William E. Lucas (william.e.lucas@kp.org) is Ambulatory Care Lead at Kaiser Permanente in Portland, OR.
Do you consistently find reoccurring compliance deficiencies in your organization? Have you ever considered staff habits as the reason you may continue to see repeated noncompliant behavior?
Many books examine the power of habits and identify strategies to break bad ones and build good ones. Among them is Charles Duhigg’s The Power of Habit: Why We Do What We Do in Life and Business.[1] In it he explores habits and how they can drive certain behavior. Jud Brewer, an associate professor at Brown University School of Public Health, also discusses habits in his Harvard Business Review article, “How to Break Up with Your Bad Habits.”[2] Both authors reference the habit cycle as a key ingredient for understanding habits. These two authors did not discuss healthcare compliance in their writings, but their explanation of how habits function presents an interesting opportunity to view noncompliant behavior.
Neuroscientists have conducted many clinical studies on how the brain responds to stimuli or cues, and what drives people to engage in bad and good habits. Studies abound with details on the brain and how it changes as habits are formed and broken. This article will not attempt to dissect any of these clinical studies, but it will leverage the understanding that comes from them and explore possible implications for healthcare compliance.
The power of habit
In The Power of Habit, Duhigg breaks habits into three elements (Figure 1).
According to Duhigg, we have cues that trigger a routine or action, which leads to a reward. This very simplified but effective explanation demonstrates what drives habits.
Applying this model lets us examine our addiction to social media. Our smartphones include applications such as Facebook, Instagram, and Twitter, and our phones ping to signal a notification that someone has either posted a picture or liked our posted picture or status. We then look at our phones to receive updates. Figure 2 illustrates this habit cycle.
Many of these habits are driven by our subconscious. Try tracking one day of your own social media activity. How often do you check your phone to either respond to a ping or check what happened with your friends and family? Another example, if you are a sports fan, is you may receive a ping from your ESPN app with updates on your favorite team’s final score or other team activity. You then look at your phone to read the updates or watch a video highlight of the game.
To find an example of the power of habits in healthcare compliance, you need look no further than celebrity-related privacy and security breaches that have transpired over the past 17-plus years. In its 2020 Healthcare Compliance Benchmark Survey,[3] SAI Global reported that 58% of the respondents had encounters with government authorities because of Health Insurance Portability and Accountability Act (HIPAA) privacy breaches. In the same report, more than half of all respondents identified HIPAA security and privacy as the top high-risk priority. Celebrities such as Drew Barrymore, Arnold Schwarzenegger, Tom Hanks, George Clooney, Britney Spears, and Michael Jackson have had their medical records inappropriately accessed in various medical facilities.[4] If you search online for celebrity privacy breaches, you can see the stream of names of celebrities that trusted healthcare organizations to protect their information, as well as the list of organizations that violated that trust. These breaches may be a one-time occurrence by these individuals working at those organizations, but something caused them to access information inappropriately.
The HIPAA Privacy and Security rules are not new, and staff routinely complete HIPAA privacy and security compliance training. It is standard practice to ensure that all staff with access to medical records complete HIPAA compliance training and are tested on their understanding after the training. Yet we as a society continue to have celebrity HIPAA breaches and, more often, breaches of protected health information (PHI) of family, neighbors, or friends.
Let’s look at these breaches using the habit cycle. We will exclude those scenarios where staff impermissibly accessed a celebrity’s PHI for monetary gain. For our discussion, we will assume that employees are just curious and have no business need to look at the medical records in question. Figure 3 illustrates how this looks on the habit cycle.
In this scenario, staff members are satisfying their curiosity by reviewing the celebrity’s medical record, and the unique information about the celebrity is their reward. The same habit cycle applies to explain what drives the staff to review the medical record of family members. Figure 4 illustrates how this looks on the habit cycle.
Although the staff member’s intent to review the medical records may differ between a family member and a celebrity, both are impermissible uses under HIPAA. Despite the trainings on permissible and impermissible uses under HIPAA, staff continue to improperly access the PHI.
Many clinical studies show how the brain is wired and the role of dopamine in the brain. So much of what we do is subconscious. If our subconscious is the culprit for some of these behaviors, how do we combat these actions?
Traditionally, organizations have used warning flags in the medical record of celebrities that ask staff if they have a compliant reason for reviewing this medical record (“break glass” approach[5] ). Some publicize within their organization that they audit medical record access to ensure that staff are not inappropriately accessing medical records. Some publicize acts of noncompliance and the corresponding consequences to educate staff. Despite these common tactics, acts of HIPAA noncompliance continue.
In The Power of Habit, Duhigg relates the story of Anthony Dungy, the former head coach of the Indianapolis Colts, a football team, and how he transformed them into Super Bowl champions. He did not introduce a new sophisticated game plan, but he took their existing habits formed over years of playing football and changed the routine as a response to the cues they see when they play. He did not have the players focus on a different cue; he just changed how they responded to existing cues to get the same reward. The final reward was a Super Bowl championship in 2006.
Can we do the same, as related to HIPAA breaches or other noncompliant actions? The cues or temptations are not going away. People are naturally curious, and we worry about our family and friends. The situation is more complex than just stating that the violator is a bad person. What if we focused on the routine that comes after the cue?
