Important · Trust & Security
HIPAA, Patient Information & Digital Displays
First Arriving digital displays are not intended to display Protected Health Information (PHI) to individuals who are not authorized to view it.
Fire and EMS CAD feeds can contain a mixture of general incident information and patient-related information. Most information associated with an incident does not automatically become PHI simply because it originates in CAD. However, certain combinations of information can constitute PHI under HIPAA.
Definitions
What is PHI?
Protected Health Information (PHI) generally includes individually identifiable information about a person's health, medical condition, healthcare, or payment for healthcare when maintained or transmitted by a HIPAA-covered entity or its business associate.
Context and combinations of data matter.
For example, a person's name by itself is not necessarily PHI. A general incident type by itself may not identify a patient.
But information such as:
Patient Name + Medical Condition
Patient Name + Nature of EMS Call
Identifiable Address/Location + Medical Condition
where the patient can reasonably be identified
may constitute PHI because health information has been associated with an identifiable individual.
CAD and dispatch call notes can therefore contain PHI even though the CAD system itself contains substantial amounts of information that are not PHI.
Physical safeguards
Why does screen location matter?
HIPAA requires covered entities to use reasonable administrative, technical, and physical safeguards to protect PHI from impermissible use or disclosure.
A screen located in an appropriately controlled area and used for legitimate operational purposes presents a different privacy risk than a screen that is readily visible to the general public.
Fire and EMS stations can have areas that are routinely accessible to people who are not members of the agency's workforce, including family members and friends, station visitors, vendors, community groups, children's tours, open-house attendees, and other members of the public.
If identifiable patient information and information about that person's medical condition or healthcare are continuously displayed where unauthorized individuals can readily view them, the agency may create an impermissible disclosure of PHI and fail to apply reasonable safeguards required by HIPAA.
Inside the station is not the same as protected
The fact that a screen is located inside a fire or EMS station does not, by itself, mean that PHI displayed on it is appropriately protected.
In practice
Most incident data may not present this issue
This concern will typically apply to only a portion of the information available from a CAD or incident feed.
General operational information, such as unit identifiers, incident numbers, unit status, response times, incident categories, resource availability, timestamps, aggregate statistics, and other information that does not identify a patient or reveal identifiable health information, may be appropriate for shared situational-awareness displays, subject to your agency's policies.
The important distinction is what information is being displayed, who can see the display, and whether the information identifies or can reasonably identify an individual in connection with their health or healthcare.
First Arriving strongly recommends limiting PHI and PII
First Arriving strongly encourages agencies to prevent PHI and unnecessary Personally Identifiable Information (PII) from being sent to shared digital displays whenever it is not necessary for the display's operational purpose.
Where available, configure your CAD feed, integration, filters, or display rules to suppress, redact, or exclude patient names, detailed medical information, sensitive narrative notes, and other unnecessary identifying information before it reaches your screens.
Your agency may choose which information it sends to First Arriving and which information it permits to appear on its displays based on its operational requirements, policies, physical environment, and applicable privacy requirements.
Your agency
Every agency and facility is different
The appropriate safeguards depend on your agency's specific circumstances, including the information contained in your CAD feed, where each screen is located, who can access those areas, and how the information is used.
We strongly encourage you to review your First Arriving data feeds and screen locations with your agency's privacy, compliance, legal, and/or IT personnel.
First Arriving cannot determine whether a particular data element, CAD feed, screen location, or agency use case complies with HIPAA or other privacy requirements and does not provide legal or compliance advice regarding your agency's specific configuration.