ASHP statement on confidentiality of patient health care information.

The American Society of Health-System Pharmacists (ASHP) believes that all medical information is sensitive and should be given the utmost protection. ASHP supports the adoption into federal law of a minimum standard for protection of individually identifiable patient health information and believes that states should retain the ability to adopt standards that are more stringent than federal law. ASHP believes that patients should have the right to access and review their medical records and the ability to correct factual errors in those records. Patients should also have the right to know who has access to their medical records and to authorize how their medical information will be used. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) requires health systems to have written policies and procedures in place to guard against the unauthorized collection, use, or disclosure of individually identifiable patient health information and provide notice of such policies to their patients. All health-system personnel should be trained to understand and comply with those privacy standards. ASHP strongly believes that pharmacists must have access to patient health records in order to provide quality care and ensure the safe use of medications. Within health systems, all authorized practitioners should be encouraged to communicate freely with each other while maintaining patient confidentiality and privacy. This includes pharmacists practicing across the continuum of practice settings in order to maintain continuity of care. Pharmacists recognize that with access to the patient’s health record comes the pharmacist’s professional responsibility to safeguard the patient’s rights to privacy and confidentiality. Uniquely identifiable patient information should not be exchanged without the patient’s authorization for any reason not directly related to treatment, payment, health care operations, or research conducted under an appropriately constituted institutional review board (IRB). ASHP advocates strict governmental protections, with appropriate civil or criminal penalties for violations, to prevent disclosure of individually identifiable patient information outside the health system (i.e., to an unauthorized third party) for any purposes not directly related to treatment, payment, health care operations, or research conducted under an appropriately constituted IRB. Pharmacists participate extensively in research on drugs. ASHP believes that all research data must be recorded and stored in such a way that the subjects’ rights of privacy and confidentiality are protected. IRBs have a responsibility to determine when informed consent is necessary and to establish procedures for obtaining informed consent. Patients should receive a statement describing the parties who may have access to patient-identifiable information (e.g., institutional personnel, business associates, researchers, personnel from study sponsors, employees of government agencies that monitor compliance with regulations). Patient authorization requirements under the privacy regulations of HIPAA must be followed, and patients always have the right to withdraw their consent at any time. ASHP believes that there is no potential for a breach of patient confidentiality when patient information is aggregated for use in legitimate research or statistical measurement and is not uniquely identifiable. Therefore, specific authorization by individual patients for access to this information is not needed. ASHP believes that pharmacy residency programs and other training programs must implement policies and procedures to ensure the confidentiality of patient medical records while allowing pharmacy students and residents access to these records in the course of their training and presentation of their research.