Certified EKG Technician Exam

You will learn how to protect patient information under HIPAA, how to stop the spread of infection with hand hygiene, standard precautions and personal protective equipment, how to clean EKG equipment between patients, what to do after a needlestick or splash, and how to keep yourself and your patients safe from electrical hazards, fires, falls and injuries. On the exam, the best answer in this area almost always protects the patient first, follows the facility policy, and keeps information shared only with people who need it.

This chapter explains the Health Insurance Portability and Accountability Act (HIPAA), what counts as protected health information, the minimum necessary rule, patient rights, and the everyday habits that keep EKG tracings, screens, printouts and conversations private.

HIPAA is a federal law that sets national rules for protecting health information. Two parts matter most for an EKG technician. The HIPAA Privacy Rule controls who may see, use and share a patient's health information. The HIPAA Security Rule controls how electronic health information is protected, for example with passwords, user accounts, automatic log-off and encryption.

Every person who works in a covered entity must follow HIPAA. A covered entity is a health care provider, health plan or clearinghouse that handles health information electronically. Hospitals, cardiology clinics, physician offices and Holter scanning services are all covered entities. Business associates, such as a company that stores EKG files or bills for the clinic, must also follow HIPAA through a written agreement.

Breaking HIPAA can lead to job loss, fines for the facility and, for intentional misuse, criminal penalties. More importantly, it breaks the patient's trust.

Protected health information (PHI) is any health information that can identify a patient. It includes the health details themselves and the identifiers attached to them. When it is stored or sent electronically it is often called ePHI.

Examples of PHI an EKG technician handles every day:

The patient's name, date of birth, address, phone number and email

Medical record number, account number and insurance number

Social Security number

The EKG tracing itself when it carries the patient's name or ID

Holter diaries, event monitor reports and stress test results

The reason for the test, the patient's medications and medical history

Photos or images in which the patient can be recognized

Room number combined with a diagnosis or test

The minimum necessary rule says that staff should use, share or ask for only the smallest amount of PHI needed to do the job. An EKG technician needs the order, the patient's identifiers, relevant history (such as chest pain or a pacemaker), and current medications that affect the test. The technician does not need to read the patient's psychiatric notes, unrelated surgery reports or billing history.

The minimum necessary rule does not apply when providers share information for treatment. A technician who hands a STAT tracing to the emergency physician is sharing PHI for treatment, which is allowed.

Common Trap: Curiosity is not a job need. Looking up the chart of a neighbor, coworker, celebrity or family member who is a patient is a HIPAA violation, even if you never tell anyone what you saw. Electronic health record systems keep audit trails that show who opened each record.

PHI may be shared for treatment, payment and health care operations without separate written permission. For other purposes the patient must give written authorization. In daily EKG work, this means:

Give tracings and results only to authorized staff caring for the patient: the ordering provider, the cardiologist, the nurse, or the monitor technician.

Do not give results to family members, friends, employers, police or reporters unless the patient has authorized it and facility policy allows it. Refer these requests to the nurse or provider.

Patients themselves have the right to their records, but EKG results are explained by the provider, not the technician. A patient who wants a copy of the record is directed to the provider or the health information management (medical records) department.

Under the HIPAA Privacy Rule, patients have the right to:

Receive a Notice of Privacy Practices explaining how their information is used

See and get a copy of their health records

Ask for corrections (amendments) to records they believe are wrong

Ask for limits on how their information is shared

Ask to be contacted in a certain way or place (for example, only on a cell phone)

Get a list of certain disclosures of their information

File a complaint with the facility or the federal government without being punished

Most HIPAA violations by technicians are not dramatic. They are small slips during a busy shift. Build these habits:

Posting about patients on social media is a HIPAA violation even when no name is used. A post such as "Wild night in the ED, did a 12-lead on a famous singer with a crazy rhythm" can identify the patient by time, place and details. A photo of an "interesting strip" that shows a name, date, room number or even a recognizable background is also a violation. The safe rule is simple: never post anything about patients, tracings or work cases.

A breach is any use or sharing of PHI that HIPAA does not allow and that puts the information at risk. Examples include a lost unencrypted laptop, a tracing faxed to the wrong number, an EKG printed on the wrong patient's chart, or a technician reading records out of curiosity.

If you cause or notice a possible breach, report it right away to your supervisor or the privacy officer, following facility policy. Do not try to hide it or fix it on your own. The facility must investigate and, when required, notify the patient and the government.

Bedside Scenario: An EKG technician finishes a 12-lead in a shared ED room and sees that the previous patient's tracing is still sitting in the printer tray, visible to the visitors at the next bed. The technician picks up the tracing at once, delivers it to the provider as ordered, and reports the near miss to the charge nurse if policy requires. Removing PHI from public view protects privacy immediately.

PHI is any health information that can identify a patient, including a labeled EKG tracing, Holter diary or stress test report.

Use and share only the minimum necessary PHI, except when sharing with the care team for treatment.

Share tracings only with authorized staff; refer family, callers and outside parties to the nurse or provider.

Protect conversations, screens, passwords and printouts; log off or lock the workstation every time.