Q&A: Using case studies involving real incidents at your facility

Q: Are we allowed to use case studies involving real incidents that occurred at our facility as part of training for safety, policies, etc.? Or is there a risk that someone could identify the real people who were involved?

A: As long as there’s a “need to know,” using real incidents for training is permitted. It falls in the category of healthcare operations. It’s wise to document who should be exposed to PHI as part of the training to make sure there’s a record of the training and the roles of attendees who may be exposed to PHI during the training.

If the training is general or there’s not a “need to know,” it’s best to strip out the PHI. You can still use the same real incidents as long as you make sure that the information included in the training is not sufficient for a reasonable person to re-identify the patient(s).

Editor’s note: Chris Apgar, CISSP, is president of Apgar & Associates, LLC, in Portland, Oregon. He is also a BOH editorial advisory board member. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Opinions expressed are those of the author and do not represent HCPro or ACDIS. Email your HIPAA questions to Associate Editor Heidi Samuelson at hsamuelson@hcpro.com.