HIPAA / Confidentiality Policy

Policy Statement

Texas Rescue Med expects all students, instructors, staff, and program participants to protect confidential information at all times.

Students and personnel may encounter protected health information, patient care information, student education records, clinical site information, agency information, business records, payment information, personnel information, and other sensitive information during Texas Rescue Med activities.

Violation of this policy may result in remediation, removal from clinical or field activities, course failure, administrative withdrawal, dismissal, termination of access, reporting to regulatory or certification bodies, and possible civil or criminal consequences.

Scope of This Policy

This policy applies to confidentiality expectations related to:

• Classroom instruction.
• Online, hybrid, and virtual instructor-led training.
• Learning Management System activity.
• Skills labs and simulations.
• Hospital clinical rotations.
• Ambulance field externship.
• Field internship.
• Capstone field internship.
• Ride-along or observation experiences.
• Patient contact documentation.
• Preceptor evaluations.
• Student records.
• Academic and remediation records.
• Clinical onboarding records.
• Payment and account records.
• Communications with Texas Rescue Med personnel.
• Communications with clinical affiliates or field agencies.
• Social media, photography, video, audio, and electronic communications.
• Any Texas Rescue Med educational, administrative, clinical, or field activity.

This policy applies whether the confidential information is written, verbal, electronic, photographic, video-based, audio-based, observed, overheard, displayed, printed, downloaded, transmitted, or documented in any format.

Relationship to HIPAA

Students may encounter patient information during clinical, field, laboratory, simulation, documentation, or educational activities. HIPAA requirements apply where the relevant organization or activity is subject to the HIPAA Rules. All students must also comply with TRM policy and the confidentiality, security, and reporting rules of the clinical or field site.

HIPAA directly regulates covered entities and business associates; Texas Rescue Med’s status and obligations depend on its actual functions and legal relationships. This student confidentiality policy is not a HIPAA Notice of Privacy Practices. Hospitals, EMS agencies, and other clinical partners may have their own HIPAA notices, privacy policies, and reporting procedures.

Whether or not HIPAA applies directly to a particular TRM activity, protecting patient information, student records, and confidential program information remains mandatory under this policy.

For federal guidance, see HHS: Covered Entities and Business Associates.

Definitions

Protected Health Information (PHI) is individually identifiable health information protected under HIPAA when held or transmitted in a context covered by the HIPAA Rules. Information that identifies a patient in connection with care remains confidential under TRM policy even when the precise HIPAA legal definition does not apply to TRM.

Individually identifiable information may include, but is not limited to:

• Patient name.
• Address.
• Date of birth.
• Social Security number.
• Medical record number.
• EMS incident number.
• Account number.
• Phone number.
• Email address.
• Photographs or video.
• Full-face images or identifying images.
• Vehicle, license plate, or scene details that identify a patient.
• Dates, times, locations, or unique details that could identify a patient.
• Any other information that could reasonably identify a patient.

Confidential Information means any nonpublic information encountered through Texas Rescue Med, clinical affiliates, field agencies, students, instructors, staff, patients, agencies, business operations, educational systems, or program records.

Student Education Records means information related to a student’s admission, enrollment, grades, attendance, LMS activity, clinical performance, field performance, remediation, professionalism, discipline, completion, financial status, or program participation.

Authorized System means a system approved by Texas Rescue Med or an assigned clinical or field partner for documentation, communication, storage, or reporting.

Privacy Incident: An actual or suspected unauthorized access, use, disclosure, loss, theft, transmission, posting, copying, photographing, recording, or mishandling of patient or confidential information. Whether an incident constitutes a legally reportable breach requires separate assessment under the rules applicable to the responsible entity.

Confidential Information Covered by This Policy

Patient Information

• Patient names.
• Patient demographics.
• Medical history.
• Assessment findings.
• Chief complaints.
• Vital signs.
• Medications.
• Allergies.
• Diagnoses.
• Treatment information.
• Transport information.
• Refusal documentation.
• Hospital destination.
• Patient care reports.
• EMS incident details.
• Photographs, videos, or audio involving a patient or scene.
• Any information that could identify a patient directly or indirectly.

Clinical and Field Information

• Clinical site assignments.
• Field site assignments.
• Preceptor evaluations.
• Clinical performance feedback.
• Patient contact documentation.
• Procedure logs.
• Clinical incident reports.
• Field incident reports.
• Site-specific operating procedures.
• Agency documents not intended for public release.
• Hospital or EMS agency internal information.

Student Information

• Application and enrollment information.
• Grades.
• Attendance.
• LMS activity.
• Exam results.
• Skills evaluations.
• Clinical or field performance.
• Remediation records.
• Professionalism or conduct records.
• Accommodation information.
• Health or immunization documentation.
• Background check status.
• Drug screen status.
• Financial account status.
• Appeals, complaints, grievances, or disciplinary records.

Texas Rescue Med Business and Program Information

• Internal policies or drafts not publicly released.
• Exam questions, quiz questions, answer keys, and testing materials.
• Skills testing scenarios.
• Simulation scenarios.
• Rubrics and evaluation tools not authorized for distribution.
• Instructor materials.
• Student records.
• Personnel records.
• Financial records.
• Vendor or partner agreements.
• Internal communications.
• Program quality improvement data.

Minimum Necessary Standard

As a TRM confidentiality standard, students, instructors, staff, and program participants may access, use, discuss, or share only the information reasonably needed for an authorized educational, clinical, administrative, compliance, safety, or operational purpose.

Use the least information needed for the approved task, consistent with patient care, supervision, site policy, and applicable law. HIPAA’s legal minimum-necessary rule has exceptions, including certain treatment disclosures; this TRM safeguard does not prevent disclosures required or permitted by law.

Curiosity, personal interest, relationship to the patient, relationship to the student, employment status, agency affiliation, or public knowledge of an incident does not authorize access to confidential information.

Student Responsibilities

Students are responsible for protecting confidential information during all Texas Rescue Med activities. Students must:

• Maintain patient confidentiality at all times.
• Maintain confidentiality of student and program records.
• Access only information needed for assigned educational activities.
• Use only approved documentation and communication systems.
• Follow Texas Rescue Med, clinical site, and field agency privacy policies.
• Follow HIPAA and confidentiality training requirements.
• Report suspected privacy incidents immediately.
• Ask for clarification before documenting, discussing, sharing, or transmitting uncertain information.
• Protect login credentials, passwords, and account access.
• Secure all paperwork, notes, electronic devices, and documentation.
• Avoid discussing patient or student information in public areas.
• Use deidentified information only when authorized and educationally appropriate.
• Follow all clinical affiliate and field agency confidentiality agreements.

Prohibited Conduct

Students, instructors, staff, and program participants may not:

• Access patient information without a legitimate educational or clinical need.
• Access student records without authorization.
• Discuss patient information in public areas, hallways, elevators, restaurants, social settings, or online spaces.
• Share patient information with family, friends, classmates, coworkers, employers, or agency members unless authorized.
• Post patient information, scene information, photos, videos, or incident details on social media.
• Photograph or record patients, patient records, monitors, scene details, facility screens, PCRs, or clinical documents without authorization.
• Remove patient records from a clinical or field site unless expressly authorized.
• Copy, download, print, screenshot, or transmit confidential information without authorization.
• Use personal email, personal cloud storage, personal messaging apps, or unsecured platforms for PHI or confidential information.
• Enter patient-identifying information into unapproved systems.
• Share login credentials.
• Use another person’s account.
• Leave confidential paperwork or devices unattended.
• Falsify, alter, or fabricate patient care documentation.
• Use patient stories, images, or details for personal, public, social media, marketing, or entertainment purposes.
• Use confidential information to embarrass, harass, retaliate against, or harm another person.

Patient Care Documentation

Students must complete patient care documentation only through systems approved by Texas Rescue Med and the assigned clinical or field partner.

Students must follow all documentation instructions, including:

• Documenting only assigned patient contacts.
• Recording information accurately and honestly.
• Avoiding unnecessary patient identifiers when documentation is for educational tracking.
• Using approved patient contact forms, PCR exercises, or clinical tracking systems.
• Submitting documentation by assigned deadlines.
• Obtaining required preceptor validation.
• Reporting documentation errors promptly.

Students may not create unofficial patient records, copy official agency PCRs for personal use, photograph PCRs, send PCRs through unsecured channels, or store patient documentation on personal devices unless expressly authorized in writing by Texas Rescue Med and the clinical or field site.

LMS, Assignments, and Educational Documentation

Students must not enter patient names, dates of birth, addresses, medical record numbers, EMS incident numbers, photographs, or other patient-identifying information into the Texas Rescue Med LMS, assignments, discussion boards, quizzes, emails, or public website forms unless specifically directed to use an approved secure system for that purpose.

When discussing clinical or field experiences for educational purposes, students must deidentify the information and remove details that could reasonably identify the patient, location, crew, agency, or incident unless disclosure is specifically authorized.

Acceptable educational discussion may include general clinical concepts, assessment findings, treatment principles, and lessons learned when no patient-identifying information is disclosed.

Deidentification Standards

Information is not automatically deidentified simply because the patient’s name is omitted.

Students must remove or avoid details that could identify the patient, including:

• Name.
• Date of birth.
• Address.
• Specific incident location.
• Specific date and time of the incident.
• EMS run number.
• Medical record number.
• Photographs or video.
• Unique injuries or rare circumstances that could identify the patient.
• Names of family members, responders, facilities, agencies, or bystanders when identifying.
• Social media details or public incident references.

If a student is unsure whether information is sufficiently deidentified, the student must ask Texas Rescue Med before sharing or submitting it.

Removing a patient name alone does not establish HIPAA de-identification. When formal HIPAA de-identification is required, the applicable covered entity or business associate must use a recognized method. See HHS de-identification guidance.

Social Media, Photography, Video, and Audio

Students, instructors, staff, and program participants may not post, publish, transmit, or share any patient-related, clinical-related, field-related, or confidential program information on social media or public platforms.

This includes, but is not limited to:

• Patient images.
• Scene photos.
• Ambulance or hospital photos involving patient care.
• Monitor screens.
• PCRs or medical documents.
• Clinical site documents.
• Patient stories with identifying details.
• Ride-along or clinical shift details that identify a patient, agency, crew, facility, or incident.
• Comments about specific patients, calls, crews, preceptors, agencies, hospitals, classmates, instructors, or incidents.

Students may not take photographs, video, or audio recordings during clinical, field, lab, simulation, or classroom activities unless specifically authorized by Texas Rescue Med and the site or individuals involved.

Even when a patient, scene, or incident has been discussed publicly, reported in the media, posted by others, or shared by an agency, students remain bound by this confidentiality policy.

Electronic Communications

Confidential information must be communicated only through authorized channels.

Students must not send PHI or confidential information through:

• Personal email.
• Unsecured text message.
• Social media messaging.
• Personal cloud storage.
• Public website forms.
• Consumer file-sharing applications.
• Personal messaging apps.
• AI tools or chatbots not approved for confidential information.

If a student receives confidential information through an inappropriate channel, the student must not forward, repost, or continue the disclosure. The student must notify Texas Rescue Med promptly.

Artificial Intelligence and External Tools

Students may not enter PHI, patient details, clinical site information, student records, instructor records, financial information, or confidential Texas Rescue Med information into artificial intelligence tools, chatbots, transcription systems, note-taking applications, or external platforms unless the tool has been specifically approved by Texas Rescue Med for that purpose.

Students may use technology tools for general learning only when no confidential information, patient information, identifiable case details, proprietary exam content, or restricted program material is entered.

Clinical Affiliate and Field Agency Requirements

Students must comply with all confidentiality, privacy, HIPAA, documentation, photography, social media, security, and patient information rules of assigned clinical affiliates and field agencies.

Clinical or field sites may require students to sign site-specific confidentiality agreements, complete training, follow electronic documentation rules, use facility-approved systems, and report incidents directly to the site.

Violation of a clinical or field site confidentiality policy may result in removal from the site, denial of future placement, administrative withdrawal, dismissal, or reporting to regulatory or certification bodies.

Peer, Instructor, and Student Record Confidentiality

Students may not access, disclose, discuss, photograph, record, post, or share confidential information about classmates, instructors, staff, preceptors, or other students.

This includes:

• Grades.
• Exam performance.
• Remediation.
• Disciplinary action.
• Accommodation status.
• Health information.
• Financial status.
• Background check or drug screen status.
• Personal contact information.
• Complaints, grievances, or appeals.
• Private communications.

Students are expected to maintain professionalism and confidentiality during group activities, peer evaluations, skills labs, simulations, and clinical discussions.

Simulation and Case-Based Learning

Simulation cases, scenario materials, patient scripts, standardized patient activities, moulage scenarios, and case-based learning materials may include realistic clinical details.

Students must treat simulation materials as confidential educational materials unless Texas Rescue Med has released them for public use.

Students may not share simulation cases, test scenarios, rubrics, checklists, answer keys, or evaluation materials with students who have not yet completed the activity.

Confidentiality During Complaints, Appeals, and Investigations

Complaints, grievances, appeals, clinical concerns, conduct reviews, Title IX matters, privacy incident reviews, exposure reports, and disciplinary matters are confidential administrative processes.

Individuals involved in a complaint, appeal, investigation, or privacy review must protect confidential information from unnecessary disclosure. This does not prevent making lawful reports to regulators, law enforcement, legal counsel, or other authorized recipients; seeking appropriate support; or participating in protected complaint and appeal processes.

Retaliation, intimidation, gossip, harassment, or unauthorized disclosure related to a complaint, appeal, investigation, or privacy review is prohibited.

This policy does not restrict legally protected reporting, cooperation with authorized investigations, or the exercise of rights under applicable complaint and appeal procedures.

Privacy Incident Reporting

Students, instructors, staff, and program participants must report actual or suspected privacy incidents immediately.

Reportable privacy incidents include, but are not limited to:

• Lost or stolen documents containing confidential information.
• Lost or stolen devices containing confidential information.
• Unsecured email or text message containing PHI.
• Screenshot, photograph, or video of patient information.
• Social media post involving patient or confidential information.
• Wrong-recipient email or message.
• Unauthorized access to records.
• Unauthorized disclosure to another person.
• Misplaced clinical paperwork.
• Patient information entered into an unapproved system.
• Sharing of confidential student information.
• Any situation where PHI or confidential information may have been accessed, used, or disclosed improperly.

How to Report a Privacy Incident

Privacy incidents must be reported as soon as possible to Texas Rescue Med through an official communication channel.

If the incident occurs at a clinical or field site, the student must also notify the assigned preceptor, site supervisor, charge nurse, agency supervisor, or other designated site contact according to site policy.

Reporting safeguard: A plain email or website contact form is not an approved mechanism for sending patient records or other sensitive attachments. Use it only to initiate contact and follow instructions for secure incident documentation.

Required Information in a Privacy Incident Report

A privacy incident report should include:

• Name of the person reporting.
• Contact information.
• Course level and cohort, if applicable.
• Date and time of the incident.
• Location of the incident.
• Description of what occurred.
• Type of information involved.
• Whether PHI or student information was involved.
• Who may have accessed or received the information.
• Whether any photos, screenshots, documents, messages, or recordings were involved.
• Steps already taken to contain the incident.
• Names of Texas Rescue Med or site personnel already notified.

Texas Rescue Med may request additional information during review.

Immediate Containment Steps

When a privacy incident occurs, students and personnel should take immediate steps to limit further disclosure when safe and appropriate.

This may include:

• Stopping the unauthorized communication.
• Deleting an unauthorized social media post when directed.
• Retrieving misdirected paperwork if possible.
• Notifying the recipient not to forward or use the information.
• Securing documents or devices.
• Notifying Texas Rescue Med and the clinical or field site.
• Preserving evidence needed for review.
• Avoiding further discussion of the incident except with authorized personnel.

Students should not attempt to hide, alter, delete, or destroy evidence of a privacy incident unless specifically directed as part of containment by authorized personnel.

Investigation and Review

Texas Rescue Med may review suspected privacy or confidentiality violations.

The review may include:

• Interviewing involved students, instructors, staff, preceptors, or witnesses.
• Reviewing emails, messages, LMS activity, documentation systems, or submitted materials.
• Consulting with the clinical site or field agency.
• Determining whether PHI or confidential information was involved.
• Determining whether unauthorized access, use, or disclosure occurred.
• Determining whether patient safety, student safety, regulatory reporting, or disciplinary action is required.
• Assigning remediation, corrective action, discipline, or dismissal when warranted.

Texas Rescue Med may coordinate with clinical affiliates, field agencies, legal counsel, regulatory bodies, or other appropriate entities when necessary.

Corrective Action and Sanctions

Violations of this policy may result in one or more corrective actions or sanctions, including:

• Verbal counseling.
• Written warning.
• Required remediation.
• Required privacy or HIPAA retraining.
• Loss of clinical or field eligibility.
• Removal from a clinical or field site.
• Failure of a clinical or field component.
• Professionalism or affective evaluation failure.
• Administrative withdrawal.
• Course failure.
• Dismissal from the program.
• Termination of LMS or system access.
• Referral to the clinical affiliate or field agency.
• Reporting to Texas DSHS, NREMT, employer, clinical partner, law enforcement, or other appropriate entity when required or appropriate.

The severity of the response will depend on the nature of the violation, the information involved, intent, harm or potential harm, prior conduct, cooperation, reporting timeliness, and applicable law or site policy.

Serious Violations

The following may result in immediate removal from clinical or field activities, administrative withdrawal, dismissal, or reporting:

• Posting patient information on social media.
• Photographing or recording a patient without authorization.
• Sharing patient care documentation without authorization.
• Accessing patient information out of curiosity.
• Disclosing PHI to unauthorized individuals.
• Falsifying patient documentation.
• Attempting to conceal a privacy incident.
• Repeated confidentiality violations.
• Using confidential information to harass, retaliate, embarrass, or harm another person.
• Entering PHI into unauthorized AI tools or external systems.
• Removing confidential records from a clinical or field site without authorization.

Record Retention and Secure Disposal

Texas Rescue Med will maintain confidentiality-related records according to applicable program policy, legal requirements, regulatory expectations, and operational needs.

Students must dispose of confidential information only through approved secure methods.

Students may not discard patient information, clinical documentation, student records, or confidential materials in regular trash, public recycling bins, personal files, personal cloud storage, or unsecured locations.

When instructed to dispose of confidential documents, students must use approved shredding, secure disposal, or site-approved destruction procedures.

Passwords and Access Security

Students and personnel must protect account access and passwords.

Students may not:

• Share usernames or passwords.
• Use another person’s account.
• Allow another person to access Texas Rescue Med systems through their account.
• Leave systems open or unattended.
• Save passwords on shared or public devices.
• Attempt to bypass security controls.
• Access records beyond their assigned role or educational need.

Suspected unauthorized access must be reported immediately.

Use of Personal Devices

Students may use personal devices for approved educational activities only when permitted by Texas Rescue Med and the clinical or field site.

Students may not store PHI, patient images, clinical documents, PCRs, preceptor evaluations, or confidential student information on personal devices unless specifically authorized.

Students must comply with any site restriction on phones, smart watches, cameras, tablets, recording devices, or personal laptops.

Media, Public Information, and Agency Incidents

Students may not speak on behalf of Texas Rescue Med, a clinical affiliate, field agency, hospital, EMS agency, patient, family, or incident unless specifically authorized.

Students may not release information to media, post incident details, confirm patient information, or comment publicly about clinical or field events.

Media inquiries, public information requests, social media questions, or requests for comment must be referred to the appropriate Texas Rescue Med administrator or the clinical or field site’s designated representative.

Training and Acknowledgment

Texas Rescue Med may require students, instructors, staff, and program participants to complete HIPAA, confidentiality, privacy, cybersecurity, documentation, or clinical site training.

Students may be required to sign confidentiality acknowledgments, clinical site privacy agreements, handbook acknowledgments, or other documentation before participation in clinical or field activities.

Failure to complete required training or acknowledgments may delay or prevent clinical or field participation.

No Retaliation

Texas Rescue Med prohibits retaliation against any individual who reports a privacy concern, participates in a privacy review, refuses to engage in unauthorized disclosure, or assists another person in reporting a confidentiality issue.

Concerns about retaliation should be reported immediately to Texas Rescue Med administration.

Relationship to Other Policies

This policy should be read together with the Texas Rescue Med Student Handbook & Program Manual, Program Disclosures, Privacy Policy, Terms of Use, Refund and Cancellation Policy, Accessibility & Accommodation Policy, Complaint, Grievance & Appeals Policy, Clinical Eligibility Policy, course syllabus, enrollment agreement, clinical site requirements, and official written communications.

If a more specific written document applies to a student, course, clinical placement, field placement, payment plan, signed agreement, or clinical affiliate requirement, the more specific written document may control unless otherwise required by law.

Questions

Questions about this policy, HIPAA-related expectations, patient confidentiality, clinical documentation, or privacy incident reporting may be directed to Texas Rescue Med through an official communication channel.