758

THE ISSUE OF CONFIDENTIALITY:

A PERSPECTIVE FROM THE
NURSING PROFESSION*
MURIEL S. PAPPERT, R.N., M.A.
American Telephone & Telegraph Company
Basking Ridge, New Jersey

CONFIDENTIALITY of health records is not a new issue to the

occupational health nurse, but it is becoming increasingly complex.
Because of the concerns of the public, the Congress, and regulatory
agencies in safeguarding the privacy of communications and the confiden-
tiality of business records, a fresh look at the privacy of employee records
is essential not only by management, labor, and the physician, but also by
the nurse.
Public Law No. 93-579, the Federal Privacy Act of 1974, established a
Privacy Protection Study Commission to develop recommendations to the
president and the Congress by mid-1977 on the extent to which the strict
requirements of that Act (which now apply only to federal agencies)
should be applied to organizations in the private sector. How might the
five "fair information practice principles" affect nursing?

THE PRINCIPLES
1) There must be no personal data record-keeping system whose very
existence is secret. In most companies, from the time an applicant for
employment is first seen in the medical department to the end of his career,
an individual sequential health record is created. The prospective employee
should be informed that such a record is being created, even though it is
commonly known that such records are always part of an employee-
physician-nurse relation. The nurse would be the logical person to inform
the employee of the creation and purpose of the health record, perhaps
during the pre-employment interview.
*Presented at a Conference on Ethical Issues in Occupational Medicine cosponsored by the New
York Academy of Medicine and the National Institute for Occupational Safety and Health and held at
the Academy June 21 and 22, 1977.
Address for reprint requests: Mrs. Howard W. Pappert, 7 Mendham Road, Bernardsville, N.J.
07924.

Bull. N.Y. Acad. Med.

 NURSING PERSPECTIVE 759
759

2) There must be a way for an individual to find out what information

about him is in a record and how it is used. Health information contained
in the medical record should be provided to the employee unless it were
not in the employee's best medical interest, i.e., terminal illnesses or
selected psychiatric diagnoses. The information on the health record
should be reviewed with the employee by a professional staff member who
can interpret it. Again, in most cases a professional nurse would be the
logical staff member to review the health record with the employee in
nontechnical terms, taking the time to be sure the instructions and the
rationale are understood, and then to assist him in taking whatever steps
are necessary to improve his health.
3) There must be a way for an individual to prevent information
obtained for one purpose from being used for another without consent.
The employee's concurrence and signed authorization regarding health
information should be obtained before transmitting any health information
to his personal physician, insurance company, or other outside agency
unless in response to valid legal process or pursuant to statutory require-
ments. Then appropriate notice should be given to the employee as
determined by company procedure.
Responsibility for the preparation of proper forms for transmittal could
be delegated to clerical staff. It is essential that all staff responsible for
handling, storage, and dissemination of health data be aware of their
responsibility for the confidentiality of that data. This would or would not
be the responsibility of the nurse, depending upon the size of the occupa-
tional health staff.
4) There must be a way for an individual to correct or amend records.
The employee should be advised that he may, at any time, request to
change, amend, correct, or expand the health history recorded. Here, the
nurse working with the physician should assist in establishing guidelines
and recommendations for appropriate access to the health record.
5) An organization creating, maintaining, using, or disseminating rec-
ords of identifiable personal data must assure the reliability of the data for
their intended use and must take precautions to prevent misuse of the data.
The medical department is responsible for appropriate measures to ensure
accuracy and overall reliability of health data generated by the company
itself. Likewise, the employee has a responsibility to provide honest and
correct information regarding his health information.
As nurses, we have long been aware of the importance of confidential-

Vol. 54, No. 8, September, 1978

 76076 MS PAPPERT
M.S. APR

ity. The Code For Nurses, published by the American Nurses Associa-
tion, succinctly states: "The nurse safeguards the individual's right to
privacy by judiciously protecting information of a confidential nature,
sharing only that information relevant to his care."1
The interpretive discussion of this statement further states:
The nurse has a clear obligation to safeguard any confidential information about the
patient that she may acquire from the patient himself or from any other source. The
nurse-patient relationship is built on trust; this relationship could be destroyed and the
patient's welfare and reputation jeopardized by the nurse's injudicious disclosure of confi-
dential information.
In some instances, however, knowledge gained in confidence is relevant or essential in
planning the patient's care. Under these circumstances, and guided by her professional
judgment, the nurse may share the pertinent information with others who are directly
concerned with the patient's care. But she discloses only the information relevant to the
patient's welfare, and only to those who are responsible for maintaining and promoting it.
The rights, well-being, and safety of the individual patient should be the determining
factors in the decision to share this information.2
The Code of Ethics of the American Association of Occupational
Health Nurses, Inc. states that occupational health nurses should:
"Safeguard the employee's right to privacy by protecting information of a
confidential nature; releasing information only as required by law or upon
written consent of the employee."'3
These codes are clear but the issue is complex. In the occupational
setting the occupational health nurses' primary responsibility is to the
employee; his health and welfare must come first. Our goal is to assist in
protecting his health and safety. To do this, it is necessary to obtain and
retain certain information as part of the health record. Much of this
information is confidential. From the data obtained one must determine not
only the health status of the individual but also his compatibility with the
requirements of his job.
But then what is our responsibility to management? Is there an irrecon-
cilable conflict between the interests of the employee and of the employing
company? Are there competing interests? I do not believe so. I believe that
what benefits the employee's health ultimately benefits the employer.
Health information must be communicated to the employer regarding the
employee's capability to perform the job without being a safety or health
hazard. But just how much detail do management, the Occupational
Health and Safety Act inspector, and others need to know? Is it necessary
for the employer to know, for example, that an employee has acute
glomerulonephritis, with details regarding how the diagnosis was reached,

Bull. N.Y. Acad. Med.

 NURSING PERSPECTIVE 761
NURSING PERSPECTIVE 761

or is it sufficient to know that the employee is "disabled due to a kidney

disorder which is serious but in which there is a reasonably good chance of
recovery in two or three months' -a general statement. And so we have a
dilemma: the privacy of the worker versus a report to management
regarding the worker's health status.
I agree with Edna May Klutas who says, "Basically, management needs
an interpretation of the medical information to enable him to maintain plant
production through informed planning, to place workers in jobs that are
within their capabilities, to protect the health and safety of the worker and
co-worker, and to meet the legal and insurance requirements.'"'
In my own organization a committee is established to examine various
aspects of the employee-privacy issue. This committee re-examines Bell
System policies, practices, and procedures required for employment and
personnel records to ensure that the spirit of fair information principles are
recognized. Re-examination of this entire subject will lead to comprehen-
sive recommendations for action. Other large companies are doing
likewise, and policies and procedures will be developed to guide health
professionals. But what about smaller employers?
This area becomes especially critical to the nurse working alone without
a full-time physician. Here there is a real need for clear, sound guidance.
Again, I agree with Klutas who says "...the nurse should be working with
a physician who provides the medical direction for the occupational-health
program. This direction should include provision of a policy statement
relative to the disclosure of confidential information. And, the policy
statement should be made known to and understood by the occupational
health staff, management, and the employees."5 She goes on to say that
"the nurse has the responsibility to work with the physician and manage-
ment to develop the policy statement on confidentiality of medical informa-
tion. "96
This year the American Association of Occupational Health Nurses
revised their guide, Principles of Privileged Communications for Occupa-
tional Health Nurses. 7 They recommend that the nurse:
1) Learn and utilize company policy regarding procedure for the release of privileged
communications.
2) If the Company does not have a defined procedure, or if the employer's rules do not
conform to ethical and legal standards, institute a co-operative action with management to
effect necessary changes.
Some of the items nursing should consider when developing a defined
procedure are:

Vol. 54, No. 8, September, 1978

 762
762 M.S. PAPPERT

A) Pre-employment information. Where kept? Employee access? Other

access? How long retained?
B) Medical information on employees. Where kept? Employee access?
Other access? Retention period?
C) Epidemiological studies-mortality and morbidity type. Are they
conducted? How used? Who has access?
D) Are medical records computerized? Who keeps them? Who has
access? How long kept? In what form?
In addition, if the nurse carries responsibility for benefits (employee,
family, or dependents), he should know:
A) Information needed for benefit administration. How obtained?
Where filed? Who has access? Retention?
B) Claims information (employee/family/dependents). How handled?
What is security arrangement? Who has access? How long retained?
The nurse should also be aware of company policy regarding the
record-retention schedule. How is the record retained? Is it on microfilm?
What specific information is kept? Who has access? How long is it kept?
What happens upon transfer, discharge, resignation, leave of absence,
retirement, or death? In what form is it kept? Does this change?
Even though the company has policies and procedures regarding the
release of privileged communications, it is still the nurse's responsibility to
see that her practice conforms to the imposed ethical and legal standards.
The occupational health nurse is accountable.
AAOHN further recommends that the nurse:
3) Join and participate in the various professional nursing organizations which are,
attuned to the changes and developments in the practice and the law.
4) Make and keep contact with the administrative bodies and agencies administering
health laws within your state. (In some states, agencies such as the Board of Health have
laws as well as rules and regulations covering the release of medical and nursing records
and information.)
5) Read current nursing journals published for the general practice of nursing as well as
journals in your specialized area of practice.
6) Attend conferences, seminars, and continuing educational offerings sponsored by the
professional organizations, administrative agencies, or other organizations concerned with
the practice.
7) Consult legal counsel in instances where called on to testify in court or in an
administrative proceeding. Legal counsel should also be employed when doubt arises in
regard to the propriety of disclosing privileged information in a "non-judicial" setting.
Today, more than ever before, the nurse must be well-versed in the
principles governing the handling of privileged communication. We must
use sound judgment in applying these principles in each situation for we

Bull. N.Y. Acad. Med.

 NURSING PERSPECTIVE 763

are accountable for our own actions. We must take an active role to
promote and preserve the confidentiality of health-care records. And we
must actively assist in establishing guidelines and policies and make
recommendations for action and implementation.

REFERENCES
1. American Nurses' Association:The code 7. The Board of Directors, American
for nurses. Am. J. Nursing 77:876, 1977. Association of Occupational Health
2. American Nurses' Association, Com- Nurses, Inc.: Principles of Privileged
mittee on Ethical, Legal and Profes- Communications for Occupational
sional Standards: Code for Nurses with Health Nurses, p. 6, 1977.
Interpretive Statements. January 1976. 8. Annas, G.J.: Legal aspects of medical
3. American Association of Occupational confidentiality in the occupational
Health Nurses, Inc.: Code of ethics. setting. J. Occup. Med. /8:537, 1976.
Occup. Health Nursing 25:28, 1977. 9. McLean, A.: Management of occupa-
4. Klutas, E. M.: Confidentiality of medi- tional health records. J. Occup. Med.
cal information. Occup. Health Nursing 18:530, 1976.
25:14, 1977. 10. Warshaw, L.J.:Confidentiality versus
5. Ibid, p. 15. the need to know. J. Occup. Med.
6. Ibid, p. 15. 18:534, 1976.

Vol. 54, No. 8, September, 1978