To hospital and EMS (emergency medical services) healthcare providers the topic of surge capacity is one of the most widely researched and discussed aspects of public-health emergencies. The 22 June 2009 Metro subway crash in Washington, D.C., cast new light on the procedures involved in the handling of sensitive patient information both during and after high-profile mass-casualty incidents (MCIs), and raised new questions about the steps needed to prevent the possible theft of patient data during and after such events.
The Town of Sandwich, Massachusetts, conducted a major pandemic exercise on 14 November 2008. The one area where there appeared to be a glaring liability was in the handling and distribution of patient information during the simulation. The pandemic exercise was simulated during an annual flu clinic – during which patients were processed through a drive-thru vaccination area for their annual flu shot. The patients also provided medical information so that the Town could receive reimbursement through Medicare. However, there was no specific protocol set for the possession, destruction, and/or distribution of the sensitive patient health data material. That problem had to be addressed in the IAP (Incident Action Plan), with the responsibility assigned to an ICS (Incident Command System) specific position.
A Patient Privacy Strike Team was created originally as a working unit of the Intelligence Branch (under the director of operations) but could very easily have been shifted to the Intelligence Section Chief – a new position supported by the U.S. Department of Homeland Security. Included on the team would be five members trained in HIPPA (Health Insurance Privacy and Portability Act) requirements, who would handle the patient information “from cradle to grave” during the incident or exercise.
The creation and use of a Strike Team, which would be supervised by a Patient Privacy Strike Team Leader, was in line with the National Incident Management System (NIMS) principle requiring that similar resources be grouped together to ensure a more effective and efficient span of control.
The Strike Team is typically deployed in accordance with the comprehensive emergency plans developed for the Town of Sandwich and/or for Cape Cod Healthcare. In most if not all situations the Strike Team would coordinate its efforts with those of a Patient Data-Theft Task Force, which would be composed primarily of IT, law-enforcement, public health, and hospital personnel; an assistant district attorney also would be a member of the Task Force to provide legal guidance and oversight. One responsibility of the task force would be to immediately investigate any suspected breach of patient data and/or electronic health records, while also providing an intentionally visible awareness of – and, therefore, deterrence to – future illegal patient data miners.
In insurance circles, PPO usually stands for “Private Provider Option.” In a mass-casualty incident the same acronym stands for patient privacy officer, whose duties and responsibilities would be little different from those of anyone else appointed to an MCI position. Establishment of the position, though, would reduce the Town’s liability during and/or in the aftermath of major mass-casualty incidents.
Assignment of a working professional qualified in the position also would ensure that, during a large-scale surge event such as the Washington Metro crash last month, the patient information gathered would not only be accurate, but also kept secure until the patient is transferred to the custody of hospital and/or EMS transport personnel.
The initial arriving company officer had a lot of action items to think about upon his arrival at the scene. There was no indication that patient privacy was even a thought in his operational plan. The position could very easily be added as an MCI position and would provide both responders and receiving personnel some clarity as to whom they are actually receiving. The four basic positions for an EMS mass-casualty response are Triage, Treatment, Transport, and Loading Officers. The positions of Loading and Transport are sometimes merged because of a manpower scarcity, so in reality the four positions would still be intact with a combining of two positions and the addition of one, the PPO.
The PPO would have a major task in managing all patient information, so the formation of the Strike Team mentioned previously makes sense for both continuity and security. The position has merit in large urban public-safety agencies, but may be more challenging for rural agencies to staff. The key fact is that patient privacy and HIPPA represent potential liabilities to municipalities – and to healthcare institutions, regardless of their size – so any changes or additions to existing plans directly addressing that possibility are a plus.
The irony is that there is significant potential for interaction with the Public Information Officer. The PIO and PPO would interact significantly in any case, because the PIO would be looking for certain information about almost any patient – his or her sex and age, for example. The release of that information is permissible under HIPPA, to keep the public informed about the scope and impact of the event. This relationship highlights the necessity of further training and collaboration between the PIO and the PPO.
A temporary shift in thinking is needed for the definition of a PPO as a personal insurance provider option. For public-safety and mass-casualty planners the PPO should define a different type of insurance that protects a municipality and/or healthcare institution from potential lawsuits, and from government fines, for HIPPA violations.
The tragedy of last month’s Metro crash highlights the need for greater consideration of patient privacy issues. There are in many if not all transportation accidents at least a few follow-on improvements in mechanical safety recommended to prevent similar such accidents in the future. Similar improvements, in planning and response operations, to patient-privacy issues are just as important for public-safety agencies.
John J. Burke
John J. Burke, a longtime employee of the Sandwich Fire-Rescue Department, received a bachelor’s degree in Fire Science from Columbia Southern University. He is certified in all levels of the National Incident Management System and nationally certified as a firefighter I/II, a fire inspector I/II, and a hazardous materials operations and incident safety officer. He has many other professional qualifications in the same fields and serves as an adjunct professor at the Center for Health Care Emergency Management at the Boston University School of Medicine. He also is author of the Town of Sandwich’s Pandemic Preparedness Exercise.
