New Reproductive Privacy Rule to Protect Both Patients and Physicians.

This Viewpoint describes the newly finalized Reproductive Privacy Rule, a HIPAA regulatory update intended to prevent law enforcement in abortion-restrictive states from obtaining reproductive care medical records to prosecute patients and physicians.

AI Chatbots, Health Privacy, and Challenges to HIPAA Compliance.

This Viewpoint examines the privacy concerns raised by medical uses of large language models, such as chatbots.

Ethical Considerations When Using a Mobile Eye Tracker in a Patient-Facing Area: Lessons from an Intensive Care Unit Observational Protocol.

This article describes the process of designing, approving, and conducting an investigator-initiated protocol to use an eye-tracking device in a health care setting. Participants wore the device, which resembles eyeglasses, in a front-facing manner in an intensive care unit for the study of personnel gaze patterns, producing a visual record of workflow. While the data of interest for our study was not specifically the health information protected by the privacy rule of the Health Insurance Portability and Accountability Act (HIPAA), a wide variety of such data was captured by the eye-tracking device, and the prospective consent of all people who might have been incidentally videotaped was not feasible. The protocol therefore required attention to unique ethical considerations-including consent, privacy and confidentiality, HIPAA compliance, institutional liability, and the use of secondary data. The richness of eye-tracker data suggests various beneficial applications in health care occupational research and quality improvement. Therefore, sharing our study's successful design and execution, including proactive researcher-institutional review board communication, can inform and encourage similarly valuable, ethical, and innovative audiovisual research techniques.

Review of HIPAA, Part 2: Limitations, Rights, Violations, and Role for the Imaging Technologist.

This article is the second part of a continuing education series reviewing the Health Insurance Portability and Accountability Act (HIPAA) of 1996. The term HIPAA should be familiar to those who work in the medical profession, but this article includes details on its rules, patients' rights, violations, breaches, and penalties. To help administer these safeguards, HIPAA requires that every organization designate a HIPAA privacy and security officer. HIPAA violations can have serious repercussions when rules are not followed; these violations can be either negligent or willful. If breaches of unsecured protected health information occur, HIPAA requires covered entities to notify affected individuals, the Secretary of Health and Human Services, and in some cases the media. Violations in which the covered entity did not know of the violation are now punishable under the first tier of penalties. Unintended violations carry a minimum penalty of $100 per violation and a maximum of $50,000 per violation. All patients have a right to privacy and a right to confidential use of their medical records. The role of medical professionals includes understanding how and when to apply these HIPAA rules verbally and electronically.

Opportunities for and Tensions Surrounding the Use of Technology-Enabled Mental Health Services in Community Mental Health Care.

Technology-enabled mental health services have the potential to expand the reach of care and reduce clinician demand. While the efficacy of technology-enabled mental health services is well established, there have been few successful implementations of such services into community care settings. Using mixed methods, 89 clinicians and supervisors at a mental health service organization shared attitudes toward and interest in using a variety of technologies in their work. Participants discussed several challenges and opportunities for technology-enabled mental health services. Whilst clinicians saw potential for technology to engage individuals both in and outside the clinical environment, the range of therapeutic techniques used by clinicians presented a challenge in implementing a tool to meet their needs. Client technology access was a concern, and although text messaging would facilitate communication, current HIPAA and payment structures restrict this ability. With these considerations, we offer recommendations for implementing technological services in community mental health organizations.

Communicating With Leadership: Behavioral Health and HIPAA in the Field.

It can be challenging for a general medical officer to determine a patient's fitness for duty in the field. Communicating with commanding officers can be difficult given a general medical officer's loyalties as both a physician and medical officer. We present a case of a junior officer that highlights these issues.

Texting Among Academic Psychiatrists: What Does HIPAA Allow?

The texting of protected health information (PHI) has raised concerns about breach of privacy as it relates to the Health Insurance Portability and Accountability Act (HIPAA). Within psychiatry, limited guidelines exist on HIPAA-permissible texting. Given the legal implications of a breach, we sought to better understand texting patterns among psychiatrists by surveying members of the Association for Academic Psychiatry, 53 of whom responded. Only 63% of respondents felt confident in their knowledge of HIPAA. While 64% reported that texting PHI is prohibited, most (53%) still used texting to communicate PHI. Currently, HIPAA is technology neutral and texting PHI is not explicitly prohibited, provided safeguards are taken and physicians securely communicate PHI.

Implementing a universal informed consent process for the All of Us Research Program.

The United States' All of Us Research Program is a longitudinal research initiative with ambitious national recruitment goals, including of populations traditionally underrepresented in biomedical research, many of whom have high geographic mobility. The program has a distributed infrastructure, with key programmatic resources spread across the US. Given its planned duration and geographic reach both in terms of recruitment and programmatic resources, a diversity of state and territory laws might apply to the program over time as well as to the determination of participants' rights. Here we present a listing and discussion of state and territory guidance and regulation of specific relevance to the program, and our approach to their incorporation within the program's informed consent processes.