[ Tuesday, November 21, 2023 ]
St. Joseph's Medical Center Settlement: During the height of Covid, St. Joseph Medical Center allowed a reporter and photojournalist access to its operations as part of a story about hospital overcrowding and St. Joseph's response to swelling numbers of Covid patients. Some pictures of patients apparently made it into the newspaper, and according to OCR, some information about St. Joseph's patients. OCR has now entered into a settlement agreement with St. Joseph's regarding the incident.
St. Joseph has admitted no liability in making the settlement.
The settlement involves an $80,000 fine, a review and possible revision of St. Joseph's HIPAA policies (to be reviewed by OCR, and a 2-year oversight plan by OCR. That's not a big penalty; I'd be extremely surprised if St. Joseph spent less than $80,000 on attorney's fees in conducting its own investigation and response, much less what it might've spent on other consultants to address the investigation. All HIPAA covered entities should be reviewing their policies and procedures regularly, and most would love to have OCR review them and give their blessing or offer tips for useful revisions. The 2-year monitoring could be a bit of a pain, but it's shorter than the usual 3-year plan seen in most settlements.
At this point, I have not seen a response from St. Joseph's, nor have I seen copies of the AP story that made the press, but I suspect that there is a legitimate question about whether PHI was actually disclosed in the article. I suspect the photos do not show patient faces, and any individual information was nearly if not entirely de-identified. However, it is entirely possible that the reporter was exposed to at least a minimal amount of PHI when he/she was allowed access to non-public areas where patients were gathered, and likely that the hospital didn't get consent from all of those patients before allowing the access. Still, that's pretty thin gruel.
However, the case is another reminder of the risks a health care entity takes when dealing with the press. While St. Joseph's probably saw the reporter's request for access and information as an opportunity to tell their story and put on a good face, covered entities must be extremely careful bout what information gets out.
Jeff [8:51 AM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
