Many of us remember the staff meeting before campers arrive when information, including information about health history, is shared. The scope of that sharing has been the subject of growing discussion. Policies at both federal and state levels about disclosure of confidential information are often confusing in their application to camp, a nontraditional healthcare setting. The purpose of this article is to examine the disclosure of health information about individuals in the camp setting.

The "Privacy Rule" (Standards for Privacy of Individually Identifiable Health Information) came about because of HIPAA (the Health Insurance Portability And Accountability Act of 1996). The Privacy Rule became effective April, 2001 and must be implemented no later than April, 2003. It does the following:

• Gives patients more control over their health information
• Sets boundaries on the use and release of health records
• Establishes safeguards that health care providers must achieve to protect the privacy of health information
• Holds violators accountable with criminal and civil penalties if they violate privacy rights
• Strikes a balance when public responsibility requires disclosure of some forms of data for the public health

For patients, it:

• Enables patients to find out how their health information is used and disclosed
• Limits release of information to the minimum reasonably needed for disclosure
• Gives patients the right to examine and obtain a copy of their own health records and request corrections

Scope of the Rule

The regulation impacts (a) how personal health information moves among and within entities involved with meeting health needs; (b) what clients are told about this; and (c) the controls they have in the process. "Covered entities" are agencies which use electronic means to transfer data about individuals' health. Given the growing use of computers and fax machines to electronically transfer data - to complete a camper's health form, to submit workers' comp claims, to fax a health form to a treating emergency room - there is need for the camp community to make note of this regulation.

In addition, the Privacy Rule addresses confidentiality of health information within an entity, regardless of electronic capability.

Clarify the Camp Policy about Privacy of Personal Health Information

The rule acknowledges that healthcare providers need access to information about the people for whom they provide direct care. But it raises a question about other people or entities. Determine your camp's current way of handling protected health information (PHI). Remember to consider:

• Who receives completed health forms and who has access to those forms before camp starts?
• About what health concerns are kitchen staff typically informed? Why are they told? Specifically who is told - just the head cook or the entire kitchen staff? Could that pool of people be more limited without jeopardizing safety?
• What health challenges are shared with cabin staff?
• Who in the specialized areas of camp - waterfront, ropes course, horseback riding, tripping, etc. - are told about health challenges? Why are they told?
• Under what circumstances does PHI leave camp? How is the privacy of that information monitored?
• What individuals have access to all and any PHI? Who has limited access and how is that access limited?
• When a person leaves camp - whether on a day trip or at the end of their camp session - how is their health history secured? Who makes decisions regarding the disposition of that information?
• How does one gain access to PHI?

The Privacy Rule directs entities to define their policy and make that policy generally known to clients as well as implement "reasonable steps" to limit use of protected information within the entity and in regard to requests it may receive from other parties. Information must only be released to those with a clear "need to know."

Consent and Authorization

According to the rule, a provider who has a direct treatment relationship with a given individual - such as the camp physician and camp nurse - is to obtain written consent regarding the use and disposition of the individual's health information.

Think about your camp's practice and consider talking with your legal counsel. Consider revising the health form's paragraph to include disclosure authorization for securing payment and/or for health care operations. In doing so, individuals - our staff, campers and their parent/guardian - may request restrictions to a camp's disclosure policy and retain the right to revoke consent. For instance, language in your permission form could be modified to read (new material in bold): "I agree to the release of any records necessary for treatment, referral, billing, or insurance purposes..."

The Rule's Concept of "Minimum Necessary Information"

The Privacy Rule acknowledges that healthcare providers need free access to individual health information and in no way seeks to limit that access. In the camp setting, for example, the camp nurse has free access to health forms; camp staff generally do not.

In this situation, the rule directs entities to limit access to the minimum necessary or to that which is reasonable. What is meant by "minimal," "necessary," and "reasonable" is left to the discretion of the entity - camp, in our case. Because of this, the scope of what a given camp discloses may vary from other camps but, in all cases, only the minimum should be relayed.

This raises a question when campers and staff are referred to out-of-camp providers such as clinics, hospitals, dentists and chiropractors. The camp retains a responsibility to satisfactorily determine that the provider is using PHI only for the purpose for which their services were engaged.

Oral Communication

We often use oral communication to convey health information about people at camp. This rule directs us to provide "reasonable safeguards" so oral information is limited only to those who need to hear the information. For example, the camp nurse may talk with a cabin counselor about a camper's care but would do so in a setting which limits - if not eliminates - who else listens to that conversation. Camps should also review screening practices of Opening Day to evaluate who is hearing what about whom during the process.

With Regard to Minors

As is the current practice at camp, the Privacy Rule recognizes parents/guardians as the representative of a minor. Consequently, the parent/guardian can sign statements of consent and/or authorization in the child's name. In addition, the Rule also recognizes another person acting in loco parentis. This is a position that many camps assume with regard to campers.

Parent access to health information about their child is another aspect of this discussion. According to the rule, individuals have "certain rights with respect to their personal health information, including the right to obtain access to and to request amendment of health information about themselves." While there's no clear directive about "access," it would seem prudent to consider the implications if parents and staff ask to see their health record. Adapt record-keeping practices as needed.

Marketing: Opportunity or Not?

As to be expected, the Privacy Rule states that an entity may not release PHI to an agent for the purpose of product marketing. Nor should a company provide health promotion, preventive care and/or wellness programs for camp staff and/or campers based exclusively on specific products used with the population. This probably has more impact upon year-round camps with employee health programs or camps that focus on a specific health challenge (e.g., weight management, asthma, diabetes). If the camp's support is identified at the time of enrollment - for example, a camp program sponsored by [name the company] - and a parent chooses to enroll a child, it is expected that the sponsor company impacts the nature of the program. However, if the camp promotes itself with no affiliation, then it should not inadvertently market a product by having that product exclusively used in the program (e.g., a given line of food items used at a camp that focuses on weight management).

What Should a Camp Do?

In view of the Privacy Rule becoming effective last April but compliance scheduled for April 2003, consider the following action plan:

• Determine how health information is currently handled at camp, who has access to it, and why. Then develop a policy statement that reflects current camp practice. Pilot the policy next season and revise it with input from appropriate sources.
• Talk with legal counsel regarding "red flags" that surfaced as a result of reading this information.
• Monitor clarification and development of the Privacy Rule via the U.S. Department of Health and Human Services. Information is available online. Several areas are already targeted for clarification, and interpretive guidelines will continue to surface.

Many camps will probably note the need to clarify their internal practices more than the external ones. We tend to act in a manner that protects our campers and staff from external intrusion, but we are more cavalier about our internal practices.

Camp health services have expanded in scope, and campers and staff have more complex health needs than ever before. The need to consider privacy is a timely matter and we have a window of opportunity during which to carefully consider the topic. Open that window.

Linda Erceg is Health & Safety Coordinator for Concordia Language Villages in Bemidji, MN and Executive Director of the Association of Camp Nurses. Contact Linda at erceg@campnurse.org.

Originally published in the 2001 Fall issue of The CampLine.