Privacy of Health Forms

[willray]

On 3/15/2019 at 6:39 PM, RememberSchiff said:

Yes what a contrast  to see how securely my health form is handled at  my doctor exam , yet that same form and information is so carelessly handled by the BSA.  

Your doctor probably spends 20% to 40% of the total insurance-billed-cost of your exam, exclusively on HIPAA compliance.  Would you like to pay an additional $50 or so per BSA event that you attend, to have BSA handle your medical information similarly?

[ParkMan]

On 3/15/2019 at 6:39 PM, RememberSchiff said:

Yes what a contrast  to see how securely my health form is handled at  my doctor exam , yet that same form and information is so carelessly handled by the BSA.  

I'd agree.   The BSA really should ask a team of volunteers in their health and safety team to put togther a list of best practices for handling health & safety forms.  It doesn't have to be onerous, but some basic guidance really should exist.

I may be placing too fine a point on it, but most people who handle health forms are not "the BSA" in the form of national or council profressionals or volunteers.  Most people who handle health forms are unit volunteers.  Most of use have about 0 experience in how to handle them beyond common sense.  Providing us as volunteers some guidance on how to store health forms is a good idea.  For example, once I thought about scanning them to make it easier for the Scoutmaster and then realized that once that happened, they would be impossible to track.  So I discarded that as a bad idea.  But, I'm sure others have come to a different conclusion.  

[RichardB]

@ParkMan  - that was done about 5 years ago when we updated the FAQ's.   What do you think isn't clear or needs to be added?  I'll just copy and paste into the thread. 

Here is the link:   https://www.scouting.org/health-and-safety/ahmr/medical-formfaqs/ 

Q. What do leaders do with the Annual Health and Medical Records they collect?
A. In all cases, the information gathered is for use in conducting a safe Scouting program. Information gathered in the AHMR must be maintained and shared in a confidential and discreet manner. Some conditions may require communication to ensure the safety of participants. This information should only be shared on a “need-to-know” basis.

Following are some of the best practices for using and storing the records:

• The Annual Health and Medical Record is secured to maintain the confidentiality of the information, yet at the same time, the forms should be accessible by adult leaders in an emergency. The following guidance will assist leaders in achieving this goal:
  • Leaders are encouraged to maintain the original AHMR forms in a safe location in a binder or file that protects the documents entrusted to the unit leader.
  • The AHMR should be taken on all activities.
  • Designate a leader to keep the files containing the AHMR up to date.  This may include reminding participants to update the AHMR annually or as needed.    
  • Designate a leader as the point of contact with event or camp health officers.  If needed, the leader should arrange to have the AHMR returned to him or her at the end of the event, if allowed by the state.
  • The unit leader (or his or her designee) is responsible for destroying or returning to the participant (or parent and/or guardian) the AHMR documents when the participant leaves the unit or when the documents become outdated.
• Records are NOT to be digitized, scanned, sent by email, or stored electronically by unit leaders.
• To streamline a summer or winter camp check-in, records of all participants are reviewed to make sure they are up to date, completed, and signed before leaving for camp. Be sure to check with the camp for any additional information that may be needed. For example, specific immunization records may be required in some states.

Prepared leaders use the AHMR in the following ways:

• Review each participant’s health history. This aids the leader in becoming knowledgeable about the medical conditions of adults and youth members in the unit.
• Review any treatment plans that may exist with participants and/or parents of youth. Examples might include plans for asthma, food or other allergies, anaphylaxis treatment, behavior, hypertension, and other health risks and medical restrictions that may require accommodations. Knowledge of a participant’s use of an inhaler would allow the leader to prompt the youth to bring it on an overnight camping trip.
• Be knowledgeable of a participant’s restrictions. This may allow the leader to find ways to extend the Scouting program to those with restrictions while also protecting others and providing a positive and safe experience for everyone. The leader may be able to plan alternate activities (within Youth Protection guidelines) for those youth members who are unable to participate in a long hike or a swimming event.
• Assist leaders to better coordinate ongoing medical care, such as administration of medications or bandage changes, with parents or other authorized and trained leaders in the unit who agree to assist the participant. This kind of assistance is especially necessary during events lasting longer than 72 hours when a parent or guardian may not be present and the youth member must take regularly scheduled medication.

[ParkMan]

6 minutes ago, RichardB said:

@ParkMan  - that was done about 5 years ago when we updated the FAQ's.   What do you think isn't clear or needs to be added?  I'll just copy and paste into the thread. 

Here is the link:   https://www.scouting.org/health-and-safety/ahmr/medical-formfaqs/ 

Q. What do leaders do with the Annual Health and Medical Records they collect?
A. In all cases, the information gathered is for use in conducting a safe Scouting program. Information gathered in the AHMR must be maintained and shared in a confidential and discreet manner. Some conditions may require communication to ensure the safety of participants. This information should only be shared on a “need-to-know” basis.

Following are some of the best practices for using and storing the records:

• The Annual Health and Medical Record is secured to maintain the confidentiality of the information, yet at the same time, the forms should be accessible by adult leaders in an emergency. The following guidance will assist leaders in achieving this goal:
  • Leaders are encouraged to maintain the original AHMR forms in a safe location in a binder or file that protects the documents entrusted to the unit leader.
  • The AHMR should be taken on all activities.
  • Designate a leader to keep the files containing the AHMR up to date.  This may include reminding participants to update the AHMR annually or as needed.    
  • Designate a leader as the point of contact with event or camp health officers.  If needed, the leader should arrange to have the AHMR returned to him or her at the end of the event, if allowed by the state.
  • The unit leader (or his or her designee) is responsible for destroying or returning to the participant (or parent and/or guardian) the AHMR documents when the participant leaves the unit or when the documents become outdated.
• Records are NOT to be digitized, scanned, sent by email, or stored electronically by unit leaders.
• To streamline a summer or winter camp check-in, records of all participants are reviewed to make sure they are up to date, completed, and signed before leaving for camp. Be sure to check with the camp for any additional information that may be needed. For example, specific immunization records may be required in some states.

Prepared leaders use the AHMR in the following ways:

• Review each participant’s health history. This aids the leader in becoming knowledgeable about the medical conditions of adults and youth members in the unit.
• Review any treatment plans that may exist with participants and/or parents of youth. Examples might include plans for asthma, food or other allergies, anaphylaxis treatment, behavior, hypertension, and other health risks and medical restrictions that may require accommodations. Knowledge of a participant’s use of an inhaler would allow the leader to prompt the youth to bring it on an overnight camping trip.
• Be knowledgeable of a participant’s restrictions. This may allow the leader to find ways to extend the Scouting program to those with restrictions while also protecting others and providing a positive and safe experience for everyone. The leader may be able to plan alternate activities (within Youth Protection guidelines) for those youth members who are unable to participate in a long hike or a swimming event.
• Assist leaders to better coordinate ongoing medical care, such as administration of medications or bandage changes, with parents or other authorized and trained leaders in the unit who agree to assist the participant. This kind of assistance is especially necessary during events lasting longer than 72 hours when a parent or guardian may not be present and the youth member must take regularly scheduled medication.

Thanks @RichardB. 

I regreft that I didn't know about this.  This looks like exactly what I was hoping would exist.

I very much appreciate you highlighting this.

[HashTagScouts]

Troop had a locking mailbox (similar to the one at the link below) mounted inside the troop trailer.  We kept the medical forms in a folder locked inside.  Adults knew where to find it, but it was pretty much out of site out of mind and no one really went into it, except the one time a year we collected updated versions.

https://www.walmart.com/ip/Indoor-Outdoor-Wall-Mount-Locking-Mailbox/703729362

[RememberSchiff]

5 hours ago, willray said:

Your doctor probably spends 20% to 40% of the total insurance-billed-cost of your exam, exclusively on HIPAA compliance.  Would you like to pay an additional $50 or so per BSA event that you attend, to have BSA handle your medical information similarly?

Consider the expense of an unqualified, untrained, non-medical person MIShandling your confidential medical and insurance information.

But more to my point regarding adult participants, IMO a BSA event need only have a signed doctor authorization for activity and contact info. If BSA thinks otherwise, get HIPAA trained, compliant.

My $0.02

Edited March 21, 2019 by RememberSchiff
Typo. Meant Mishandling private info

[willray]

51 minutes ago, RememberSchiff said:

Consider the expense of an unqualified, untrained, non-medical person handling your confidential medical and insurance information.

It doesn’t appear to me that the current system costs anything for exactly that level of service?

 

You you do understand that if BSA literally required HIPAA compliance, your out-of-pocket cost to participate in any BSA event would increase by probably at least $50, more likely considerably more, per person, per event?

 

51 minutes ago, RememberSchiff said:

But more to my point regarding adult participants, IMO a BSA event need only have a signed doctor authorization for activity and contact info. If BSA thinks otherwise, get HIPAA trained, compliant.

 

Unless you actually know what you’re asking for there, I would caution against you recommending it.   You would like medical records to be more private - I don’t disagree with  that at all - but your comments suggest that you have no idea of either the required burden of HIPAA compliance, or the dramatic changes that HIPAA compliance would enforce upon the scouting program.  

[malraux]

1 minute ago, willray said:

Unless you actually know what you’re asking for there, I would caution against you recommending it.   You would like medical records to be more private - I don’t disagree with  that at all - but your comments suggest that you have no idea of either the required burden of HIPAA compliance, or the dramatic changes that HIPAA compliance would enforce upon the scouting program.  

Just the amount of training to get anyone who would have to handle the health forms up to hipaa compliance... And it would have to cover anyone who touches a health form.

[HashTagScouts]

To be clear- the BSA itself, and more importantly its units- are not covered entities under the law, so there is no necessity to be HIPAA compliant.  If you thought of a hospital, not all the employees working within the hospital would be covered entities, but the hospital itself would be.   That doesn't mean you would give training to the janitors or the receptionists on data safeguarding practices.  That might be what you are looking for. 

Yes, the BSA could contract someone to put that together, and it would probably be a 20 minute online training.  Would you need to require everyone to have to do it? Debatable.  You could say that units must have SM and CC need to do it yearly.  You could make it part of the "trained" designation too.  I don't think you need every adult in your unit having access to these forms- having just one works, if that person is on every event.  Obviously having more is ideal.

[malraux]

1 hour ago, RememberSchiff said:

But more to my point regarding adult participants, IMO a BSA event need only have a signed doctor authorization for activity and contact info. If BSA thinks otherwise, get HIPAA trained, compliant.

 

So what's on the health form currently? Basically, a list of medications you are currently taking, making sure your vaccinations are up to date, allergies, and medical conditions that can affect your ability to participate in the program. I can understand what you want with effectively a doctor's note saying you are clear to participate, but from the side of the person administering the program, you'd want to know about possible problems with seizures even if the person's doctor says that it's well controlled. Sure, it would be great if every unit could have a dedicated physician, but that's just not realistic.

[willray]

10 minutes ago, HashTagScouts said:

To be clear- the BSA itself, and more importantly its units- are not covered entities under the law, so there is no necessity to be HIPAA compliant.  If you thought of a hospital, not all the employees working within the hospital would be covered entities, but the hospital itself would be.   That doesn't mean you would give training to the janitors or the receptionists on data safeguarding practices.  That might be what you are looking for. 

Yes, the BSA could contract someone to put that together, and it would probably be a 20 minute online training.  Would you need to require everyone to have to do it? Debatable.  You could say that units must have SM and CC need to do it yearly.  You could make it part of the "trained" designation too.  I don't think you need every adult in your unit having access to these forms- having just one works, if that person is on every event.  Obviously having more is ideal.

Oh, my no.  You can't even get Medical doctors and nurses to up to full compliance with regular mandatory trainings and a giant cudgel to bash them if they step out of line.😖   And yes, you absolutely do train the janitors and receptionists regarding data safeguarding - at least up to the level of "under no circumstances may you ever do X".  A janitor who snaps a selfie with a patient, or a receptionist who tweets "guess who just walked in the door", is going to be in for a world of hurt.

20 minutes of training would be perfectly fine for "don't be an idiot, the medical forms are private and should only be divulged to emergency personnel, etc when absolutely necessary", which BSA has already done in the form of the quoted policy.   To actually "make BSA HIPAA compliant" would require treating BSA, its units, and presumably the scouters and scouts, as covered entities, which would turn a scout at a troop meeting saying "Wow, you should have seen how well scoutTom bandaged up scoutJim's finger last weekend!", into a legally actionable statement with mandatory reporting and disciplinary consequences.

[malraux]

1 minute ago, willray said:

To actually "make BSA HIPAA compliant" would require treating BSA, its units, and presumably the scouters and scouts, as covered entities, which would turn a scout at a troop meeting saying "Wow, you should have seen how well scoutTom bandaged up scoutJim's finger last weekend!", into a legally actionable statement with mandatory reporting and disciplinary consequences.

yeah, living with an MD, its really clear exactly what's involved with being hipaa compliant, and it is a huge (justifiable) pain in the butt. Even to the point of I'm not sure exactly how a SM could handle issues like carrying medicine for scouts and reminding them to take it.

[willray]

1 hour ago, RememberSchiff said:

But more to my point regarding adult participants, IMO a BSA event need only have a signed doctor authorization for activity and contact info.

I should actually say - a large part of the reason for HIPAA in the first place, is that you have very little control of what's in "your medical record" as your doctor accesses it.

On the other hand, you have complete control over what goes on the Part A and Part B health forms.  If there is something that you don't want anyone to know about, don't put it on the form.  If you're absolutely certain that no-one has any legitimate need for the information, why include it on the form?   Now, if you leave something off, and either you are harmed, or harm someone else because of the omission, that's clearly going to be on your head, but with the BSA forms that's a choice you get to make : are you more worried about someone knowing X from your medical history, or about you coming to or causing harm by them not knowing X?  

[scoutldr]

10 minutes ago, willray said:

I should actually say - a large part of the reason for HIPAA in the first place, is that you have very little control of what's in "your medical record" as your doctor accesses it.

On the other hand, you have complete control over what goes on the Part A and Part B health forms.  If there is something that you don't want anyone to know about, don't put it on the form.  If you're absolutely certain that no-one has any legitimate need for the information, why include it on the form?   Now, if you leave something off, and either you are harmed, or harm someone else because of the omission, that's clearly going to be on your head, but with the BSA forms that's a choice you get to make : are you more worried about someone knowing X from your medical history, or about you coming to or causing harm by them not knowing X?  

The only problem with this is that the form has to be completed and signed by your healthcare provider.  If they omit pertinent information, they are liable.

I would say it is analogous to the workplace...you go get a physical and the Dr certifies you "fit for duty" or "fit for duty with restrictions".  Then those restrictions are enumerated.  Your supervisor does not get a complete copy of your medical history, test results and medications.  We are all adults here.  If one of my ASMs was an insulin dependent diabetic, we all knew it and knew what to look for.  If I had told him that he had to check his insulin (or Metformin) in at the Health Lodge and had to go there to take his meds, he would have told me where to shove it.  And he would be right.  

[willray]

4 minutes ago, scoutldr said:

The only problem with this is that the form has to be completed and signed by your healthcare provider.  If they omit pertinent information, they are liable.

Parts A and B, the only parts required for standard activities, do not require a signature by a health-care provider (except in a few states where apparently a health-care provider's signature is required to permit someone else to dispense medications to youth).