Is Height HIPAA Compliant for DMAT Field Hospital Triage Boards?

HIPAA Compliance Requirements for Patient Information

DMAT field hospitals generally operate as health care providers, and when they transmit health information electronically in connection with standard transactions, they function as Covered Entities. That means any patient details on triage boards must be treated as Protected Health Information (PHI) if the information is individually identifiable.

Under HIPAA, PHI is Identifiable Health Information that relates to a person’s health, care, or payment and that identifies the person or could reasonably be used to identify them. Height by itself is not a named direct identifier, but it can become identifying when combined with other data points in a small population or unique scenario.

Two cornerstone rules govern what you write on boards: the Minimum Necessary Standard (only display what is needed for care coordination) and Reasonable Safeguards (practical steps to prevent Unauthorized Disclosure). Incidental disclosures can occur in fast-moving operations, but they must be limited by sound safeguards.

Safeguards for Whiteboard Displays

Apply layered Reasonable Safeguards that reflect the realities of surge operations. Start with Physical Access Controls: position boards in staff-only zones, limit sightlines from public areas, and use barriers or screens when feasible.

Administrative measures matter just as much. Define who can write on boards, standardize approved data elements, and train staff to avoid free-text entries that could reveal identities. Enforce a no-photography policy around clinical coordination areas.

Use practical display controls: small enough text to be readable by staff but not across the tent; color-coded indicators rather than words; erasable markers that wipe clean; and timed “board hygiene” checks to remove stale entries that no longer support active care.

Use of Height in Triage

Including height on a triage board can be HIPAA compliant when it is clinically necessary and presented in a way that does not reasonably identify the patient. Height may support rapid dosing (especially with pediatric length-based tools), ventilator settings using predicted body weight, or selection of size-dependent equipment.

Apply the Minimum Necessary Standard: if height will not affect sorting, resource allocation, or immediate interventions, keep it off the public board and record it on the triage tag or in the patient record instead. When height is needed at-a-glance, prefer ranges (for example, “Ht: ~5'6–5'8” or “Peds length zone: Green”) or coded indicators over exact values.

Avoid pairing height with other data that meaningfully narrows identity (for example, name, full date of birth, highly specific location). For unusually distinctive heights, consider a broader range or a code to reduce identifiability.

Minimizing Patient Identifiers

Use

• Triage ID number, triage category (color), and concise status codes (for example, “A/W” for airway watch).
• Time stamps in coarse intervals (for example, “08:15–08:30”) rather than exact times, if visibility to the public is possible.
• Generic clinical flags (for example, “Allergy: Y/N,” “Isolation: Y/N”) without listing the allergen or pathogen on the board.

Avoid

• Names, initials, full DOB, contact numbers, addresses, or images.
• Combining multiple quasi-identifiers that, together, can point to a person (for example, bed location + rare condition + exact height).
• Free-text comments that can drift into identifying narratives.

This approach preserves Patient Privacy while enabling real-time coordination and reducing the chance of Unauthorized Disclosure.

Placement and Accessibility of Triage Boards

Place boards inside staff work corridors, behind check-in desks, or within cordoned areas to enforce Physical Access Controls. Angle boards away from entrances and public queues so passersby cannot read them.

Conduct a quick “line-of-sight audit” from common vantage points. If visitors or media can read entries from a doorway, relocate the board, reduce font size, or add a privacy screen. Keep the whiteboard at a height and distance that favors staff-only readability.

Where public-facing signage is required (for example, wayfinding), use non-clinical identifiers and never replicate board content on public displays.

Best Practices for Field Hospital Triage Boards

• Define a standard template: Triage ID, category, key status codes, location/zone, next action, and time window. Exclude patient names by default.
• Convert sensitive data into coded indicators (for example, “Ht: Peds-G” or “Vent PBW set: Y/N”) with the legend available only to staff.
• Assign a scribe role per zone to control entries, prevent drift into PHI, and perform scheduled wipes of resolved cases.
• Mark the area as “clinical coordination—no photography” and brief all responders at shift start.
• Document your board policy in the incident action plan so expectations are clear across rotating teams.
• After demobilization or patient transfer, erase boards and verify that no residual PHI remains on surfaces or in photos.

Privacy Risk Assessments

Use a rapid, field-ready risk assessment before adding any data element to a board. Identify threats (visual eavesdropping, photography), note vulnerabilities (board near entry, large text), estimate likelihood and impact, and pick controls that lower risk without harming care.

For height, ask: Is it essential for immediate decisions? Could it reasonably identify the patient in this context? Can you replace exact numbers with a range or code? Are sightlines and Physical Access Controls strong enough to prevent casual viewing?

Rapid decision framework: Should you post height?

• Purpose: Does posting height materially aid triage or equipment selection now?
• Necessity: Is there a less identifying way (range, code) to convey the same value?
• Pairing: Will height be adjacent to other quasi-identifiers on the board?
• Safeguards: Are Reasonable Safeguards in place to prevent public viewing or photos?
• Outcome: If any answer is “no,” omit from the board and record height only in the tag/record.

Conclusion

Including height on DMAT triage boards can be HIPAA compliant when it is truly necessary, displayed using the Minimum Necessary Standard, and protected by Reasonable Safeguards and Physical Access Controls. When in doubt, code or omit height from the board and keep exact values in the patient’s record to preserve Patient Privacy.

FAQs.

What patient information is allowed on triage boards under HIPAA?

Limit entries to the Minimum Necessary Standard for coordination: triage ID, acuity category, brief status codes, location/zone, and next action. Avoid names, DOB, contact details, and narrative notes. Use coded indicators for sensitive clinical flags and keep exact values in the patient record.

How should triage boards be positioned for privacy?

Place boards inside staff-only areas with Physical Access Controls, angle them away from public lines of sight, and conduct quick sightline checks. Use screens or barriers if needed, set a no-photography zone, and size text so it’s readable for staff at working distance but not by passersby.

Is including height on triage boards a HIPAA violation?

Not inherently. Height is not a named direct identifier, but it can help identify someone when combined with other details. Post height only when it directly supports care, prefer ranges or codes, and never pair it with other identifiers. With Reasonable Safeguards, this approach aligns with HIPAA.

What safeguards are required to protect patient information on whiteboards?

Implement Reasonable Safeguards across people, process, and place: designate scribes, standardize allowed fields, prohibit photos, and wipe boards routinely; use Physical Access Controls and sightline management; and avoid free-text that could trigger Unauthorized Disclosure. These steps protect Identifiable Health Information while keeping operations agile.