Removing ID before discarding slides

Medical Laboratory Observer,  May, 2008  by Barbara Harty-Golder

• E-mail
• Print
• Link

Q Our HIPAA supervisor insists that we have to remove all identifying information from slides before discarding them. Is this true?

A This is the HIPAA question that will not die. It first raised its head when HIPAA was new and uncharted territory for the laboratory. In my column in MLO in April 2004 ["Another privacy issue: slide disposal," page 38], I noted that there was no definitive rule or opinion that would require a lab to deface or remove identifying information from glass slides before disposing of them --for several reasons:

* The information is minimal (often, only last name and hospital number) and detached from any significance to an individual casually encountering the slide.

* Removing information from the slide can pose an unnecessary risk of injury to the individual doing so, depending on his technique.

* Slides are disposed of as biohazard in sealed containers--by disposal experts who are also bound by HIPAA regulations--and leave that disposal process completely destroyed.

The sort of disclosure that might potentially occur from having access to an unobliterated label on a slide can potentially be likened to the incidental disclosure that may occur with janitorial staff. In the same vein, slides containing identifying information should be stored while in use in the same way as other patient-information documents. Slides should not, as a rule, be left out for casual observation by patients or incidental visitors.

Similarly, the lab has a responsibility to prevent access (by sealing slides in a container before disposal, for example) when sending slides for disposal, and may also need a business-associate agreement to ensure that proper confidentiality is maintained in the course of disposal by the hauler. Although HIPAA does not require a laboratory to make certain that the business associate is complying with HIPAA, a good idea might be to have in writing the procedures that the business associate uses in disposing of slides as further proof of good-faith effort to comply. If the lab becomes aware of a violation by a business associate, it does have an obligation to try to prevent further such violations or, if that is not possible, end the contract and find another business associate that will work by the rules.

Since I have been unable to find any official opinion or information that is contrary to that original assessment, I would certainly welcome input from readers about their experiences in this area. In the interim, business (sensing a void) and technology (ever expanding) have moved to create alternatives for those who are uncomfortable leaving the identifying information on slides once they are being thrown away. At least one company has in development an in-lab slide-disposal system that will break up glass slides prior to their disposal, rendering even potential HIPAA concerns moot. Though this creates its own problems (disposing of large quantities of broken glass on a daily basis) and increases expenses, this technique may offer a resolution to this perennial problem. Physical obliteration of labels with opaque marker or by dipping the end in ink may also serve but are time and labor intensive.

The use of bar codes that tie the specimen to the sensitive medical information can also alleviate the concerns of a nervous HIPAA coordinator, because such codes reduce the need for name identification on the slide itself. The separation of information means that it must be reconnected at some point in order to produce the finished report; and, depending on the system, this may add a step to the reporting process.

In light of the recurring uncertainty about slide management, a good idea is to make an effort to limit the amount of truly identifiable information placed on slides and to document in detail the disposal management. That way, if questions are asked, a lab can demonstrate its efforts to limit disclosure of information when the slides are in the lab as well as ensure proper handling once the slides leave for destruction.

In short, there are many answers to the problem of slide disposal--but no single articulated "gold standard" of which I am aware. How you choose to dispose of slides will depend on the resources available and how much expense the lab is willing to bear.

Much more important, and something that has been the subject of litigation, is the proper management of computers and other portable, information-dense medical information by healthcare workers including lab personnel. Proper eradication of information from mass-storage devices before recycling or disposal is critical, and there have been several high-profile instances in which proper procedures have not been followed, resulting in the lead of medical information. Formal "sanitizing" of discs to obliterate, not simply de-access, information is required to prevent future retrieval of information by a dedicated computer whiz. In some cases, physical destruction of the drive is preferable. A wide variety of companies offer media clearing and destruction that are HIPAA compliant.