Q&A: Reviewing employee patient history during routine vaccine

Q: If an employee of our facility is seen for a routine vaccine, is it permissible for the nurse to review the patient history?

A: The nurse can review the employee’s patient history if the purpose of the review is to determine when the last vaccine was administered and if the patient has any conditions or has been prescribed any medications that would be contraindicated. It’s important to remember that the minimum necessary standard does not apply to treatment. You can access the HIPAA Privacy Rule minimum necessary standard at 45 CFR §§ 164.502(b), 164.514(d).

If the nurse has no reason to review the patient history, such as reviewing the patient history out of curiosity, that would still likely be a violation of the HIPAA Privacy Rule. It often gets down to the professional judgement of the practitioner—do they need the information to assist with treatment and to determine if, in this case, the vaccine was contraindicated? Or do they need the information to inform the patient of potential adverse reactions associated with the patient’s health and the administering of the vaccine?

Some covered entities have implemented policies that indicate when fellow staff, in this case a nurse, can view other employees’ patient history and who is authorized to review an employee’s patient history. That is not a HIPAA requirement but addresses accessing sensitive information about the employee’s health. It’s also to alleviate the fears that employees have associated with other staff looking at their medical record.

Editor’s note: Chris Apgar, CISSP, is president of Apgar & Associates, LLC, in Portland, Oregon. He is also a BOH editorial advisory board member. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Opinions expressed are those of the author and do not represent HCPro or ACDIS. Email your HIPAA questions to Associate Editor Heidi Samuelson at hsamuelson@hcpro.com.