Assessment tool details

Performance measurement toolkit for health care information privacy

How you benefit
Evaluate and demonstrate whether your organizational culture is consistent with protecting patient privacy.

• Find out if confidential patient records are well protected.
• Learn if your staff believe the organization takes privacy seriously.
• Assess whether patients feel their privacy is being protected.
• Introduce HIPAA regulations to staff and practitioners.
• Determine what level of knowledge your staff have about HIPAA and decide if supplemental training is needed.
• Determine what level of knowledge your staff have about ethical standards.
• Decide if supplemental information or training is needed to reinforce privacy protections.
• Ensure integrity of survey results by having the Ethical Force Program provide independent data entry, analysis, and reporting.
• See how your organization's performance compares to others confidentially.
• Share "best practice" information between health care networks.
• Improve ethical performance to maintain patient trust.

Estimated burden to implement
The total cost of implementing the toolkit will depend on the number of surveys ordered and returned. Costs will include mailing, data entry by Ethical Force staff, data analysis, and creation of an individualized final report. Please contact the Ethical Force Program for information on the cost of implementing the toolkit in your organization.

How much time is required to use the toolkit? Time estimates are approximate and will be updated as organizations conduct the assessment and provide us with feedback. For current estimates please contact the Ethical Force Program.

• Practitioner Survey: Less than 10 minutes, depending on practitioner's experiences.
• Patient Survey: Less than 10 minutes, depending on patient/member/beneficiary's experiences.
• Policy Checklist: 20 minutes, depending on participant's familiarity with privacy policies.
• Facility Assessment: At least 3 hours. This assessment is to be filled out in an interview fashion, with the participant attending IRB/privacy committee meetings and discussing the answers with other staff members and patients/members/beneficiaries as necessary.

Toolkit description
The Ethical Force Program's performance measurement toolkit includes 4 self-evaluation instruments that when used together will allow health care organizations to assess their policies and practices for safeguarding patient privacy and confidentiality, identify performance gaps, evaluate organizational culture, and develop a procedure for quality improvement of privacy and confidentiality standards.

Part one of the toolkit is a written Practitioner Survey that is to be filled out by randomly selected health care practitioners who work in the health care organization (nurses, physicians, etc.). The practitioner survey contains questions about practitioners' understanding of policies for privacy and confidentiality, practitioners' experiences at the organization, and practitioners' own medical record procedures. The survey is intended partly as an educational tool to help the organization determine how much the practitioners know about privacy policies, and where the appropriate points are to start or bolster education efforts on the privacy and confidentiality measures that are in place.

The second part is a Patient Survey that focuses on patients' impressions of privacy protections. This survey will help to bridge the gap between the information that your organization is presenting to patients, and the amount and quality of information the patients understand. In general, this survey should provide you with information on whether patients believe that they have been sufficiently informed of their privacy rights, and whether they understand your privacy and confidentiality process.

The third part is a Policy Checklist designed for use by the health care organization's internal assessment team as a quality assurance, quality improvement, and risk assessment exercise. Questions on the checklist address some of the key policies and documents that organizations should have in place for protecting confidential medical records. Some of the policies are those required by HIPAA and others, while not required by HIPAA, are those that the Ethical Force team felt were important to maintaining good-faith relationships with patients.

Part four, the Facility Evaluation Form, is a more subjective evaluation to be made by your quality assessment team. It is filled out using information from an on-site evaluation and interviews with key on-site staff. Like the Policy Checklist, the quality assessment team should complete the Facility Evaluation Form and return a copy to the Ethical Force Program office. After several organizations complete this form, the Ethical Force staff will use the results to determine best practices. Best practice information will be made available to all participating health care organizations as an educational resource that will provide strategies for addressing the areas that organizations identify as needing improvement.

Budget and other support
To date, the Ethical Force Program's privacy work has received support from a variety of sources, for which we are profoundly grateful. Critical support has come from the American Medical Association, the Agency for Health Care Research and Quality, the Greenwall Foundation, the Joint Commission on Accreditation of Healthcare Organizations, the American Nurses Association, the David and Carolyn Fleming Charitable Foundation, and the Blue Cross Blue Shield Association.