The short answer
Security officers protect patient privacy and dignity by limiting access to information, using discreet communication, and treating every person respectfully. Officers should receive the facility’s privacy training, access only information needed for their assigned duties, avoid discussing incidents in public areas, secure reports and video, and route requests for patient information to authorized healthcare staff. HHS explains that covered entities generally must limit uses, disclosures, and requests for protected health information to the minimum necessary for the purpose; the facility…
What to know
Dignity also affects how an officer responds. Use the person’s preferred form of address when known, explain actions when circumstances allow, avoid unnecessary public exposure, and account for disability, language, age, culture, trauma, and behavioral-health needs. Security should not diagnose, punish, or use clinical information as a label. When intervention is necessary, preserve as much privacy and autonomy as safety permits and use the least restrictive approach allowed by law and policy.
Reports should contain objective security-relevant facts, not gossip or unsupported medical conclusions. Whether an outside security provider is a HIPAA business associate depends on the contracted functions and access to protected health information; it should not be assumed from the job title alone. The healthcare organization’s privacy officer or counsel should determine the relationship, required agreements, safeguards, access limits, and retention rules. Arrow should incorporate the approved requirements into site orientation, supervision, and post orders.