Introduction

Over 70% of people living with HIV (PLHIV) are concentrated in Sub-Saharan Africa and the Asia-Pacific [1, 2]. In Vietnam, HIV/AIDS is one of the 10 main causes of death [3]. In the last quarter of 2014, the Vietnamese government has committed to the HIV treatment target, the United Nations (UN) “90-90-90” program, which aims to stop the HIV pandemic by AD 2030. That means “90% of people living with HIV will know their HIV status, 90% of people who know their status are on HIV treatment, and 90% of all people on treatment will have undetectable levels of HIV in their body (known as viral suppression)” [4]. Vietnam has made a concerted effort to increase the number of PLHIV to participate in antiretroviral therapy (ART) programs at local healthcare facilities, and the numbers have been increasing [5]. At the end of 2015, there were over 227,000 PLHIV in Vietnam, particularly those belonging to high-risk groups [6]. However, to join the ART program, patients must reveal their personal identifiable information—name, age, detailed address, national identification number, HIV status profile, etc. Several studies have identified associations between social stigma and the confidentiality/security of HIV/AIDS patient information [7–10]. Confidentiality is a concern for individuals seeking HIV-related healthcare services; when personal health information is not confidential or secure, HIV/AIDS patients are often reluctant to engage with these services [11–12].

The use of patient-identifiable data must strike a balance between maximizing the benefits of data usage and minimizing potential harm owing to inadvertent or malicious release of sensitive data [12]. Vietnam has adopted regulations and guidelines ensuring the security and confidentiality of HIV-related information; these include Decision No. 4159/QD-BYT, dated 13/10/2014, on the security of electronic health information at health facilities and the health industry [13], and the Health Ethics Regulation [14], among others.

Confidentiality and security measures are valuable because they reflect autonomy and control over personal information and free patients from the burdens of stigma, inequality, and discrimination [15]. Confidentiality concerns an individual’s right to protection of their data during storage, transfer, and use. Security is a collection of technical approaches that address issues covering physical, electronic, and procedural aspects of protecting any information that is collected [16]. Any breach of confidentiality or invasion of privacy should be prevented by all stakeholders. A study in Vietnam revealed that non-confidential healthcare processes can lead to serious consequences [17]. Although there have been numerous campaigns aimed at educating the public about HIV/AIDS, both globally and locally in Vietnam, evidence of the negative impacts of HIV-related stigma and discrimination are still reported [18].

In Vietnam, an HIV/AIDS care and ART program was established in 2000 by creating 312 HIV outpatient clinics (HIV-OPCs) nationwide. These clinics provide services exclusively for HIV patients, and patients at these clinics must provide personal identifiable-information to clinic staff. While Vietnam has escaped poverty and become increasingly prosperous, funding for HIV/AIDS programs has decreased rapidly with clearly reduced donor-sponsor support. This changing situation has obliged the Vietnam HIV/AIDS prevention system to be more streamlined [19]. The HIV-OPC system, which had been a separate HIV clinical setting, is currently in transition, and from 2017 will be gradually integrated into hospitals/general healthcare facilities. The change in management of the organization and delivery of ART and other HIV/AIDS services is a direct result of the reduction in donor funding. The operation and management resources for the HIV/AIDS program have to be increasingly subsidized by the Vietnamese government rather than the donors, and health insurance would be mandated to cover the cost of HIV patient treatment. At a hospital, HIV patients would be examined and treated like all other patients, while the distribution of antiretroviral (ARV) drugs would be implemented at the commune health station where patients live [19,20]. Personal health information will increasingly be shared with the health insurance agency when ARV drugs are administered and controlled under health insurance [5]. In addition, the data-sharing strategy has permitted health workers at the commune or hospital ward level to identify who is currently undergoing ARV treatment [21].

A balance is needed between the collection and sharing of individual-level data with the protection and safeguarding of such data, to optimize clinical care and to monitor and evaluate HIV services. The Joint United Nations Programme on HIV/AIDS (UNAIDS) investigated 98 mid- and low-income countries; reports varied substantially on issues of information governance and privacy, data storage and availability, data access, and data transfer [12, 22]. Several guidelines and standards on data security and confidentiality exist to facilitate the sharing and use of HIV surveillance data, covering access and roles, data sharing, physical and electronic data security, and security breaches [23–28]. No evidence-based information currently exists on how these concerns have been implemented in HIV-healthcare services in Vietnam. This study was conducted as a national survey, particularly among healthcare providers at HIV-OPCs, and focused on assessing healthcare staff practices regarding security/confidentiality of HIV-related information. In addition, staff personal characteristics, as well as their knowledge and perception levels regarding security measures and protection of data confidentiality, were assessed to determine their associations with practice activities.

Materials and methods

Results

Respondent characteristics

From all 312 HIV-OPCs in 63 provinces, 400 staff from 238 (76%) in 56 (89%) provinces responded to the online survey (Table 1). Respondents included 178 (44.5%) doctors, 23 (5.8%) pharmacists, 154 (38.5%) nurses, and 45 (11.3%) administrative/other healthcare personnel. Among these professionals, 212 (53.0%) were female; higher female percentages were found among all professional categories, except doctors. Ages ranged from 21 to 60 years; age distributions varied across different professions. The distributions of time working in the HIV field and time working at the HIV-OPCs, also varied across professions. Overall, 296 (74.0%) of respondents had never been trained in data security and confidentiality. Based on their correct answers to the 10-items measuring knowledge of general principles and Vietnamese regulations on security and confidentiality of HIV data, the HIV-OPC staff were classified into three subgroups: 173 (43.2%) had good knowledge, 180 (45.0%) moderate knowledge, and 47 (11.8%) needed improvement. Although there was no statistically significant difference between the different professions, higher percentages of good knowledge were found among doctors and administrative/other professionals. Similarly, based on their ratings for the 9 items measuring perceptions regarding perceived benefits and threats to protect data security and confidentiality of HIV data, the HIV-OPC staff were classified into three subgroups: 104 (26.0%) had good perception, 185 (46.2%) moderate perception, and 111 (27.8%) needed improvement. Again, no statistically significant difference was evident between professions, but a higher percentage of good perception level was found among administrative/other professionals.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 1. Characteristics of survey respondents (N = 400).

https://doi.org/10.1371/journal.pone.0188160.t001

Practices for protection and safeguarding of confidential PLHIV information

Regarding security measures (Table 2), about 90% of HIV-OPC staff always kept patients’ paper records in a secured location. For entering patient data on personal computers, about 75% did not do so, but another 8% always or often did it while 17% rarely did so. About 53% of HIV-OPC staff followed the policy of periodically changing password while another half rarely or never did so. For practices of safeguarding the system, 40% of staff always and 42% often installed antivirus-software on computers containing HIV data.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 2. Proportions of security and confidentiality practices.

https://doi.org/10.1371/journal.pone.0188160.t002

The practices on protection of confidential data of the HIV patients were not fully compliant with the national policy and regulation (Table 2). For data sharing and transfer, 64% of respondents never sent reports containing HIV-related information via unauthenticated networks whereas 14% often or always did so. About 58% of respondents never shared patient information with other trusted healthcare personnel for consultation purposes; however, 8% often or always did so. Comparing across professional categories (table not shown), there were differences among professionals in this area: 70% of pharmacists never shared such information compared with 56%–60% of nurses and doctors and 47% of other staff; 7% of doctors and 13% of nurses often or always did so. In practice, up to 46% of respondents never obtained consent from the patient to share their personal information with others, whereas about 39% always or often did so. No significant differences were reported among professionals (table not shown).

Associations of staff characteristics with security and confidentiality practices

The associations of staff characteristics with their practices on security measures and protection of patient data confidentiality were analysed separately (Tables 3 and 4). From the average scores of their practice rating on 4-items regarding security measures, the HIV-OPC staff were classified into two subgroups: 348 (87%) had proper practice and 52 (13%) needs improvement in their current practices (Table 3). Male and female staff were not statistically significant in their practices. Similarly, there were no statistically significant differences among professionals, though lower percentage of pharmacists who had proper practice scores was observed. Time working in HIV field and time working at OPC were not significantly associated with proper practices on security measures; however, percentages of proper practices appeared to increase with longer working time. Staff who were not trained on security were significantly different from those who were trained (OR: 3.74; 95%CI: 1.44–9.67). Staff with needs improvement knowledge level were significantly different from those with good knowledge level (OR: 5.20; 95%CI: 2.39–11.32) and moderate knowledge level (OR: 5.10; 95%CI: 2.36–11.00). Similarly, staff with needs improvement perception level were significantly different from those with good perception level (with 100% proper practices) and moderate perception level (OR: 5.67; 95%CI: 2.93–10.95).

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 3. Associations of practices on security measures, according to different staff characteristics.

https://doi.org/10.1371/journal.pone.0188160.t003

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 4. Associations of practices on protection of confidentiality, according to different staff characteristics.

https://doi.org/10.1371/journal.pone.0188160.t004

From the average scores of their practice rating on 3-items regarding protection of patient data confidentiality, the HIV-OPC staff were classified into two subgroups: 264 (66%) had proper practice and 136 (34%) needs improvement in their practices (Table 4). Again, the staff practices regarding protection of data confidentiality were not significantly associated with sex, professional categories, time working in HIV field and at OPC, Staff who were not trained on such issues were significantly different from those who were trained (OR: 2.18; 95%CI: 1.29–3.65). Regarding the protection of data confidentiality, knowledge and perception levels were not significantly associated with such practices, even though the percentages of staff with proper practices were lower among those with needs improvement than the ones with moderate and good knowledge or perception levels.

Discussion

The results of this study suggested that security and confidentiality practices among HIV-OPC staff potentially increase the risk of revealing patient information. There has been a question whether separate HIV clinical settings, as compared with general hospital settings, would result in a greater or lower risk of breaching confidentiality. With the new approach when the treatment of ARV is conducted at a public health facility and ARV drugs are administered by a commune health station, HIV/AIDS patients are exposed to several different levels of healthcare personnel and other people, including non-HIV-infected patients. Therefore, the risk of exposing confidential information is higher, and ensuring security and confidentiality is more difficult. Before the changes in policy and management in 2017, all HIV-OPCs operated as separate units; the HIV information management software was a specific system and different from the information management system used at the public hospital and general healthcare facilities. From 2017 onwards, when the integration of HIV-OPCs into public hospital settings is implemented, a good management information system is essential to ensure the security and confidentiality of HIV/AIDS patients data that become part of the large information systems normally used in general hospitals. In the literature, an exit survey demonstrated that some integrated sites had raised concerns about patient confidentiality [31]. A study of awareness, experiences, and attitudes among staff in clinical settings suggested different environments might lead to leaks of confidential information, including the lack of private rooms for patient examination and the use of public-access computerized systems [32]. Even where a system is physically secure, multidisciplinary staff not involved in HIV/AIDS patient care may have access to detailed patient information [15, 32]. However, it can be concluded that any setting has a potential for violating patient confidentiality, if appropriate protective measures are not in place.

The majority of HIV-OPC staff had good or moderate levels of knowledge (88%) and positive perceptions (72%) regarding issues about security measures and disclosing/ensuring patient confidentiality. It should be noted that their knowledge and perception levels on such issues did not differ across profession categories, which may have different roles and responsibilities for accessing and using patient information. The professionals also did not differ in terms of training in security and confidentiality issues; however, only about a quarter of all professionals had been trained.

As a general rule in data security measures, personal information should be collected, stored, and disseminated in accordance with applicable national regulations [33]. Several guidelines for HIV programs have suggested planning and management for both physical and data security [13, 23–30, 33, 34]. One study reported that 80% of AIDS surveillance offices in the United States have a security guard during non-working hours and 44% have fireproof cabinets [35]. Vietnam has similar regulations and guidelines on physical security for HIV/AIDS surveillance [13, 34, 36, 37]. As a simple physical security measure in this study, nearly all staff (90%) were well aware of and practiced keeping patients’ paper records in secured locations, which requires no complex information technology or skill. On the contrary, about 25% of HIV-OPC staff had entered patient data on personal computers; the practices for electronic data security that require computer applications/and/or electronic services had raised a risk management concern, since only 14% of staff rigorously changed passwords periodically and about 40% always installed and used antivirus software on computers containing patient data. These policies should be emphasized and enforced. Implementation of other manageable data security measures should be considered, as in another study showing that about 74% of HIV/AIDS offices in the United States installed security locks and 54% installed specialized software to control computer access [35].

Regarding protection of confidentiality of patient information in practice, about 39% of HIV-OPC staff always or often obtained patient consent before sharing personal information. However, for staff who reported never obtaining consent, this might be partially because these personnel had no role in using such information. In other studies in Vietnam [38, 39], 38% of PLHIVs reported that their HIV status had been disclosed without their consent. This incidence, varying from 15%-50%, was also reported in other Asian and African countries [40–42]. Interestingly, a study among medical students reported that about three-fourths believed they had the right to inform the sexual partner of an HIV-positive patient of the patient’s HIV status [43]; however, another recent study reported that 70% of community members recommended maintaining patient confidentiality [44]. Confidentiality of patient information is based on trust between healthcare providers and their patients [15]. The general principle justifying the reasons for access and disclosure of minimum patient-identifiable information should be that it is acceptable only when absolutely necessary and on a strict need-to-know basis [12, 15, 22]. About 58% of HIV-OPC staff never shared patient information with other trusted healthcare personnel for consultation purposes, but some doctors and nurses often or always did so. This reflects a common practice among doctors and nurses, who have direct access to patient records for providing treatment and care, thus raising the potential for breaching patient confidentiality. The administrative staff who perform patient registration and pharmacists who request certain information about a patient’s condition might sometimes disclose patient information. A study among homo/bisexual men indicated that disclosure of their HIV status was used as a mechanism for coping with the disease [45]. Similarly, a study among clinical staff stated that they felt justified in disclosing information to other health personnel on a need-to-know basis [32]. A study among HIV/AIDS patients and other stakeholders in healthcare services suggested that the acceptability of data sharing depends on trust in how the data will be used [46]. As suggested in all guidelines, there should be appropriate technical and organizational measures in place to prevent unauthorized use and transfer of data to unrelated settings [23–27]. About one-third of HIV-OPC staff had shared/transferred patient information via unsecured mechanisms. It is critical to consider the protection of patient information as the responsibility of healthcare providers [47]; therefore, more robust methods should be implemented, including encryption and strong authentication mechanisms [23, 26].

In examining the associations of HIV-OPC staff characteristics with their security and confidentiality practices, differences were observed among those who had been trained and those who had not. Those who had been trained on the concepts of data security and safeguarding patient data by the Vietnam Ministry of Health had better practices for both security measures and protection of personal health information. A systematic literature review reported that the implementation of legal requirements in dealing with security and confidentiality of sensitive data was mostly due to non-technical measures, including education/training program and raising awareness of such issues [48]. In another systematic review study identifying the needs of healthcare professionals to receive effective training in patients’ information confidentiality, it was suggested that health authorities must address the needs and provide training on the policies pertaining to confidentiality while the healthcare personnel need to have the proper skill set to ensure the security and confidentiality of patient health records [49]. The best solution for compliance with policies regarding security and confidentiality was to offer healthcare professionals educational tools, whereby healthcare organizations would provide regular updates to all professional health staff regarding the policies and procedures to prevent the exposure of sensitive data [48]. There were some studies reported the associations of poor training on security and confidentiality which could affect care [50,51]. It was suggested that investment in training with standardized educational materials was needed at the commencement of employment and on the job [52,53]. In this study, about 25% of HIV-OPC staff were fully trained, but 87% of them appeared to have proper security practices and 66% for the protection of data confidentiality. This may due to health authorities’ enforcement of policies and procedures governing access to and use of personal health data. However, it is still important to acknowledge that those who were trained had better practices, and thus training programs are needed, since some personnel may either be untrained or trained but not fully understand the importance of this matter. Moreover, technical support staff may be required to change personnel behaviors.

Knowledge and perceptions regarding the security and confidentiality of patient information were found to affect the proper practices of HIV-OPC staff, particularly regarding to security measures. Although there were no statistically significant differences for practices of protection of personal health information, the trends appeared to be similar—staff with moderate/good knowledge and perceptions had better practices for safeguarding patient data. Compared with 58% of the general population in a semi-urban setting in another study [54], 88% of HIV-OPC staff had good or moderate knowledge about the confidentiality of HIV-information. However, healthcare providers are expected to have good, rather than moderate, levels of knowledge in this regard. Moreover, different people may have different perceptions of what should be considered sensitive information; thus, it is important to have standards when providing care services to ensure compliance with and responsibility for the administration, monitoring, and evaluation of patient information [55]. To change the perception or attitude of staff members, they must recognize and understand what and why changes are needed. Highlighting the importance of information confidentiality and security measures is essential, as is building relevant technical skills.

The findings of this study reflect the classic theories of associations between knowledge and perception with awareness and behavior. Behavioral theories have also suggested that training is important as it would have positive associations with knowledge, beliefs, perceptions, and behaviors [56, 57]; therefore, arranging continual training on guidelines and regulations related to data security and confidentiality may help improve practices at the healthcare settings, at existing HIV-OPCs or integrated general healthcare hospitals.

Vietnam has regulations for the prevention and control of disclosure of HIV-identifiable information, and penalties for violations of the law [58], but the enforcement and monitoring of the guideline requirements/procedures have not been thorough. Adopting core standards of other countries for data security and confidentiality could be beneficial for HIV-OPC management in Vietnam. For example, stringent core technical standards implemented by the Centers for Disease Control and Prevention [23,26] include the following: (1) Healthcare providers with access to patient-identifiable data should attend data security/confidentiality training annually, and (2) newly hired staff should sign, and all other personnel re-sign, a confidentiality agreement annually. Core standards for data sharing and release include, for example, assessment of risks and benefits of sharing data if the data are to be shared beyond the originally stated purpose. However, a study across several countries concluded that successful development and implementation of guidance requires strong collaboration at local and national levels [12].

Conclusions

In general, the practices among HIV-OPC staff for securing and protecting patient information were at acceptable levels. Most staff had proper practices for maintaining data security; however, protection of patient confidentiality, particularly for data access, sharing, and transfer, still needed improvement. Most HIV-OPC staff had good or moderate knowledge and positive perceptions towards security and confidentiality issues. Staff with good and moderate knowledge and perception tended to engage in proper practices more often than those needing improvement. Training in data security and confidentiality is an important factor for better practices, as it would also improve knowledge and raise awareness about the need to change the perceptions/attitudes of those needing improvement.

As the operation and management of HIV treatment and care in Vietnam is in transition from separate healthcare clinics (HIV-OPCs) into units integrated into general hospitals/healthcare facilities, the findings of this study suggest issues that might be useful for revising guidelines and regulations by Vietnam health authorities or other countries in similar situations. In planning for development and implementation of the computerized system and case-management procedures during this transition period, one should take into consideration, and have clear strategies to ensure, information confidentiality/safety/security and the benefits for HIV patients. Although there are many advantages to this transition approach, concerns involve the confidentiality of data that might engender patient stigma and discrimination. One of the critical questions of concern in the plan is how to ensure the security and confidentiality of HIV patients’ information when this information will be shared with third parties, especially health insurance officers and other health workers at general hospitals and commune health stations where HIV patients are administered ARV drugs. Secured infrastructure and data access and use measures are a very important and worthwhile investment. The provision of continuous training and active enforcement and monitoring of the practices of healthcare personnel, in either HIV-OPC settings or HIV/AIDS units integrating into general hospitals should improve understanding and acknowledegement of the importance of national policies and guidelines regarding HIV-related patient information.

Supporting information

Acknowledgments

This project was funded by a grant from the Rockefeller Foundation and the Faculty of Tropical Medicine, Mahidol University, Thailand. The authors would like to extend their thanks to the funders for supporting the graduate students in the Biomedical and Health Informatics program at Mahidol University. Sincere appreciation goes to all heads of the HIV-OPCs and the staff at all of the clinics in Vietnam, the key groups participating in the study, for their time and willingness to respond.