Privacy Note: Privacy Risks of Electronic Communication

Privacy Note: Privacy Risks of Electronic Communication

National Privacy Services has launched a month privacy newsletter to keep clients and others updated on privacy issues. It is designed to be a practical resource for businesses. You can subscribe by clicking the link on NPSi's website (http://www.privlaw.com).

The first edition of Privacy News contains the following article that I wrote:

Privacy Note: Privacy Risks of Electronic Communication

The same communication technologies that have revolutionized our workplaces, made workers more efficient and have freed us from our desks also pose particular privacy risks that need to be carefully considered to minimize the risk of accidental disclosure of personal information.

Virtually every privacy code and statute requires that custodians protect personal information against accidental disclosure. This obligation exists at every stage: from collection through storage to ultimate disposal. Virtually every means of communication comes with the risk that the information transmitted may be intercepted or misaddressed.

This risk is significantly heightened, however, with more recent and modern means of telecommunications. Letters can always be misaddressed, but the risk is relatively low if envelopes are individually hand-addressed, one at a time. Faxes and electronic mail take that risk to a whole new level. If a conventional phone number is misdialed, this fact immediately comes to the attention of the calling party. The call can be quickly and politely ended before any information is disclosed. A misdialed fax, on the other hand, will often be completely undetected to the sending party, particularly if another fax machine is reached at the other end of the line, producing a transmission report that simply states the fax was successfully sent. Electronic mail has very similar issues, as anybody who has accidentally clicked on "reply to all" can easily attest. In addition, auto complete features of some email systems may mean that a message may be sent to the first person matching a particular name in your address book, even if they were not the intended recipient. For example, an email meant for Sue Smith may be sent to Ann Smith if the sender is not paying sufficient attention. In addition, electronic mail messages are less secure than postcards because they routinely pass through the computer systems of complete strangers on their way to the final destination. An email message between neighbours using different internet service providers may actually leave the country before finally being routed to the proper inbox.

Health care organizations have always needed to be concerned about this in light of their ethical and professional obligations of confidentiality. New privacy laws, however, bring this issue to the fore once again. Most private sector health care providers now have a legal obligation to protect that information against disclosure and a person whose information is disclosed may be able to seek damages for the leak. In addition, some privacy laws require the custodian of that information to let the individual know that their information was accidentally disclosed. A recent example from the American media involved a hospital that accidentally sent patient records by fax to the newsroom of the local newspaper. Under Canadian laws, that media outlet is unrestricted in what it can do with that information once it has it in its custody. The hospital will consider itself lucky if a report describing its mistake only ends up on the front page of the paper.

A recent finding from the Office of the Federal Privacy Commissioner admonished an employer for allowing medical information about employees to be received at a central fax machine in their HR department. Incoming and outgoing faxes must be additionally secured, particularly when they send or receive sensitive personal information.

So what is an organization to do to secure the transmission of personal information against accidental disclosure? The following checklist provides some guidance:

  • Consent to communicate by email should be obtained from the individuals in question, because email communications might be received by unintended parties. Workplace email systems may be routinely monitored by the employer and some people may give others access to their email box, for example to a secretary or a colleague if the individual is on vacation. Home email addresses may be used by a number of members of the same household, posing the risk that a sensitive message may be received by a number of members of that household.

  • Email communications should be encrypted wherever possible.

  • The "auto complete" feature of email systems should be disabled, requiring the full name of an individual recipient before a message is sent.

  • Regularly called fax numbers should be programmed into the auto dial feature of fax machines. In the Health care setting, separate fax machines should be used: one for patient information and a second for other communications. Only vetted health care providers should be entered on the speed-dial feature of the patient information fax machine.

  • Clear consent from patients or customers should be obtained before email or fax is used to communicate sensitive personal information.

  • Facsimile cover pages should suggest that any unintended recipients contact the sender as soon as possible so that any harm done from the accidental disclosure can be mitigated as much as possible.

For more information on how to secure your organization, and your communications, against accidental disclosures of personal information, please contact National Privacy Services at 1-877-PRIVLAW.

0 comments:

Post a Comment

  • Health Care Reform Explained from B... Dan Roam at the Back of the Napkin Blog sums up the current health care reform effort in this four part health care series, Healthcare Napkins All. Great back of the...
  • Why We Need A Health Care Revolutio... Dr. Val Jones' road to revolution provides her personal perspective on the current state of our health care system and why we all need to work for change.Don't miss the...
  • The important lesson from sandcastl... As I return to West Virginia after a week spent at the beach -- this post by Jim Carrol, Futurist, Trends & Innovation Expert, caught my attention. Much of my week on...
  • A little Nick: I'm a liberal an... Law blogger posts online: Don't miss reading this post by my favorite hospital blogging CEO, Nick Jacobs over at Nick's Blog. Much of what Nick has to say strikes a chord with me and this post is...
  • Executive Order Impacts Health Care... Law blogger posts online: President Bush signed an Executive Order on August 22 requiring federal agencies to do more to inform public health care consumers about the cost and quality of health...
  • eHealthWV: West Virginia EHR Public... Law blogger posts online: As a part of West Virginia's participation in the Health Information Security and Privacy Collaborative (HISPC), West Virginia Medical Institute and its partners launch...
  • Physicians vs. Patient: Rating-Perm... Interesting post from the WSJ Health Blog on Medical Justice's new ratings-permission contracts (press release on service).This new service offered by Medical Justice...
  • Just when you thought it was safe: ... Law blogger posts online: I’ve blogged previously about just how much I hate browser toolbars and nothing much has changed in the four years that have passed. Call me nosey, but when I’m...
  • Governor Manchin Approves Cardiac C...The West Virginia Health Care Authority website indicates today that Governor Manchin approved the final revised certificate of need Cardiac Catheterization Standards.
  • A Law Actually Interview with… Litt... Next up in the interview chair is Gemma from Little Tiny Pieces. Little Tiny Pieces is an interesting name?  What it inspired it; does it have any hidden meanings?...
  • Let the voting commence!... Law blogger posts online: Yes, after two long weeks of nominations, the shortlist for the 2010 Blawggies has been decided and voting for the awards can officially begin! The polls will remain...
  • Is blogging good for your health?... Law blogger posts online: Is blogging good for your health?This Boston Globe article, Cancer blogs become part of treatment, indicates that blogging about your condition has a positive impact.The...
  • ADVANCE Magazine - Article on EHRs ... Recently I was interviewed for an article looking at the legal issues involved in the developing world of EHRs and PHRs written by Beth Walsh for ADVANCE Magazine. The...