[ Thursday, December 03, 2015 ]
Rochester, NY: Small fine for a small breach
Jeff [2:51 PM]
. Brought by the NY Attorney General, a Rochester, NY hospital was fined $15,000 for a breach that occurred when a nurse practitioner left the hospital and joined a private practice neurology group, and brought the records of some 3,000 patients with her to her new employer.
UPDATE: Adam Greene weighs in
, as does Cooley LLP
. Texas is different; Texas Medical Board Rule 165 requires
the departing physician to notify patients of the physician's departure and tell the patients where their medical records will be. The rule states that the obligation falls on the departing physician, although obviously it can be fulfilled by the practice the physician is leaving. While most physician employment agreements state that the medical records belong to the practice, there's no prohibition on allowing the physician employee to retain ownership of records relating to patients he cares for, and taking those records when he leaves, and therefore no prohibition on the departing physician notifying "his" patients of "his" new address, any more than the practice would be prohibited from notifying the patients if it moved offices. I suspect there was more going on in Rochester, although the fine is small enough it could just be a nuisance settlement.
Blogger: HIPAA Blog - Edit your Template