitals) and “providers of medical or health services” (e.g., non-institutional providers such as physicians, dentists and other practitioners) as defined by Medicare, and any other person or organization that furnishes, bills, or is paid for health care.
So, yes, this does cover providers who are not hospital based. It does cover doulas. It covers birthcenters. It covers homebirth midwives. It covers childbirth educators. All of them in one way or another get paid for health care. Doulas have been fighting, rightly so, for recognition of the profession as a legitimate one, but with that comes the responsibility to uphold professional standards such as HIPAA. Social media seems to be the largest source of violations that I see. Over the last few years I have seen numerous debates on the subject. Common reasons professionals use for sharing patient information include claims that the parents want to see it, that it’s a good marketing tool, and that they aren’t actually revealing personal information. If you’re using photos, as long as you have proper written permission, that’s fine. That’s not revealing personal health information. (Although I find the common practice of posting “trophy” pictures on websites from every single birth a little off-putting.) The real violation comes when certain pages post birth weights, date and time of birth, gender, and even parent and sibling information online. In some cases, the information is specific enough that the exact identity of the patient could be surmised from the posts. This is CLEARLY illegal, and with such violations come fines– BIG fines. More importantly, as is the case with many ethical issues (the criminal aspect of this notwithstanding), when care providers show such blatant disrespect for patient privacy and federal law, it casts doubt on their competency overall. No matter how you try to rationalize it, even out of hospital birth pros NEED to respect patient privacy, period.
The International Code of Marketing of Breast-Milk Substitutes
This topic has reared it’s ugly little head in the community again, and I have a nice little video that you can watch to understand the “WHO Code”, what it covers, and why.
If an event is underwritten by a company the violates the WHO-Code, it’s imperative that health care professionals with a code of ethics that addresses WHO Code compliance adhere to their professional standards. And despite the common attempt to skirt the issue with the refrain of “I just want to support all mothers,” PLEASE realize that has NOTHING to do with supporting or not supporting mothers. It’s about the billions of dollars spent by big food conglomerates and big pharma to pass along misinformation and to influence mothers and health providers alike. Finally, WHO-Code violating companies know that the promise of financial gain is enough to woo health care professionals to ignore the rules and like to fuel the fire of the “mommy wars” to help them undermine breastfeeding supporters.
Find more information on the WHO-Code via the following resources:
Bottom line? As with the HIPAA rules, the very second you start to try to justify legal or ethical violations in the name of marketing or financial support, you’re making a bad choice. It’s simply not worth it, and families deserve better.