[ Sunday, May 06, 2012 ]
Is this a HIPAA violation? Harold Phillips asked me after church this evening whether I had read the HIPAA article in the Sunday Dallas Morning News. We'd had a busy Sunday and I hadn't seen any of the paper, but I read
this article this evening. A high school student in a health science program does a rotation at the hospital, and learns that a homeless patient is going to be released from the hospital, even though she will eventually need surgery. She feels bad, and tells her mom about the patient. Mom calls the hospital, wondering if they can try to raise funds or otherwise help the woman. The nurse at the hospital goes ballistic, saying the student violated HIPAA. Later, the student finds out she can't participate in the program any more because of the HIPAA breach. Mom calls the newspaper,
So, HIPAA breach? I disagree with Ross Leo: the info the girl gave her mother was probably not PHI, given the circumstances (unlikely that the mother would be able to identify the individual based on the information given her, and if you can't identify the individual, it's not PHI). The information did not appear to contain the any of the list of identifiers that, if removed, would turn PHI into de-identified information. If it's not PHI, it's not a HIPAA breach. However (and this is one of the problems with the concept of "identifiability"), the disclosures didn't stop then. When the mother notified the nurse, the nurse might have known who the patient was, but only because of the nurse's knowledge of other PHI regarding the individual (and, as a workforce member of the hospital, that should not be an improper disclosure). At that point, I still don't think there's a HIPAA violation. However, when the mother notified the newspaper, the likelihood of identifiability went way up; but still, is it identifiable information? The only way anyone would know the identity of the individual would be if they already knew the medical information. Still, it's much more likely to be "PHI" if the audience is larger or in a better position to track down the information. Closer to a violation, but at least arguably you still don't have "identifiability," so you don't have PHI, so you don't have a violation.
That said, was the hospital's response appropriate? Forget the banned/not banned, "it's not our fault" response from the CEO, the hospital is the only "covered entity" in this picture, and so it's the only "person" who could violate HIPAA anyway. The student probably was a "workforce" member, so the hospital is required to train her in HIPAA matters, and must have HIPAA policies regarding sanctions for workforce members. Did the hospital train her sufficiently? If not, that might be a bigger problem. Did they sanction her appropriately? If she was appropriately trained and still disclosed information, then banning her was probably appropriate.
What about the tech who disclosed the information to the student in the first place? Was that information appropriate to disclose? It wasn't for treatment purposes, and arguably wasn't within the "minimum necessary" if it was disclosed for some other reason (healthcare operations would be the likely catch-all where disclosures to interns and students would fit).
I suspect Dallas readers will hear more about this. Did the hospital handle it correctly? I'm not sure -- they could have used it as a teachable moment, or at least as an opportunity to see if their training of high school interns is sufficient. They absolutely could have, and should have, done a better job of dealing with the press on this. This is much more likely to be a breach due to the publication of the story (the likelihood that the information is PHI is definitely increased by the fact that it is more widely broadcast). And the areas where the hospital might be culpable (the training of the student interns, and the actions of the tech who told the intern about the patient's personal information) are only problematic if there's a breach of PHI. That doesn't mean the student should be let back in (assuming she was actually trained to not discuss any patient information, and violated that training). But the hospital should have looked more at mitigation than blame-deflection.
Jeff [10:53 PM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
