Privacy, records and safety

Confidentiality is a practice, not a form

Confidentiality means that what a person or family tells you, and what you see in their home, stays with you unless they have agreed that it may go somewhere else, or a law requires you to report something. It is the reason people let you in. A family that finds its private grief repeated at a neighbour's table will not trust the next doula, or the next hospice volunteer, or anyone.

For a doula, confidentiality is mostly a set of small habits rather than a legal document. The habits are:

• Ask before you need to. At the first meeting, ask the person: "Who may I talk with about how you are doing? Is there anyone I should not talk with? If the nurse asks me something, may I answer?" Write the answers down. Ask again if things change.
• Share for a purpose, and only what serves it. Before you say anything about a client to anyone, ask yourself: does this person need to know this, to help? If the nurse needs to know that your client said her hip hurts more today, she does not also need to know about the argument over the will.
• Use the agreed channel. Most families and teams settle on one route: a named family member, the hospice phone line, a shared notebook on the kitchen table. Use that, not a side conversation in the driveway.
• Debrief without identifying. You will need to talk about the work (Module 12). Do it with a supervisor, peer group or counselor, without names or identifying details.

Consent to share

The person who is dying decides what is shared about them for as long as they can. When they cannot, the person they chose to speak for them (a health care proxy or agent; see advance directives) usually steps in. Things you hear about relatives, old conflicts or money are kept too.

An example of what a doula might say at the start, in their own words: "What you tell me stays with me. I will only pass something on if you have said I may, or if I am worried someone is in danger. If that ever happens, I will tell you first whenever I can." That last sentence matters. It is honest about the limits, which are the subject of the rest of this module.

HIPAA in plain words: who it covers, and where you stand

This section is education, not legal advice. If you work through an organization, ask it for its privacy training; if you run your own practice, ask a local lawyer the questions at the end of this section.

HIPAA is the federal law whose privacy and security rules protect health information in the United States. The U.S. Department of Health and Human Services (HHS) says the HIPAA Rules apply to covered entities and business associates, and that "if an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules."

• Covered entities are health plans (including Medicare and Medicaid), health care clearinghouses, and health care providers such as doctors, clinics, nursing homes and pharmacies, but only providers that send health information electronically in certain standard transactions, such as billing an insurer. A hospice that bills Medicare is a covered entity.
• Business associates are people or companies that do work for a covered entity that involves its protected health information, such as billing, legal or cloud services. HHS says the covered entity must have a written business associate contract with them.
• Workforce is a defined term in the federal rules: "employees, volunteers, trainees, and other persons" whose work for a covered entity is under its direct control, "whether or not they are paid." A hospice volunteer is part of the hospice's workforce.

Where you stand

"Not covered by HIPAA" is not a licence to be loose. It means the protection your clients have depends mostly on you.

The minimum-necessary habit

HHS describes HIPAA's minimum necessary standard as the practice that health information "should not be used or disclosed when it is not necessary to satisfy a particular purpose." Covered entities are required to follow it. A doula should borrow it anyway: share the least that does the job, with the fewest people, by the safest route.

What the clinicians may share with family

HHS explains that a provider may share information with family or friends who are involved in the person's care if the person agrees, does not object, or, using professional judgment, the provider believes the person does not object. That is the clinician's decision under their rules. It does not pass to you. A doula answering a relative's medical question is not a shortcut; it is the error.

Questions to take to a local lawyer or the organization

• In the way I work, am I part of any organization's workforce, or its business associate?
• Does any state privacy law apply to my practice or my records, and how long should I keep notes?

What to write down, and what not to

A doula's notes are the doula's own. They are not part of the medical record, and they should never look like it. They exist so you can remember what you agreed, follow through, hand over well to a colleague, and show, if ever asked, what you did and when.

Good notes are

• Factual. What you saw and heard, in plain words. Use the person's own words in quotation marks when they matter.
• Brief. Date, time, place, who was there, what you did, what was agreed, who you told and when, and your next visit.
• Without clinical judgment. No diagnoses, no guesses about causes, no pain scores unless the team taught you to record one for them, no psychological labels. "Her daughter was crying and said she had not slept" is an observation. "Daughter is depressed" is a diagnosis you are not trained to make.
• Kept private and secure. A paper notebook kept at home and never left in the car, or a device protected by a passcode. Not a shared family computer, not a notes app that syncs to a shared account, not a group chat.
• Minimal in identifiers. Initials rather than full names where you can. No dates of birth, addresses or insurance numbers unless you truly need them.

Worked example: rewriting a note

Here is an invented note written at the end of a long day, and the same visit written well.

Moving information: texts, email and the team

Texts and email can be forwarded, read over a shoulder, or left on a lost phone. Keep identifying and health details out of them; use texts for logistics ("Running ten minutes late"), and the agreed channel for anything more. If a hospice you volunteer for gives you a secure tool, use it by its rules. When the team needs to know something, say what you saw, what the family said, and what you are asking for; Module 14 teaches a hand-off structure (SBAR-lite). You do not need to send anyone your notes.

When your work ends

Decide in advance how long you will keep notes and how you will destroy them (shred paper; delete files and empty the deleted-items folder), and put it in your written agreement.

Photos, recordings, social media and your phone

Photos and recordings need consent, every time

Families sometimes ask a doula to take a last photo of hands held together, or to record a grandmother telling a story (Module 9 covers legacy work). These can be precious. The rules are simple:

• The person decides, if they can. If they cannot, the family decides together, and you do not press.
• Use the family's device where you can, not yours. If you must use yours, send the file to the family by the method they choose, then delete it from your phone and its backups.
• Never take a photo for yourself, your records or your portfolio.
• Anyone else in the frame needs to agree too, including the nurse or aide.

Social media: never

Do not post about clients: not their names, not their photos, not their stories, not their homes, not "a lovely woman I sat with today." Changing the name or the age is not enough. Families recognise their own story, and small towns recognise everyone. If you want to write about the work, write about yourself and what you learned, in a form no family could recognise, long after the fact, and ideally after asking a peer to read it with that question in mind.

Your phone holds more than you think

Contacts, texts, call logs, photos and notes can identify clients. The Federal Trade Commission's basic advice for protecting a phone is to lock it with a passcode of at least six digits, set software to update automatically, back up your data, and turn on the feature that can find, lock or erase a lost phone. Add a few doula habits:

• Turn off message previews on the lock screen, so a family's text is not readable on the table.
• Save clients under initials, and remove them when your work ends.

Safety on home visits

The National Institute for Occupational Safety and Health (NIOSH) lists hazards home healthcare workers face, including overexertion, stress, weapons, verbal abuse and other violence, hostile animals and long drives between homes. A doula walks into the same homes. Plan for them.

Your personal safety

• Someone you trust knows where you are, when you expect to leave, and what to do if you do not check in.
• Your phone is charged. On a first visit, notice exits, who is in the home, and how you feel. Trust that feeling.

Driving and fatigue

The Occupational Safety and Health Administration (OSHA) notes that driving between clients puts home care workers at high risk of crashes, and names driving while tired among the causes. A doula coming off a night vigil is a tired driver. Build rest into your on-call plan, and if you are too tired to drive, do not.

Do not lift

OSHA says lifting and moving clients creates a high risk of back injury. A doula does not lift, transfer or reposition a person who cannot move themselves, and does not try to get someone up after a fall. Call the hospice line or the number in the family's plan, and stay with the person. If the team has shown the family a technique, that training was for them.

Infection basics

The CDC says standard precautions are used for all patient care. They include hand hygiene, protective equipment when exposure to infectious material is expected, and cough and sneeze etiquette. For hand hygiene, the CDC says alcohol-based hand sanitizer is preferred in most clinical situations unless hands are visibly soiled, and to wash with soap and water when hands are visibly soiled, before eating, after using the restroom, and during care of patients with suspected or confirmed infection during outbreaks of C. difficile and norovirus.

• Clean your hands when you arrive, before and after touching the person, and when you leave.
• Most doula work involves no contact with body fluids. If it might, follow the hospice's training; gloves do not replace hand hygiene.
• Stay away when you have a fever, a cough or a stomach bug.

Pets

Pets comfort many dying people, and can also bite or trip you. It is fair to ask, "Could the dog be in another room while I settle in?"

Firearms in the home

You do not handle firearms or lecture anyone about them. Ask the care team what their guidance is. Clinicians may use lethal means safety counseling, which Johns Hopkins' Center for Gun Violence Solutions describes as voluntary and patient-centered: helping the person and family reduce access to lethal means while risk is higher. Clinical writing on dementia describes options such as locking guns away or removing them from the home. Those decisions belong to the family and the team. Your part: tell the team what you noticed and, if their guidance is that visitors should ask, ask without confrontation. An example: "The nurse asked that we check whether anything in the house needs putting away for safety while visitors come and go. Is there a firearm here, and is it stored away?" If a person tells you they intend to harm themselves or someone else, call 911 or 988 and then the team. (Medical aid in dying is a separate, lawful process in some states, handled by clinicians; see what MAID is and Module 11.)

Oxygen and open flame

Medical oxygen does not burn by itself, but it makes things burn faster and hotter. Oregon's State Fire Marshal advises: never smoke where medical oxygen is used; keep cylinders five feet from heat sources, flames and electric devices like hair dryers or heaters; and post "No smoking, vaping, or open flames" signs. Candles and oxygen do not mix. At a vigil, offer battery candles. The hospice or the oxygen supplier will give its own instructions, and theirs are the ones to follow. You never change oxygen settings; you call the nurse.

Scheduling, on-call and working alone

• Say in writing when you are reachable and when you are not, and name a backup doula (Module 12 helps you set limits).
• Make sure every family knows your number is not an emergency line: the hospice 24-hour number and 911 are.

When to leave

Leave, calmly, when you are threatened or harassed; when someone is intoxicated and aggressive; when a weapon is shown; when an animal is dangerous; or when you are pressed to act outside your scope and cannot steer back. "I'm going to step out now. I'll be in touch" is enough. Afterwards, tell the person you report to and, if the dying person may be unsafe, the care team. Do not go back alone.

Reporting duties: learn yours

Confidentiality has limits, and the law draws some of them. Mandatory reporting means a duty, set by state law, to report suspected abuse or neglect to the authorities. Who must report, and what, varies by state and by role.

• Children. The Child Welfare Information Gateway explains that the federal Child Abuse Prevention and Treatment Act requires each state to have procedures for reporting suspected child abuse and neglect, and that states name in law who must report. In approximately 17 states and Puerto Rico, any person who suspects child abuse or neglect is required to report.
• Older and vulnerable adults. Every state has Adult Protective Services (APS). The U.S. Department of Justice's Elder Justice Initiative says to call 911 in an emergency and points to the National Adult Protective Services Association, which lists how to reach APS in each state. Whether a doula is a required reporter of elder abuse depends on the state and on the role.

What to do now, before you need it: look up your state's rules for both children and vulnerable adults; if you volunteer or work for an organization, learn its reporting policy and who you tell; and put the limits of confidentiality into your written agreement. If you are worried, you report what you saw and heard. You do not investigate, confront anyone, or promise a family you will keep it secret.

Business basics, without the tutorial

How you are set up affects your taxes, insurance, privacy duties and who is responsible if something goes wrong. The table names common arrangements so you know what to ask; it is not advice about which to choose. For what is and is not paid, see how doulas get paid.

Get this from a local accountant, lawyer or a Small Business Development Center, not from a tutorial.

Insurance

The SBA describes professional liability insurance as coverage that protects service businesses against financial loss from malpractice, errors and negligence. Whether it applies to doula work, what it excludes, and whether your home and car policies cover you at work, are questions for an insurance agent or advisor you choose. This module recommends no provider.

A written agreement

Put the basics in writing, in plain language, before you start:

• What you do, and what you do not do (no medical care, no medication advice, no lifting, no legal documents).
• That you are not a clinician, and who the family calls for medical questions and emergencies.
• How to reach you, your hours, your backup, and how cancellation works on either side.
• Confidentiality and its limits, including reporting duties, and whether you may speak with the care team.
• Photos and recordings, social media, and what happens to your notes when the work ends.

Background checks, immunizations and TB screening

Federal hospice rules require hospices to obtain criminal background checks on employees who have direct patient contact or access to patient records, and to require the same of contracted staff. Volunteer requirements are set by each hospice. For example, one health system's hospice volunteer pages say all volunteers must complete a criminal background check and TB screening, show proof of measles-mumps-rubella immunization, and have a flu vaccine in flu season; another hospice asks volunteers for a TB test and to wait a year after the death of an immediate family member before starting. Expect questions like these, and ask each organization for its own list.

Volunteering with a local hospice is one of the best ways to get supervised, real-world practice; the capstone returns to this.