Is there still protected health information in openly available PowerPoint files?

Abstract

Introduction: PowerPoint presentations containing radiographic images continue to be an important educational tool for healthcare professionals. When properly deidentified, these radiographic imaging files are valuable and do not pose any privacy concerns for patients. However, when these images are not properly managed, patient information can be uncovered; raising concerns about patient privacy and potential legal consequences for healthcare systems and academic institutions. This study revisited and expanded upon previous work published by Weadock et. al in an attempt to see how this issue has changed in the last 15 years.

Methods: This study consisted of 8 separate Google Web searches related to a medical imaging modality. Each PowerPoint file was manually inspected for imaging files including x rays, CT scans, MRI's, PET scans, CT and MR angiography and ultrasounds. If a PowerPoint contained an image file, it was then inspected for PHI. Full PHI included all of the following: patient's full name, medical registration number (MRN), date and a geographic indicator smaller than a state.

Results: The first two Google searches "Magnetic Resonance Imaging filetype:ppt" and "Cardiac CT CAT Scan filetype:ppt" returned 146 search results with 7.6 % containing full PHI. "Radiology Chest X-ray filetype:ppt" resulted in accessible PHI in 40 % of the presentations with images and "Post-Operative CT Scan filetype:ppt" resulted in accessible PHI in 29 %. Magnetic Resonance Imaging filetype:pptx" returned 0 results with PHI. "Cardiac CT CAT scan filetype:pptx" returned 1 result with partial PHI."Radiology Chest X-ray filetype:pptx" contained 4 results with partial PHI and 1 result with full PHI. "Post-Operative CT scan filetype:pptx" contained 2 presentations with partial PHI.

Discussion: While a declining percentage of PowerPoint files containing PHI is reassuring, this follow up study demonstrated that PHI can still be easily accessed openly on the internet by anyone who has basic familiarity with Microsoft PowerPoint. Work remains to continue to educate users on how to properly protect patient information in PowerPoint files. Appropriately protecting private healthcare information is essential for patient safety and can prevent unintentional HIPAA violations. Radiologists are uniquely positioned to educate other healthcare providers on how to properly remove PHI from radiologic imaging files.