Knowledge and Practice of Patients’ Data Sharing and Confidentiality Among Nurses in Jordan

Introduction

The rights of patients have been reviewed as a component of the human rights concept since the Universal Declaration of Human Rights was adopted.^1–3 The primary objective of patient rights is socially supporting and strengthening patients.⁴ The key patient rights entail respecting human decency, receiving healthcare services of high-quality, the right to information, the initial agreement of the patient to medical intervention, respecting privacy and personal life, and sustaining care and treatment.^1–3

Since advancements in technology simplify the intervention in the private lives of individuals, there is an increase in demand to protect privacy and confidentiality. The demand influences healthcare services provided and creates new methods.⁵ This produces new discussions in the medical ethics field and health law regarding the promise of individuals gaining from healthcare services to have the right to personal privacy.^1,6,7 The deliberations and recommendations relating to the legal and moral dimensions of the right to confidentiality in healthcare services have a special significance in the protection and preservation of this right.⁸

Patient rights are under intensive debate, at both national and international scope. Numerous countries have included patient rights in health legislations. Rights regarding health are usually contained in the constitution or main national legislation.^4,9 While some countries in Europe have amended and revised their current legislations regarding the rights of patients, some countries have enacted new laws. The rights of a patient to confidentiality entail the privacy of information regarding the patient and bodily patient privacy.^9,10 Confidentiality and privacy are crucial in developing and preserving a courteous relationship in clinics. The right of privacy has a social advantage since it promotes a definitive consultation of health-related challenges between nurses and patients.¹¹ It is a requirement of privacy for clinicians to confidentially preserve information offered by patients or that they receive from interacting professionally with the sick.¹² Privacy is vital since it offers a safe patient environment where patients get medical attention and offer complete and precise information, and which strengthens trust in healthcare and stresses the significance of respecting the patient’s right.¹³ Each person has the right to the privacy of personal information, as well as the information concerning their health status and possible check-up or therapeutic exercises, including the safeguarding of their privacy during the conduction of diagnostic examination, professional visits, and general medical/surgical procedures.^12,14 All the data and information concerning the health status of an individual, and the medical/surgical procedures they undergo, must be treated with privacy, and should thus have adequate protection.¹⁵ Individual privacy must be dignified, even during medical/surgical procedures (check-up examinations, professional visits, and drugs, etc.) which must occur in the right conditions and the presence of the necessary individuals (unless a patient explicitly agrees or requests).^14,16

Nurses, healthcare providers, and patients getting healthcare services and their relatives should understand patient rights to enable the improvement in the standards of the offered and received services. Legal implements alone do not suffice. It is essential to enact these legal provisions.¹⁷ As a result of this, all experts in healthcare, especially nurses, should be informed, aware of patients’ rights.¹⁸ For an integrated approach to be realized in the health sector, it is essential that nurses persistently include the rights of patients in their actions. Personal needs should have psychological, social, cultural, spiritual, and intellectual aspect satisfaction within an integrated health approach. The importance of this study is that it addresses the widely emerging trend of patient data sharing information and confidentiality among nurses in developing countries taking Jordan as an example. Moreover, this is the first study assessing the confidentiality issue from the perspective of nurses in many clinical settings. The objective of this study is to survey the knowledge and practice of nurses in various healthcare industries toward sharing patient data and confidentiality.

Method

The focus population of this research is composed of nurses. Regarding the sample size, the study was carried out in all Jordanian health facilities, with anticipation that all eligible nurses will participate.

A descriptive cross-sectional design was employed through an online survey from May to June 2020. The researcher used the G*Power software version 3.1.92 to calculate the sample size. A significance level of 0.05, a power of 0.95, and 11th variables were among nurses with a medium effect size of 0.15 with the minimum number of subjects being 750. Based on an anticipated dropout rate of 15%, the target number of participants was 900. The researcher performed an analysis of the data on 800 nurses. The heads of healthcare facilities were mailed a link to an online survey; the heads then forwarded the links to the nurses. A survey questionnaire was distributed electronically to a convenience sample of 1000 nurses working at any private and governmental healthcare facilities in Jordan. Inclusion criteria include holding at least a bachelor's degree and having a current job in a hospital. A total of 800 nurses agreed to participate in the study (response rate is about 80%). The nurses were requested to willingly participate in the research by filling the consent form on the first electronic page and filling out the online questionnaire, which had automatic submission to a database.

The authors developed an instrument that contained 19 statements reflecting the understanding of nurses’ knowledge and practice of privacy and the sharing of data required to safeguard a patient’s privacy. This instrument had two sections. The first section is about knowledge and consists of 13 items regarding knowledge about data extraction and institution policy for this issue, and the second part consists of six items asking about practice for data sharing. The scores of this scale range between 0 and 19. The nurse was given two points for a correct answer and one point for a wrong answer and not knowing the answer. The score scale range from 13 to 26 and the practice score scale ranged from 6 to 12. As the score increased, this means less confidentiality toward patient information. This instrument was developed by the researchers based on the literature. More than 10 articles related to the same subjects were reviewed by the authors of the current paper and the items related to this instrument were collected in one sheet and then sent to five experts in the healthcare area and reviewed for the suitability and accuracy. For content validity, the authors assessed whether a test was representative of all aspects of the construct and found the instrument covered all relevant parts of the subject it aimed to measure. For the face validity, the authors found the survey seemed representative of what was wanted to test which considered having high face validity. To achieve construct validity, the authors ensured that your indicator of data sharing and confidentially and measurements were carefully developed based on relevant existing knowledge.

A pilot study was conducted, and the face validity was first checked – several colleagues reviewed the draft questionnaire. The associates were requested to provide their take on clarity and question accuracy. The questionnaire was then adjusted according to their suggestions. Later, to guarantee participants understanding what the questions required, the verbal protocol was used to validate the questionnaire further. This involved separately recruiting 10 respondents and requesting them to complete the questionnaire. The respondents were requested and asked to think aloud, and to explain what each of their answers meant, and what each question meant to them. The nurse recorded each of their answers, and the questionnaire had an appropriate adaptation. Furthermore, there was an establishment of internal reliability that was 0.77 Cronbach’s alpha.

Data Analysis

Descriptive statistics were employed for knowledge and the respondent’s practices. Descriptive data analyses were carried out to determine means and percentages of responses. The Pearson correlation test was conducted between knowledge and practice toward data sharing and confidentiality. Moreover, a multiple regression test was carried out to determine the predictors of knowledge, attitude, and practice of nurses toward sharing information and confidentiality of the patients.

Results

Demographic Characteristics

Demographic characteristics of the study are shown in Table 1. Average age of participants was 32.3 (SD=7.79) years, females represented 50.5%. The majority of the study participants were Jordanian, married, and living in a city. Most of the study participants, 616 (77%), were practicing nurses. Yet, only 4.4% had previous research experience.

Table 1 Demographic and Work Characteristics of Study Participants (N=800)

Knowledge of Data Sharing and Institutions’ Policies

For the knowledge, the mean score was 21.03 (SD=3.7). This reflects that the knowledge for participants was considered moderate and still required improvement. Less than half of the participants (36.5%, N=292) indicated to have previously participated in a data security workshop. Besides, roughly all participants agreed that junior nurses should participate in a data sharing and confidentiality course before engaging or starting practice. Storage and access to data were majorly conferred to nurses and healthcare providers who have direct contact with the patients (N=572, 71.5%). Regarding institutional policies for data sharing and protection, the responses of nurses if there are special recommendations and instructions from their institution related to exchange of patient information among the medical staff, many agreed there are recommendations for that (N=572, 71.5%), and regarding special recommendations and instructions from the institution in which they work to circulate patient information in general, many nurses (N=463,57.9%) agreed there are special recommendations. Additionally, most nurses (N=578, 72.5%) reported that there are regulations in the institution in which they work, the patient’s information shall be taken just by nurses and healthcare providers with direct contact with patients. Additionally, many nurses indicated that policies agreed upon in the institution are that the information be taken from the patient and documented with complete privacy and confidentiality (N=712, 89.4%).

Regarding if there are patient information privacy documents that need to be signed for every person who has permission to access patient information, many reported there are one or more documents (N=564, 70.7%). Regarding a training program, 498 (60.7%) nurses reported that there is one concerning safeguarding sensitive patient information such as psychotic and sexually transmitted illnesses, or LGBT. They further indicated that responsible facilities often erected more limitations for sensitive information compared to the regular information when dealing with patients (N=702, 88.0%). Intriguingly, 85% of nurses reported getting information from electronic sources required for providing healthcare for the patients.

Practice of Data Delivery and Storage

For the practice, the mean score was 7.8949 (SD=1.88). This means that still some of the nurses are not safe in practicing data sharing for patients’ data. The response of the nurses showed that many of them agreed mainly using the computers of their institutions with a single password for all healthcare providers (N=607, 76.5%). For data delivery and storage, a USB flash memory was used (N=274, 34.3%), and an e-mail was used (N=127, 21%). Additional methods used to deliver data were mobile phones and printouts accounted for the other (N=248, 41.2%). However, to store the data, personal laptops were used (N=167, 21.0%). Concerning the practices of the nurse, roughly three-quarters of the participants reported the constant antivirus installation in their computers. Besides, the confidentiality of patients was a priority for most of them (N=678, 85.0%). Roughly a fifth of nurses indicated that persons not related to the caring process such as cleaning persons entered the examination room during the presence of the patients (N=131, 16.4%). Some nurses observed that the patient’s condition is discussed in front of other patients to shorten the time and place (N=168, 21.1%). Most nurses maintained to have always guaranteed the confidentiality of patient data and not disclosing health records to unauthorized individuals and have handled sensitive information with more caution (N=777, 97.1%).

Correlation Between Knowledge and Practice of Data Sharing

The results showed there was a correlation between knowledge and practice of data sharing and confidentially (x=0.457, P≤0.001). This means as the knowledge increased, greater confidential practice toward patient data practice among nurses.

Predictors of Patients’ Data Sharing and Confidentiality Among Nurses

A multiple regression test was used to predict knowledge and practice of nurses toward patients’ data sharing and confidentiality according to demographic variables (age, gender, education level, work experience, and job role). Table 2 summarizes the outcomes of the multiple regression tests. All of the listed factors are not associated with the perception of patients’ data sharing and confidentiality among nurses (p>0.05) except age (B=−0.135, p=0.010), gender (B=0.155, p=0.01), marriage (B=0.145, p=0.01), and attending a security course before practice (B=0.110, p=0.01).

Table 2 Predictors of Knowledge and Practice of Data Sharing and Confidentiality Among Nurses for Patients’ Information (N=800)

Discussion

This is the first national study in private and governmental hospitals that has been undertaken in Jordan to examine the knowledge and practice of nurses in various healthcare industries toward sharing patient data and confidentiality. The current research, which was conducted in private and public hospitals in Jordan, used a quantitative method to assess data sharing and confidentiality among nurses. This study found that patients have various exposure extents to nurses and healthcare providers. There is thus a higher risk of threatening private information, and it is more difficult to ensure safety and confidentiality.

Knowledge for Patients’ Data Sharing and Institutional Policies Among Nurses

Regarding knowledge for the legal issues and recommendation with data sharing and confidentiality, the current study found many nurses reported that they knew there are special recommendations and instructions from the institution in which they work to circulate patient information in general; there are regulations in the institution in which they work, and the patient’s information shall be taken by the health personnel only. Moreover, there are policies in their institutions that the information should be taken from the patient and documented with complete privacy and confidentiality and there are training programs on the confidentiality and privacy of patient information for the medical staff. According to the Centers for Disease Control and Prevention (2011) and Connecticut Department of Public Health (2017), all regulations and appropriate technical and administrative guidelines should be enacted to prevent illegal access and data movement to the different environments.^27,28 Roughly one-third of nurses had used insecure methods to share/transfer patient information. It is vital to regard the safeguarding of patient data as the duty of nurses. More vigorous methods should thus be employed, as well as encryption and tough variation methods. Similarly, a literature review revealed that executing legal provisions in handling safety and privacy of delicate information was common as a result of non-technical actions, leaning/training initiatives, and increasing the knowledge on the subject.²⁹ A different systemic review identifying healthcare nurses’ needs to have effective training on the confidentiality of patient information recommended that healthcare authorities must handle the requirements and offer training on regulations regarding confidentiality, while the healthcare practitioner should possess the right sets of skills to guarantee the safety and privacy of patient health information.³⁰

Practice for Patients’ Data Sharing Among Nurses

The current study found that roughly a fifth of those who entered the examination room during the presence of the patients were not related to the healthcare process, such as cleaning persons. Additionally, a fifth reported that the patient’s condition is discussed in front of other patients to shorten the time and place. This was consistent with previous literature that indicated some merged sites where concerns regarding the privacy and confidentiality of patients were raised.²⁰ A previous study in Vietnam reported there are no private rooms to examine patients and other workers could enter the room at the time of examination.⁴

The results of this study showed that more than quarters of participants reported the use of computerized public-access systems and shared passwords which may result in the leakage of confidential data. Similarly, Khac Hai et al reported from Vietnam that a quarter of nurses were using the same computer with the same password to access patients’ information.⁷ A study in the USAs found that regardless of the physical security of a system, multidisciplinary nurses who are not concerned with patient care may access detailed patient data.²¹ Nonetheless, it can be deduced that any environment has the probability of breaching patient privacy if there are no appropriate security measures.

The current study reported that a fifth of nurses used personal laptops to store patients' data. Concerning the practices of the nurse, roughly three-quarters of the participants reported constant antivirus installation on their computers. Similarly, Khac Hai et al reported that roughly 25% of nurses recorded patient information on personal computers. The electronic data security practices that need computer software and electronic services had become concerning to risk management because only 14% of nurses frequently changed their passwords, and 40% often installed and utilized antivirus applications on their desktops with patient information.⁷ There should be a reiteration and enforcement of these policies. In a study from the USA, it was indicated that roughly 74% of nurses and patient offices installed secure locks, while 54% initiated a specialized application to monitor access to computers.¹⁸

Sensitive personal data as defined in data protection legislation should include specific protections for highly stigmatized diseases, such as sexually transmitted and psychiatric illnesses. The current study found that the majority of students reported that the information of some patients with allergic diseases, mental illness, and sexual diseases are treated with more privacy. Similarly, a study by Holt et al²⁵ reported that homo/bisexual men research revealed that disclosing their status was employed in managing the condition. Likewise, a study by Cross and Sim on clinical staff study revealed that the staff felt they had the right to share patient information with their colleagues on the basis to inform.²⁶ The current study found that more than 95% of nurses always guaranteed confidentiality of patient data and not disclosing health records to unauthorized individuals and have handled sensitive information with caution. In agreement with our results, Khac Hai et al found that roughly 58% of nurses did not disseminate patient details in combination with various security practices and patient information confidentiality.⁷ On the contrary, it was reported that roughly 39% of nurses in Vietnam are disseminating sensitive data to unauthorized individuals. Nonetheless, for nurses who reported never receiving approval, it would be partly because these individuals did not have the responsibility of using the information.²² Similarly, many studies reported that almost 38% of nurses reported the disclosure of patients’ status without their approval. Other countries in Africa and Asia also reported this occurrence with a variance between 15% and 50%.²³ Intriguingly, research among medical students found that roughly three-quarters believed they had the right of informing a partner of the patient's status without their approval and without asking for permission. Nevertheless, in general, 70% of members of the community wanted the preservation of patient confidentiality.²⁴ In summary, some nurses often or always shared patient information. This shows a rampant practice among nurses who directly access patient treatment and care data, thereby increasing the possibility of contravening patient confidentiality. The management staff responsible for patient registration and nurses who ask for some details regarding the conditions of a patient may occasionally expose patient details.

Correlation Between Knowledge and Practice of Data Sharing

The current study found there was a correlation between knowledge and practice of data sharing and confidentially. This means as the knowledge increased, greater confidential practice toward patient data practice among nurses. Our study was congruent with studies by Khac Hai et al. and Karasneh et al who found that as knowledge regarding data sharing and confidentiality, the nurses and healthcare providers exhibited greater confidentiality toward patients’ data sharing.^4,28

Predictors of Knowledge and Practice of Data Sharing Among Nurses

The multiple regression analysis carried out in the study to comprehend the effect of the demographic attributes of nurses on data sharing and confidentiality of their patients indicated that there was some connection between these attributes and the nurses on data sharing and confidentiality of their patients. These factors include age, gender, marriage status, and attending a security course before practice. Young age, female, not attending a data sharing course, and single nurses are less engaging with data sharing and confidentiality of the patients for unauthorized patients.

None of the previous studies determine that demographic data are the predictors of data sharing and confidentiality in nurses regarding their patients. The only factor determined in the previous studies was attending a data security course. This is consistent with previous work which reported that nurses who had full training about data sharing and confidentiality among nurses are less engaged with sharing data to unauthorized people in Vietnam.⁴ Offering educational apparatus was the best way of ensuring adherence with regulations concerning safety and confidentiality, where health organizations would regularly update all professional health nurses about the regulations and methods of preventing sensitive information exposure.^7,29,31 Several studies revealed that ineffective training on safety and privacy could impact on care. It was suggested that there was a need to invest in training with standard learning materials at the start of employment and during employment.

Implications for Practice

The study findings propose various issues that may be put into consideration when amending regulations and guidelines imposed by Jordan health authorities and other countries experiencing the same situation. Besides, it is also important to consider and develop a concise strategy to ensure the confidentiality, safety, and security of patient information while planning for the development and implementation of computerized systems and case management processes. Training is essential since it will have a beneficial relationship with knowledge, opinions, views, and actions. Thus, planning continuous training on policies and regulations about data safety and privacy may assist in improving healthcare settings' practices.

Jordan has policies that prevent and regulate disclosure of information that identifies a patient, and repercussions for breaking the law. However, the guidelines requirements/approaches for monitoring and enforcement have not been rigorous. Jordan could benefit by embracing core standards for data safety and privacy in various countries. For instance, the strict central technical principles enforced by the Centers for Disease Control and Prevention such as: 1) nurses that access data that identify a patient should attend annual security/privacy training; and 2) new nurses should sign, while all other staff re-sign, an annual non-disclosure agreement. Central data sharing and release standards include, for instance, risk assessment and advantages of data sharing, should the data sharing exceed the original scope. Nonetheless, research in different countries concluded that a strong partnership is essential at both local and national levels for a successful establishment and guidance enactment.

Conclusions

Generally, the practices that ensure the security and protection of patient information among nurses were found to be at acceptable levels. A significant proportion of the staff had appropriate practices that ensured data security. However, practices that ensures patient confidentiality in the aspects of access, sharing, and transferring of patient data need improvement. It was revealed that most nurses have good or reasonable knowledge as well as positive perceptions regarding security and confidentiality issues. Besides, individuals with good and reasonable knowledge and perception tend to engage more in suitable practice compared to those who need improvement. To enhance practices related to security and confidentiality of patient information, the staff must receive training in data confidentiality and security. The training will enhance their knowledge and awareness of the perception and attitude changes required.