One of our HIPAA clients asked me whether “shadow” students are “students” that fall under the treatment, payment, or health care operations exemption for which the covered entity does not need to get signed patient consent or authorization. In my opinion, such shadow students do not fall under that exemption because shadow students are not involved in or providing treatment of the patients, but only observing. See Chapter 18 of my book The Compliance Guide to HIPAA and the DHHS Regulations, 6^th edition, available here, for a complete definition of treatment, payment and health care operations exemptions.

Thus, some other ground for an exemption that complies with HIPAA is necessary to be able to allow shadow students to conduct such observation. The safest method of so doing is to obtain a signed consent by the patient. I have seen some covered entities merely ask the patients whether they have any objection to having the shadow student observe. In this scenario, the oral consent must be documented in the medical record. Note that the HIPAA authorization for family members and even close personal friends who are involved in the patients care will likely not work because the shadow student is not involved in the care and the patient seldom if ever will have a family or friend relationship with the shadow student. An argument could be made that, if patients do not object to the shadow student’s observation, that scenario is a tacit consent. Finally, always remember that, if another state or federal law affording more privacy protection requires something more, such as a court order (see 42 C.F.R. Part 2) or a consent containing particular language, the covered entity must comply with the more stringent law.

In short, nothing prohibits covered entities from using shadow students this way, but HIPAA requires that such use be done in a HIPAA compliant manner. Again, the safest thing to do is to get a signed consent from the patient and keep it in the patient’s medical record.

As an aside, again please note our new address for both Veterans Press and EMR Legal: 121 W. 63^rd Street, Suite 209, Kansas City, MO 64113. Also, again please note that I have bought out Richard Dvorak’s interest in both Veterans Press and EMR Legal, so please contact me directly at jon@veteranspress.com or my associate, Alice McCart, at alice@veteranspress.com or our IT guru, Brent Sadler, at brent@wccit.com.