[ Tuesday, November 27, 2018 ]
Jeff [12:46 PM]
A patient had a complaint about Allergy Associates of Hartford (CT); he took his complaint to the local TV news station. The reporter called the practice to ask for a response, and the doctor in question spoke with the reporter (despite the fact that his privacy officer told him to say "no comment" or not respond at all). That conversation with the reporter disclosed patient PHI in a manner not permitted by HIPAA. And now, OCR has fined the practice $125,000.
It's not fair: the patient told the reporter all of his information already, it's in the public domain, he put it in the public record, he publicized it, he started it. Yes, all that's true.
But it doesn't matter. The covered entity has the obligation not to use or disclose PHI unless the use or disclosure is permitted by HIPAA. The fact that the information is already public knowledge doesn't matter, even if the patient himself put it out there.
That doesn't mean the provider can't respond to the reporter at all. At the least, the practice should let the reporter know that it can't respond with respect to any specific patient due to the prohibitions of HIPAA (and can't even acknowledge that the patient is a patient), unless the patient specifically authorizes the disclosure. Additionally, the practice can give general information about the practice that doesn't disclose anything about any individual patient. For example, if the patient falsely complains that it took 20 office visits in 2 months to fix the issue, the practice can state that it researched its records for the last 5 years and did not locate any patient with 20 visits scheduled in a 2-month period (since that doesn't provide any information on any particular patient, it's not PHI). But you can't say "this patient didn't have 20 visits" because that is PHI.
The playing field is tilted against providers when it comes to patient complaints. But don't make it worse by responding in a way that violates HIPAA.
UPDATES (other law firms picking up the thread):
Holland & Knight: Eddie Williams III
Drinker Biddle: Sumaya Noush
Blogger: HIPAA Blog - Edit your Template