Professionalism and Technology: Competencies Across the Tele-Behavioral Health and E-Behavioral Health Spectrum

Ethics, professionalism, and the law are inextricably linked. Ethical behavior is intrinsic to professionalism and “professionalism is expressed through ethical action” [1, p. 17]. Acting in accordance with the law is a principle of medical ethics. One may think of ethics, professionalism, and the law as intersecting Venn diagrams with a significant area of overlap (Fig. 1).

Fig. 1

The intersection of professionalism, ethics, and the law

Psychiatrists are typically held to a higher ethical standard than other physicians because of the nature of their work. Psychiatric patients may be particularly vulnerable because of the impact of psychiatric symptoms on their thoughts, feelings, and behaviors. The power differential between care provider and patient may be heightened as a result. In addition, the psychiatrist as a person with feelings is an essential instrument in the therapeutic process; therefore, self-reflection is especially important. Psychiatrists also have an impact beyond the consulting room, as they may play a role in advising to outside entities such as schools and community agencies [1].

A number of organizations and institutions define professionalism standards in psychiatry. In the 1990s, the American Board of Internal Medicine (ABIM) began its Project Professionalism. In 2002, it issued a “Physician’s Charter,” intended for all physicians, entitled “Medical Professionalism in the New Millennium.” The charter espouses three fundamental principles of professionalism: the primacy of patient welfare, patient autonomy, and social justice.

The American Accreditation Council on Graduate Medical Education (ACGME) in psychiatry defines professionalism in its 22 sub-competencies and component milestones [2]. The sub-competency PROF 1 refers to “Compassion, integrity, respect for others, sensitivity to diverse patient patients, adherence to ethical principles.” It includes (under Level 3) the Milestone 3.3/B, “Recognizes ethical issues in practice and is able to discuss, analyze, and manage these in common clinical situations.”

In clinical practice, professionalism standards are laid out by professional organizations in documents like the American Psychiatric Association’s (APA) Principles of Medical Ethics with Annotations Especially Applicable to Psychiatry [3] or the AACAP Code of Ethics [4]. Professionalism standards are also laid out by state and federal laws (for example, HIPAA for issues of confidentiality), by the Federation of State Medical Boards and the state boards, and by institutional and malpractice carrier policies.

Enforcement of these professional standards is a more complex process. Medical professionals are held to a standard of self- and peer-monitoring and are expected to report professionalism breaches. Patients and their family members may report perceived violations to APA District Branches or the central Office of Ethics in a procedure outlined in the Principles of Medical Ethics [3, pp. 11–27]. Most institutions have systems for anonymous reporting to a compliance officer. State medical boards may impose sanctions or suspend or remove licenses. If the media reports a professionalism breach, the public reaction may lead to even further consequences.

Publicized breaches of professionalism online spurred the development of a field called “digital ethics” or “e-professionalism.” A now landmark study by Chretien et al. surveyed medical school deans about their experiences with medical student breaches of professionalism online. A significant 90% of deans who responded reported online professionalism breaches [5]. A similar study of state medical boards in 2012 found that 90% of them had received at least one report of online professionalism violations [6]. Current use and misuse of technology by residents is difficult to assess. The Pew Research Center reports that 77% of Americans own a smart phone [7]. According to one small survey (N = 34), 94% of resident responders reported googling their patients [8].

Evidence-Based and Ethical Practice

In the face of rising concerns about digital professionalism breaches, professional guidelines, standards, consensus statements, and evidence-based reports have developed in the last decade. In the USA, oversight and compliance efforts to protect privacy are, in general, in a dynamic tension with forces seeking to promote open communication, access to care and innovation. As Hughes and Goldstein write:

Agencies have . . . recognized a need to encourage innovation regarding the use of IT and have expressed interest in minimizing regulatory impact through adoption of risk-based regulatory schemes that will help avoid unnecessary or duplicative regulation. Government activity in this space also indicates a preference toward industry-driven solutions and self-regulation, supporting the development of voluntary codes of conduct…” (emphasis added) [9, p. 234]

Thus, regulations remain broad and general, but nonetheless important. Table 1 lists guidelines, policies, and consensus statements relevant to psychiatrists.

Table 1 Professional Organization Guidelines and Resources for Professionalism and Technology in e-Behavioral Health

While professional guidelines vary somewhat, certain themes emerge: Technology should augment but generally not replace face-to-face treatment. Medical professionals are expected to monitor and report their peers for any professionalism breaches. When posting or publishing online, full disclosure of the writer’s identity and credentials is expected (no anonymous posting), as are appropriate citations for evidence. Potential conflicts of interest should be disclosed. Separate professional and personal online identities should be maintained, and privacy protections on all personal sites and communications ensured. Confidentiality and privacy of patients must be protected, and data must be accurate, complete, and secure, with plans for monitoring and managing breaches (consistent with Fair Information Practice Principles, see below). If collecting information, prior notification and informed consent are warranted. The same professionalism principles should be adhered to online as offline.

Because technological innovations occur so rapidly, organizations such as AADPRT and APA have emphasized invoking key professionalism principles when using technology, rather than following a detailed list of “do’s and don’ts.” For example, APA’s “App evaluation model” allows users to assess apps that they are considering using in their practice according to a set of recommended principles: safety/privacy, evidence (i.e., effectiveness), ease of use, and interoperability [10] (The Black Dog Institute, an app developer and rater at the University of New South Wales, also adds assessing the credentials of the app developer). The American Medical Informatics Association has similarly issued 16 recommendations for the rating of apps [11].

Evidence to support specific technologies in clinical psychiatric care is under active development but rigorous studies are still lacking. For example, the APA estimates that there are more than 10,000 depression- and anxiety-related self-help apps that can be downloaded; however, fewer than 1% have been professionally evaluated [12]. Nonetheless, some excellent studies are emerging. Research such as Firth et al.’s meta-analysis of randomized controlled trials of smartphone-based interventions for depression is an attempt to bring scientific rigor to the study of technology in clinical practice in order to develop a sound evidence base [13].

Several laws and legal entities have a role in protecting consumers from professionalism breaches in the clinical use of technology. The legal requirements about the privacy and security of health information are perhaps the best known. The USA has no single federal privacy law; instead, starting with the Privacy Rights act of 1974, “FIPPS” (Fair Information Practice Principles) has become the standard for consumer protection. “FIPPS” emphasize the following [9]: transparency and notice about collecting personally identifying information, individual consent, specifying the purpose, data integrity (accuracy/completeness), security safeguards, and auditing for compliance.

These principles form the basis of privacy legislation such as the 1996 Healthcare Information Portability and Accountability Act (HIPAA, Public Law 104-191) and the subsequent Privacy and Security Rules (2000, 2003). According to HIPAA, all healthcare providers who transmit or receive any health information in electronic HIPAA transactions (billing, even if contracted out; eligibility checks; referral authorizations; etc.), all Health Plans, all Health Care Clearinghouses, and any business associates are considered “HIPAA-covered entities” and must comply with this federal law which includes very specific guidelines regarding technology. Behavioral health data requires additional protections; for example, section 42 CFR Part 2 prohibits disclosure of identifiable information by a federally assisted substance abuse treatment program to any entity without signed consent from the patient, even if the information is needed for treatment. Non-covered entities include freestanding electronic personal health records and mobile health apps marketed directly to the consumer and not offered by a provider. The federal Health and Human Services (HHS) department, which includes the Office of the National Coordinator for Health Information Technology, has become increasingly aware of gaps between covered and non-covered entities [14]. The HITECH Act (Public Law 111-9, 2009), designed in part to incentivize the adoption and use of electronic medical records, also enhanced privacy protections.

Other federal laws cover healthcare practices such as prescribing. The Ryan Haight Online Pharmacy Consumer Protection Act (Public Law 110-425, 2008) seeks to prevent the illegal sale, abuse, and trafficking of prescription drugs over the internet. State laws also impact privacy, confidentiality, and informed consent, particularly around the age of consent for minors and those in treatment for addictions.

The Federal Trade Commission (FTC), the Federal Communication Commission (FCC), the Food and Drug Administration (FDA), and the National Telecommunications and Information Administration (NTIA) are federal agencies also involved in consumer protection, including in the use of technology in healthcare. Of note, the FDA has said it will not oversee mental health apps, although it has, as of this writing, approved a substance abuse app called Reset. The FCC oversees the 1998 Children’s Online Privacy Protection Rule (COPPA, 16 CFR Part 312), which prohibits the collection of personally identifiable information from children younger than 13 years without parental consent.

Legal violations have at times been prosecuted through these federal agencies. For example, the FTC charged HTC, America Inc., an American mobile device manufacturer, with failing to employ “reasonable and appropriate security practices in the design and customization of the software on its mobile devices” [15]. The case settled in 2013. In 2011, the FTC sanctioned Facebook for repeated privacy violations, including by exposing “potentially sensitive affiliations” such as users’ sexual orientation, political opinions, and business interactions. Similarly, the FTC protects consumers from false advertising by requiring “substantiation” or evidence for explicit or implied claims; these apply to claims made about online or app-based healthcare technologies [16].

How these various guidelines, consensus statements, and laws are implemented at a local level may be determined by institutional guidelines, requirements, and case-by-case adjudications by state medical boards and malpractice carrier requirements and recommendations. Greysen et al. [17] examined consensus among state medical and osteopathic boards on violations of online professionalism using 10 vignettes (response rate 71%; 48/68 boards); the highest consensus rates occurred around misrepresentation of board certification on the physician practice website (77%), posting of patient image on website without explicit consent (79%), and misleading claims of treatment outcomes (81%). Practitioners should be familiar with these in their own area of practice. Patient complaints, anonymous peer reporting, and lost electronic devices appear to be the primary way in which transgressions come to the attention of authorities.

Importantly, given the ever-changing landscape of technology, many issues remain an area of debate even for experts. For example, the recent FDA approval and release of Abilify MyCite, an oral version of the psychosis treatment aripiprazole that includes a sensor for monitoring ingestion and a capacity to report compliance data to providers, has elicited a wide range of clinical and ethical opinions [18].

Moving from Compliance to Competence

With the rapid uptake of technology across healthcare, simply avoiding ethical, professionalism, and legal violations is insufficient; clinicians must also be able to provide clinical evaluation and care and create their own “tele-practice” within an ethical, professional, and legal framework. Particularly in rural settings and with underserved populations (veterans, children, the elderly) and in integrated/collaborative care, technology is becoming a mainstay of treatment [19]. A tele-behavioral health skill set will be required of many psychiatrists in the twenty-first century and will include the following:

• 1. Initial evaluation/assessment/consultation

While an in-person evaluation may be ideal, in many settings, this standard is simply not possible or threatens access to care so significantly as to be impractical and unethical (principle of distributive justice). Practitioners will need to be familiar with the guidelines described in Table 1, as well as with the licensing requirements in their own state and in the state in which the patient resides. These will include, at a minimum, obtaining written informed consent from the patient or guardian for use of technology in performing the assessment. Tele-psychiatry guidelines address the need for back-up at the patient’s site, a plan for addressing acute safety issues, and particular consideration of developmental issues when assessing children [20].

• 2. Appropriate triage, intervention, and treatment

Following an assessment, appropriate referral and treatment must be handled according to oversight by the relevant international, federal state/provincial/local and organizational regulations, policies/procedures/licensures, and professional standards. This may require adapting to a variety of settings and contexts, in accordance with these requirements.

• 3. Creating and maintaining a professional identity

A necessary part of tele-practice will involve establishing a professional identity online [21]. A variety of social media, blogging and other sites are currently used for networking and job searching (e.g., LinkedIn), providing information for patients (e.g., Healthy Minds, Healthy Lives by authors of the APA, or KevinMD.com), and hosting practice websites. A Pew Internet survey found that 61% of respondents reported seeking health information online and that the information they find affects their healthcare decision-making [22]. In creating an online identity, practitioners will need to adhere to the ethical, legal, and professional parameters outlined above. For example, content should be accurate and professional and should disclose any potential conflicts of interest. If sites are interactive with patients, care must be taken to avoid establishing an unintended doctor-patient relationship that may leave the practitioner open to liability complaints should a perceived bad outcome occur. Any intended clinical interactions require informed consent. Finally, anything that could be construed as advertising must comply with the FTC Advertising Substantiation policy described above, including a “reasonable basis” of support for any claims [18]. Useful summaries of these issues are now published [23].

Core Areas of Focus

As the digital revolution has unfolded, experts and educators have attempted to provide an educational framework for trainees and practitioners. The Group for the Advancement of Psychiatry, for example, has developed a “heuristic framework for the evaluation of clinical situations involving e-communications” [24].

In 2011, the AADPRT Taskforce on Professionalism and the Internet developed a curriculum that identified nine core areas in education and training for online professionalism: liability, confidentiality and privacy, psychotherapy and boundaries, safety issues and mandated reporting, libel, conflicts of interest, academic honesty, netiquette, and professionalism remediation [25]. These will be briefly reviewed here.

• i. Liability claims rest on the “4 D’s” of malpractice—a dereliction of duty that leads directly to damages. Malpractice suits are civil actions, and civil laws differ from state to state. However, the “standard of care,” in general, what a “reasonable physician” practicing under similar circumstances might do, may be defined by national consensus guidelines such as those in Table 1. Even regardless of outcome, malpractice suits are notoriously stressful and may incur additional adverse outcomes such as Board of Medicine sanctions and negative publicity. Malpractice suits that find against the physician or that settle out of court are reportable to the National Practitioner Safety Bank.

Potential areas for malpractice allegations, both online and in-person, include misdiagnosis, negligent use of somatic treatment, abandonment, sexual misconduct, negligence in supervision, liability to third parties, fraud, and practicing without a license. Tele-behavioral health may pose unique risks in these areas. For example, if a practitioner is treating remotely a patient who resides in a state where the practitioner does not have a license, they may be open to a malpractice claim (tele-psychiatric organizations are lobbying for more flexibility around these requirements).

• ii. Confidentiality is at risk due to both practitioner error or noncompliance and outside forces. Psychiatrists may show bad judgment in copying and pasting or forwarding content online, venting about patients, or revealing patient-identifying information. Online searching about patients (“Patient-Targeted Googling,” or PTG) should be conducted cautiously and with clear consideration of potential risks and benefits and how and to whom information learned will be communicated [26]. Outside forces include hackers, viruses, and disclosed or undisclosed data mining through tracking technologies, cookies, and so on [27]. In an era in which much personal data is available online without personal consent, protecting practitioner privacy is challenging. Practitioners need to conduct regular audits of their digital footprints and attempt to move desirable content higher on any search functions.

• iii. Psychotherapy online poses unique risks for boundary violations. The lack of physical and temporal boundaries with electronic communication can blur the conventional therapeutic framework. Nonverbal cues may be lacking and thus communication may be compromised. Given how routine online activity has become, maintaining a professional stance without slipping into more personal usages may be challenging. AMA and FSMB guidelines prohibit “friending” patients. “Following” patients on Twitter and Googling patients may confuse the roles of therapist vs. friend and raise concerns about voyeurism on the part of the psychiatrist.

• iv. Safety issues, and the role of mandated reporting laws, arise when content is (even unintentionally) discovered that includes unsafe or possibly unsafe behaviors involving a patient. Most states have laws that address the need to report legitimate concerns about a threat a patient poses to others. States also legislate protections of vulnerable populations such as children, the elderly, and the disabled. Suspected domestic violence, driving while intoxicated, infectious diseases, and physician impairment may have legal or medical board mandates for reporting. Legal, ethical, and clinical consultation around such cases is often warranted.

• v. Libel is a written communication that is intentionally untrue and is stated as fact not opinion. It is against the law. Online communications that meet these criteria and result in harm (i.e., to reputation, public opinion, and respect) may result in successful lawsuits for damages in civil or small claims courts. In most cases, patients’ blogging about or rating their psychiatrists in a negative light represents opinion not libel.

• vi. Conflicts of interest, real or potential, arise when practitioners carry multiple roles that may have competing interests. The 2009 Institute of Medicine (IOM) report entitled Conflict of Interest in Medical Research, Education and Practice defines conflict of interest as “a set of circumstances that creates a risk that professional judgment or actions regarding a primary interest will be unduly influenced by a secondary influence.” For most psychiatrists, our primary interest, as defined by the IOM, is “promoting and protecting . . . the welfare of patients” [28]. Secondary interests are personal interests that benefit us but not necessarily our patients and include financial benefit and professional advancement. Many academic and clinical institutions have policies around conflicts of interest, and the 2013 Physician Payments Sunshine Act (part of the Affordable Care Act) aims to improve transparency around income not related to patient care to physicians and hospitals [29]. Online activity needs to be compliant with such policies and laws.

• vii. Academic honesty has emerged as an important issue in tele-behavioral health because of the rapid increase in quantity and accessibility of scientific data and its reporting through open-access or non-peer-reviewed online publications, blogs, or other websites. Integrity in managing healthcare data online is vital for the reputation of the individual healthcare practitioner and the profession, as well as the reliability of information used to treat patients. A particular emerging concern is “mouse-click plagiarism” [30]. The Office of Research Integrity of the US Department of Health and Human Services defines plagiarism as “the taking of words, images, ideas etc. from an author and presenting them as one’s own. It is often associated with phrases, such as kidnapping of ideas, fraud, and literary theft” [31]. If discovered, plagiarism may result in professional sanctions as well as legal charges of copyright violation.

• viii. “Netiquette” refers to online manners. Increasingly, expectations for polite and professional online communication are being taught in schools and professional settings. These include avoiding all caps and expletives, cautious use of images including emoticons, appropriate tone in electronic communications, and appropriate posture/appearance in videoconferencing. Similarly, careful consideration of electronic functions such as retweeting or forwarding, copy and pasting, and “reply all” prevent negative personal and professional sequelae.

• ix. Remediation of professionalism concerns is easier when expectations have been explicitly stated at the outset. Reviewing written or video vignettes is helpful in understanding how guidelines apply to practice [25]. Medical schools and training programs are starting to teach in these areas, and practitioners in the field should also make use of CME opportunities in e-professionalism and digital ethics to stay abreast in this rapidly evolving field.

Professionalism Competency—Two Prototypes: Confidentiality/Privacy; Psychotherapy And Boundaries

ACGME requirements are currently framed in terms of six “core competencies” [2]: Practice-Based Learning and Improvement, Patient Care and Procedural Skills, Systems-Based Practice, Medical Knowledge, Interpersonal and Communication Skills, Professionalism. Each core competency is divided up into sub-competencies (22 for general psychiatry, 21 for child/adolescent psychiatry). Each sub-competency is further broken down into “milestones,” or benchmarks in development. ACGME defines milestones as “competency-based developmental outcomes (e.g., knowledge, skills, attitudes, and performance) that can be demonstrated progressively by residents and fellows from the beginning of their education through graduation to the unsupervised practice of their specialties.” Residents and fellows are evaluated across levels 1 through 5 for each sub-competency, with the anchoring for each level provided by specific developmental Milestones. For example, Patient Care (PC4) is a Sub-competency entitled “Psychotherapy.” Levels 1–5 for PC4 begin with the following milestones: 1.1/A accurately identifies patient emotions, particularly sadness, anger; 2.1/A identifies and reflects the core feeling and key issue for the patient during a session; 3.1/A identifies and reflects the core feeling, key issue, and what the issue means to the patient; 4.1/A links feelings, behavior, recurrent/central themes/schemas, and their meaning to the patient as they shift within and across sessions; level 5 in this case has no milestones.

Hilty and colleagues have proposed a set of “telepsychiatric competencies” to provide a framework for what competencies residents and fellows should be expected to demonstrate in tele-behavioral health [32]. These competencies borrow from the framework of the ACGME competencies and attempt to delineate specific milestones for overall competency in using technology in clinical practice. For illustration, two tele-behavioral health competencies—“Confidentiality/Privacy” and “Psychotherapy and Boundaries”—and their component milestones as proposed by Hilty et al. are described here in context of the preceding discussion.

• a. Confidentiality/privacy

Under each of the core competencies, one might envision a tele-behavioral health sub-competency. For Medical/Clinical Knowledge, this sub-competency might be entitled “MK1 Confidentiality/Privacy.” Specific milestones under this sub-competency might include the following: (1) describes basic tenets of HIPAA’s privacy and security parameters, (2) describes the informed consent process and documentation requirements, (3) describes process for reporting breaches, (4) outlines potential penalties after breaches, and (5) describes the limits of confidentiality.

Under the core competency of Patient Care, a sub-competency entitled “PC 1 Privacy/Confidentiality” might include milestones such as (1) sets confidential framework, (2) completes informed consents appropriately, (3) maintains confidentiality except where appropriate, and (4) deals with security breaches appropriately. Under Interpersonal and Communication Skills, a sub-competency “ICS 1 Confidentiality/Privacy” might include the milestone (1) maintains confidentiality both in person and digitally (encryption, virus protection). Under “Systems-Based Practice,” the sub-competency “SBP 1 Confidentiality/Privacy” would include the following suggested milestones: (1) adjusts behavior to context (e.g., institutional, local, regional and state guidelines/policies/laws) and (2) appropriately reports breaches. Under Professionalism, “PROF 1 Privacy/Confidentiality” could include a milestone about the ability to avoid accidental or intentional replication of confidential information digitally and other breaches. Under Practice-Based Learning, “PBL1 Confidentiality/Privacy” might include the following milestones: (1) recognizes lapses or actual breaches in compliance with HIPAA and other legal/ethical parameters, (2) remediates lapses and breaches promptly, (3) appropriately reports lapses and breaches per institutional and other policies and requirements, and (4) changes practice to prevent such lapses and breaches in the future.

• b. Psychotherapy and boundaries

Following a similar format as that outlined above, milestones in a sub-competency on Psychotherapy and Boundaries under Medical Knowledge might include the following: (1) describes the appropriate framework of psychotherapy, including appropriate interpersonal and online relationship boundaries and (2) describes how boundary crossings and violations and other breaches can occur with technology, as well as their potential impact. Under Patient Care 1, milestones might specify the following: (1) uses technology to support in-person relationships appropriately, (2) shifts to in-person care when appropriate, and (3) remains within the frame of the treatment relationship in all aspects of care. Under Interpersonal Communication Skills, a milestone could describe demonstrated understanding of the different capacities and nuances of digital vs. in-person communication and ways in which such communication might impact the treatment alliance, transference, counter-transference, and so on. Under Professionalism, component milestones might include the following: (1) maintains clear boundaries both in person and online, (2) addresses any boundary crossings with the patient appropriately, and (3) adheres to professional, legal, and ethical standards in online professional identity as a psychotherapist. Systems-Based Practice could incorporate a milestone about adjusting the use of tele- and e-behavioral health appropriately to different systems of care, treatment settings, and patients. Finally, a Practice-Based Learning competency could include a milestone about the ability to routinely assess boundaries and any boundary crossings that occur in a self-reflective manner and addresses concerns, with consultation as needed [32].

In conclusion, the digital revolution has paved the way for enhancing psychiatric care by improving access, communication, and innovation. It has also engendered new professionalism, ethical, and legal risks for psychiatrists in clinical practice. The innovation-regulation balance in the USA has tended toward freedom to innovate; professions are largely left to oversee themselves. As a result, trainees in psychiatry will need to be explicitly taught about professionalism in tele-behavioral health from two important perspectives: (1) compliance with organizational, expert consensus, and evidence-based standards and (2) competence in practicing in a model that uses technology to support clinical care. Consistent with ACGME’s effort to delineate specific sub-competencies and milestones in psychiatric education, specific milestones in compliance and competence in tele-behavioral health practice need to be delineated within the structure of the six core competencies, along the lines of the two examples presented here. Much further work is needed in this area, including research on outcomes assessments. Keeping abreast of the rapid pace of technological change will be an important challenge for psychiatric educators and clinicians alike as they embark on this process.