• Feature

    New Technology: Keeping It Ethical, Keeping It Legal

    Advances in health care technology raise legal and ethical issues. Here are some situations you soon may encounter, if you haven't already. How should you respond?

    New Tech

    Technology is constantly advancing. Just a single generation ago, smartphones, social media, and voice assistant devices didn't exist. Now they are part of everyday life. But with new technology comes new ethical challenges and legal considerations.

    "Often, technology outpaces ethical concerns," says Bruce Greenfield, PT, PhD, FAPTA, who chairs APTA's Ethics and Judicial Committee and is a professor of rehabilitation medicine and senior fellow of the Center of Ethics at Emory University in Atlanta. "And simply because you can do something," he adds, "doesn't mean that you should."

    The Perils of Online Advice

    While many of us lived without social media for much of our life, in the past decade it's become a big presence in work, school, and home. Although social media can be a benefit, Nancy R. Kirsch, PT, DPT, PhD, FAPTA, offers a cautionary tale. (Note that the scenarios presented in this article are based on actual events. Certain specifics have been modified to ensure the privacy of those involved.)

    "A physical therapist (PT) shared some stretching exercise advice for skiers before ski season began. He put it on his website and said these were good things to do before you start skiing," says Kirsch, a professor and DPT program director within the School of Health Professions at Rutgers University in New Jersey. "A guy in another state did the exercises, injured himself, and had to cancel his skiing trip. He blamed the PT."

    The injured skier filed a complaint with the licensing board in his home state. Board members questioned why the PT was practicing in the state, as he wasn't licensed there. The board took action.

    "They believed he was practicing without a license in their jurisdiction, based on the way that telehealth is defined by the American Telemedicine Association, as well as on how this state defined it in their law," says Kirsch.

    Mary Ann Wharton, PT, MS, advises, "You should put a disclaimer on your website that the material there is general information and that individual advice should be obtained with an evaluation or assessment by an appropriate physical therapist." Wharton is a physical therapy consultant in the areas of ethics and geriatrics. She adds, "The idea of having a disclaimer is a safeguard."

    Remember, though: A disclaimer isn't foolproof. "Anybody can be sued for anything," says Kirsch.

    "Before blogging or posting any sort of medical advice on his website, the PT should have consulted an attorney about a legal disclaimer and made the disclaimer prominent on the website," says Kara R. Gainer, JD, APTA's director of regulatory affairs. "The PT also should check state law before giving out any sort of health practice advice over the internet, to see if any regulations restrict him from making medical recommendations to individuals in that setting—or in any other forum that is not face-to-face. He also should check APTA's Code of Ethics for the Physical Therapist [the Code] to assess whether there is any guidance to help PTs navigate proper patient interaction."1  

    Although the Code does not make specific reference to the use of social media, it does provide guidelines related to the profession's obligation to patients and clients that should be considered when making a decision to use social media.

    In addition, Gainer says, the blog post should have made clear that the PT was offering general guidance and education rather than specific advice for patients with certain conditions.

    Posting Photos Online

    Kirsch gives another example: "A PT posted photos on her social media page of a patient who she was incorrectly instructing in yoga," says Kirsch. "The patient was clearly identified in the photo. She had not given permission to use the photos and was embarrassed to be identified as doing yoga poses incorrectly."

    The patient reported the incident to the PT licensing board, recounts Kirsch. "The PT responded that she wasn't acting as a physical therapist at the time, but rather as a yoga instructor. The licensing board responded that she was a PT 24/7, even though she also was a yoga instructor.

    "The fact is, we sometimes think what we're doing isn't related to being PTs because we're doing it after hours and on our own time," Kirsch continues. "But when you're licensed, you're considered a PT all the time."

    She notes that a variety of disciplinary actions could have occurred. The PT could have received a private letter from the board, a public reprimand, or public action. The latter would have included a fine and been reported to the National Practitioner Data Bank. "Every time you apply for an insurance panel, renew your license, or obtain a practice privilege through the licensure compact, it's going to have implications. It can affect the PT's practice forever," says Kirsch.

    "I understand that people want to be involved in social media," she adds. "But first you have to think it through. If you're going to do it, make sure your privacy settings are actually set to private."

    "PTs have to be aware of patient privacy," says Wharton. "For example, in guidelines for HIPAA [the Health Insurance Portability and Accountability Act], you can post a photo as long as you have the patient's permission. If you are ever in doubt, you can read the HIPAA guidelines." (See "Health Technology Resources" on page 34.)

    PTs also need to consider the Code whenever they work with technology, says Wharton. "Principle 1, especially 1A, talks about being respectful of the patient regardless of age, gender, or other traits. Also, look at Principle 2," she advises, "which covers being trustworthy and compassionate. And then, specifically, look at principles 2A and 2E. Principle 2A discusses adhering to the core values of the profession, and 2E talks about protecting confidential patient-client information. Principle 3," Wharton adds, "is about exercising sound judgment, and 3D talks about not engaging in conflicts of interest. Inappropriately using social media can be seen as a conflict of interest.

    "Finally," Wharton continues, "Principle 4 of the Code addresses integrity in your relationships, and Principle 5 covers fulfilling legal and professional obligations. So, you really have to think about how you're dealing with HIPAA and other regulations when you're disclosing information."

    "A good rule of thumb," she says, "is don't post anything on social media that you wouldn't say on an elevator or in a coffee shop."

    Voice Assistant Devices

    Voice assistant devices (VADs) such as Alexa, Google Assistant, Siri, and Cortana have made many people's lives easier. The user can give a command to turn on lights, listen to music, get answers to questions, and much more. Microphones that are embedded in computer chips in smartphones or standalone devices listen and capture commands or questions. A Wi-Fi connection relays questions to a nearby computer that transmits them to "the cloud" and receives responses. A speaker provides answers, asks follow-up questions, and even can play music and podcasts.

    But recent news stories have revealed that VADs do more than listen and respond. They also record questions and conversations, sometimes relaying them to locations unknown.

    Suppose that a home health care PT goes into a home and the patient has one of these devices turned on. What should the PT do? What are the PT's ethical and legal responsibilities?

    "Because we know that these devices are recording information, we must be aware of the ethical and legal risks," says Robert Latz, PT, DPT, the APTA Section on Health Policy and Administration's representative to the association's Frontiers in Rehabilitation, Science, and Technology (FiRST) Council. "Device manufacturers claim that they are only recording so that they can listen for commands, but from media reports we know that they have recorded at other times as well. So if you're talking with the patient, it's getting recorded."

    Latz, who is chief information officer at Trinity Rehabilitation Services, gives another example: Suppose you are a home health care PT with a VAD in your home. "If you call a physician and tell her about the patient you saw today, you're using the patient's name and talking about his medical condition. Your device could be recording it."

    "In the first scenario, I'm not breaking HIPAA regulations, but in the second one I am," explains Latz. "People talk about ‘Big Brother' listening in. But the real risk is from somebody who wants to hear what's going on in the home. It's possible someone can hack into these devices. We already know that hackers can access and control cameras on laptops and other technology."

    Latz advises PTs in the first scenario to just recognize that the device is there—because it's awkward to ask the patient to turn it off. After all, it's their home and their device. But in your own home, he notes, you have control over the device. If you're talking with physicians or anyone else about a patient and sharing their confidential information, make sure the VAD is turned off, unplugged, and doesn't have a battery backup. "Or just don't do your work around the device," says Latz. "You can't take that risk."

    Always review the employer policy, Gainer adds. "Check if your employer has a policy that says that you agree to go into the patient's home knowing the machine might be on, and that you cannot—or can—request that it be turned off."

    Gainer echoes Latz's comments, stating: "You shouldn't use these devices when sharing protected health information—for example, using Alexa to order a prescription for your patient." However, an acceptable use may be getting your patient to use his or her smart home device to set a reminder to take medications at a certain time.

    "A problem with voice assistant devices is that they're not yet in compliance with HIPAA," says Greenfield. "You also have to wonder which companies have access to the information that's being recorded."

    "Only a select group of health care organizations can currently use Alexa to communicate protected health information without violating HIPAA rules," says Gainer, who raises another concern: "Also keep in mind that Alexa or Google Home generally runs over a Wi-Fi network. If there are security breaches in the network, those vulnerabilities extend to the voice assistant device."

    Wearable Technology And Remote Monitoring

    Suppose a PT is working with patients using wearable technology—perhaps an activity tracker or a smartwatch. She is contacted by one patient's employer, who wants the PT to begin monitoring that patient and recording the data in the electronic health record (EHR). What does she do?

    "Principle 4A in our Code of Ethics gives solid advice on that," says Kirsch. "We have an obligation to the patient foremost—regardless of who the payer is—to be honest and truthful, and to have integrity. It also says that we're going to provide truthful, accurate, and relevant information and not make misleading representations. So if I'm going to give somebody wearable technology, I'm going to explain that it's subject to report in the EHR, that it's recorded, and that it's an integral part of their treatment with us to know what's happening and what they're doing. The patient needs to realize that it's all discoverable."

    She adds, "If wearable technology is not the right treatment or intervention for the patient, I'm not giving it to them. I'm certainly not going to do it so that I can report them to somebody."

    Principle 2 of the Code of Ethics, Kirsch explains, says that PTs are collaborators with their patients. "We make decisions with patients about their health care. I wouldn't report the information to the employer unless the patient was onboard with it."

    Kirsch also points out the risk that the patient isn't providing correct information. For example, she cites a situation in which the PTs were getting "amazing" feedback from a patient's wearable device, indicating that the patient was doing better than should be possible based on his condition.

    The patient admitted that he had put his activity tracker on his dog's paw.

    "The issue with the wearable being on the dog is not only that the patient is being dishonest with the PT. Some insurance companies are giving premium discounts if people use step counters and are taking X number of steps a month. If a dog's running around with it on, that's giving false information to insurance companies, too," says Latz.

    "As for monitoring for an employer—we can only do that if the employee—our patient—knows it, and the employer has something in writing showing that the employee has agreed to it," says Latz.

    Cameras in the Clinic

    If a PT installs cameras in the clinic to monitor employees' job performance, is this a problem?

    "Many cases about PTs installing cameras are going to licensing boards—primarily because of confidentiality," says Kirsch. She says that PTs need to decide why they're installing cameras. Is it to protect staff or patients from being inappropriately treated? Is it because they want everything documented so that there is a record of all treatments?

    "If you're going to have cameras, you have to disclose everywhere—all over the place in the clinic—that cameras are there and recording," says Kirsch. "The problem arises because the most logical place to install them is in treatment rooms. But sometimes patients get undressed there."

    "Installing cameras is probably not a great idea. Even if you have disclosures, there still can be problems. Confidentiality and privacy are key," says Kirsch.

    "Employers using video cameras to monitor employees are required to have a legitimate business reason for doing so," adds Gainer. "State privacy laws determine what is considered legitimate, so it is important to be informed about your state's specific limitations and allowances. Courts have generally upheld an employer's right to monitor its employees with security cameras so long as the monitoring is not particularly invasive. But note that cameras in bathrooms or dressing areas usually are not allowed."

    "Including information about video surveillance in the employee handbook can help employers direct employees to written language concerning their company's policies," suggests Gainer. "Making your employees aware of the video surveillance ahead of time also may disperse any negative feelings of being ‘spied on.'"

    Overall, she says, "Know the laws and legal ramifications regarding video surveillance."

    Keeping Electronic Health Records Private

    Because PTs often are moving from one location to treat patients to another area where the records are stored, they sometimes leave an EHR open on their computer, Kirsch notes.

    "This is becoming a huge problem. People have been fired because they allowed access to protected health information by unauthorized people. They've walked away from a monitor and left the record open because they're trying to document while they're also treating," she says.

    An even bigger problem can occur when PTs access EHRs remotely. Hospitals often have sufficient security measures to protect patient information. But if you're accessing the records to do work while in an airport on Wi-Fi, on the bleachers while your kid plays in a baseball game, or in a coffee shop, you're putting yourself at risk due to the lack of encryption.

    "Lack of encryption or the possibility of personalized information leaking out can result in both a legal and an ethical problem due to compromise of privacy and confidentiality," says Greenfield.

    "You have to make sure your electronic devices are appropriate to transmit patient information. Your devices must be sealed, secured, and HIPAA-compliant," says Wharton. That means, she adds, that PTs should not use personal devices unless they meet those standards.

    Latz identifies another risk: PTs who access EHR under someone else's name. For example, if a PRN therapist is coming in on a Saturday, another PT there may try to "help" by allowing access to the records under the PT's name. "If you're going in under someone else's name, you're putting them at risk and you're putting yourself at risk as well," says Latz. "Don't do it."

    Telehealth/Telemedicine

    According to the Health Resources and Services Administration of the US Department of Health and Human Services (HHS), telehealth is "the use of electronic information and telecommunications technologies to support and promote long-distance clinical health care, patient and professional health-related education, public health, and health administration. Technologies include videoconferencing, the internet, store-and-forward imaging, streaming media, and terrestrial and wireless communications."2

    Telehealth can be highly beneficial. With it, PTs can treat patients in rural areas, check in with those who can't easily make it to a clinic, and monitor patients' conditions. That said, there are risks of which PTs must be aware, says Greenfield.

    "Telehealth changes the traditional role between the PT and patient as a 1-on-1 experience. The concern among ethicists and health care professionals regarding telehealth is that it can eliminate the personalized, traditional caring relationship between patient and provider," explains Greenfield.

    "Telehealth also can be dicey if the patient only wants to be seen online or through streaming and doesn't want to come in for an appointment. It also can be problematic if the PT only wants to provide treatment via telehealth," says Alan Lee, PT, PhD, DPT. "Consumers needs to be aware that telehealth is a digital form of care—with no hands-on treatment. They also need to be offered the opportunity to come in and receive that hands-on care."

    PTs need to know that various states are starting to develop language regarding telehealth in their practice acts, says Lee, and be aware of the ways states are addressing it. "PTs need to be mindful of where they're licensed and what the state is doing, because how states perceive telehealth is evolving. There isn't one set of rules regarding telehealth for each state," says Lee, a professor at Mount Saint Mary's University in Los Angeles and a PT at Scripps Mercy Hospital in San Diego.

    Greenfield suggests that PTs who aren't sure what they can and can't do should—in addition to reviewing their state practice act—consult federal entities such as HHS or the Centers for Medicare and Medicaid Services. They also can check into the American Telemedicine Association—a great resource."

    At the very least, "any clinical entity that plans to use telehealth has to have adequate encryption or security measures to protect information that's being conveyed," says Greenfield.

    What to Keep in Mind

    Technology is undoubtedly beneficial in physical therapy. "There are risks out there, there are things that make us nervous," Latz admits. But, he adds, "If we don't innovate and use technology, somebody else is going to, and we're going to lose that piece in our profession. So, be as aware as you can, have policies and procedures in place, and be transparent with patients. Doing these things will decrease ethical issues."

    "PTs need to know what their employer allows or forbids them to do," Wharton says. "They need to know what's in their employer's policy and procedures manual. If they're the employer, they must know what's in their own manual. Knowing and following the proper procedures help eliminate risk."

    Greenfield says that because technologies will continue to evolve, improve, and become more complex, and because PTs will be expected to implement them into patient care, they should ask themselves if they are educated enough to do it properly—ethically and with liability risk in mind. If they aren't, they must figure out how to get the information and training they need. "An important ethical consideration is to know that the obligations of a PT are based on the rights of the patient as well as certain standards of care," says Greenfield.

    "PTs must be aware of what they do and don't know about our increasingly technological world, and err on the side of caution," says Kirsch. "Know that this technology is part of the world we're going to continue to practice in, so we need to have a better understanding of how it all works—for the good of our patients and of our profession."

    Michele Wojciechowski is a freelance writer and regular contributor to PT in Motion.

    Note: The comments and suggestions in this article are not offered or intended, nor should be relied upon, as legal advice.

    References

    1. Code of Ethics for the Physical Therapist. American Physical Therapy Association. http://www.apta.org/uploadedFiles/APTAorg/About_Us/Policies/Ethics/CodeofEthics.pdf#search=%22code%20of%20ethics%22. Accessed July 1, 2019.
    2. Telehealth programs. Health Resources & Services Administration. https://www.hrsa.gov/rural-health/telehealth/index.html. Accessed June 21, 2019.

    Health Technology Resources

    The PTs interviewed for this article suggest that PTs consult these references for further guidance on HIPAA and health information technology.

    APTA

    HIPAA Webpage

    www.apta.org/HPAA/

    Health Information Technology Webpage

    www.apta.org/FederalIssues/HIT/

    Privacy, HIPAA Compliance, and Social Media Policy E-Learning Course

    learningcenter.apta.org/ (Search for course by title name above)

    HIPAA and Telehealth E-Learning Course

    learningcenter.apta.org/ (Search for course by title name above)

    Social Media for Physical Therapy Practices E-Learning Course

    learningcenter.apta.org/ (Search for course by title name above)

    US Department of Health & Human Services

    HIPAA for Professionals

    www.hhs.gov/hipaa/for-professionals/index.html

    Summary of the HIPAA Privacy Rule

    www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html

    Summary of the HIPAA Security Rule

    www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html

    Cyber Security Guidance Material

    www.hhs.gov/hipaa/for-professionals/security/guidance/cybersecurity/index.html

    Health Information Technology And HIPAA

    www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/index.html

    Guidance on HIPAA and Cloud Computing

    www.hhs.gov/hipaa/for-professionals/special-topics/cloud-computing/index.html

    HIPAA for Individuals

    www.hhs.gov/hipaa/for-individuals/index.html

    HealthIT.gov

    Your Mobile Device and Health Information Privacy and Security

    archive.healthit.gov/providers-professionals/your-mobile-device-and-health-information-privacy-and-security


    Comments

    Michele Wojciechowski wrote many wise advice for PT and PTA practitioners in this article so thank you. The power of social media is real and we as a PT profession and professional have a responsibility to check the validity and reliability of the information that is online and digitally consumed by patient/clients and providers. In telehealth and digital practice, the rule of thumb is always always check PTs and PTAs credentials and licensure that is publicly available from FSBPT verify licensure check. https://www.fsbpt.org/Secondary-Pages/The-Public/Verify-a-PT-PTA-License This is one safeguard for digital practice and telehealth and this includes social media and PT social media influencers by filtering the information and landing on best practice, education, and research.
    Posted by alan lee on 10/31/2019 8:42:17 AM
    Thanks for sharing some "real-life" examples. With technology advancing almost weekly, we (as a profession) need to understand how these changes affect the way we practice.
    Posted by Mac Innocent on 10/31/2019 9:50:10 AM
    This is an excellent article that I will share with my students. It reviews topics that I have never even thought of before. I’m certain I am not alone and hope a lot of my colleagues will read it.
    Posted by Evelyn Petrash on 10/31/2019 5:56:46 PM
    tl;dr Have your liability release language in place and prominently displayed, get your patients to sign a model release before posting their likeness online, Alexa's probably listening to you, don't install cameras in your clinic, lock your emr away from your desk, and check with your state's telehealth laws and regulations. Although if you really want great advice and strategy on best practice use and application for telehealth, talk to physical therapist Rob Vining. The guy's doing more for the industry than most people can begin to understand or appreciate.
    Posted by Greg Spooner on 11/8/2019 1:42:42 AM
    Could Nancy Kirsch please provide a reference or link to the PT Licensure Board cases she mentioned?
    Posted by Gwen Simons on 11/8/2019 2:47:21 PM

    Leave a comment: