HIPAA Violation??

[Kyle7376]

What is the name of your state (only U.S. law)? Pennsylvania

My girlfriend was recently terminated from her job at an urgent care facility (her boss had it out for her). In her termination packet, her boss included all of her disciplinary write-ups, and copies of patient sheets that pertain to the write-ups. On several patient sheets, there are full SSN's, full names, addresses, email, and more patient information. We are trying to figure out if her former boss violated HIPAA laws in doing this and how do we report her? Also if my girlfriend is in violation as well because these sheets are not something she requested be attached with her write-ups. In the 1 write-up this all pertains to, she gives the examples of why she was being written up as such: "On XX/XX/2015, (employees name) had patient J.Doe in for medical work and didn't fill out company used form correctly, see attached copy of form." Now the attached form has all the patient information on it. It also says at the top of that form "For Internal Use Only".

Anyone that could shed some light to this topic would be greatly appreciated!

 

[cbg]

If your girlfriend feels that HIPAA was violated, she is free to report it to the HHS.

http://www.hhs.gov/ocr/privacy/psa/complaint/

It will in no way affect her termination. It will not get her, her job back.

 

[justalayman]

a hipaa violation is where patient information is disclosed to an unauthorized party. The employees of the clinic would be authorized parties.

and that is likely why it also says; for internal use only.

 

[Kyle7376]

She isn't worried about getting her job back because it became a miserable place to work. The big thing I/we are worried about is this coming back on her because she is in possession of these copies.

Thank you for the link!!

 

[ecmst12]

The way to correct the problem would be for her to destroy the patient information that she is in posession of.

 

[Kyle7376]

a hipaa violation is where patient information is disclosed to an unauthorized party. The employees of the clinic would be authorized parties.

and that is likely why it also says; for internal use only.

Correct, but she was given these papers after being terminated. Her boss took my girlfriend into her office, talked with her about everything, told her she was being let go, gave her a folder of her write-ups and other post-employment information, escorted her through the building so she could gather her personal belongings, and then escorted her out of the building. So she was no longer an employee when she was given this information. We only discovered it 2 days later when she started to go through everything.

 

[justalayman]

knock yourself out:


http://www.hhs.gov/ocr/privacy/hipaa/complaints/


btw: it is unlikely your gf will ever know what happens, if anything does, once she makes the report.

 

[Kyle7376]

The way to correct the problem would be for her to destroy the patient information that she is in possession of.

She will be destroying the information as soon as she files a report. Basically it comes down to, in my opinion, well deserved payback to her former boss. Her boss is a young 24 year old with her first "big girl" job that she truly isn't qualified for. My girlfriend was employed at this company for over 4 years, and in that time was only written up once 3 months into the job about speeding up her work. Since her boss started there, 8 months ago and got very power happy, she has been written up 3-4 times for paying attention to details and other small insignificant things that at least 4 other employees were also doing but not written up for. Her boss was picking favorites with the employees and I feel she was writing her up to give her more reason to fire her. So my girlfriend feels that her former boss deserves to be reported to HIPAA for doing the same thing she was repeatedly written up for, not paying attention to detail, and giving out patient information that should have been redacted

 

[ecmst12]

She's not going to get her boss fired over this, more than likely. And revenge is never a positive goal. She really needs to learn from her experience (and quit blaming her boss) and move on.

 

[Silverplum]

She will be destroying the information as soon as she files a report. Basically it comes down to, in my opinion, well deserved payback to her former boss. Her boss is a young 24 year old with her first "big girl" job that she truly isn't qualified for. My girlfriend was employed at this company for over 4 years, and in that time was only written up once 3 months into the job about speeding up her work. Since her boss started there, 8 months ago and got very power happy, she has been written up 3-4 times for paying attention to details and other small insignificant things that at least 4 other employees were also doing but not written up for. Her boss was picking favorites with the employees and I feel she was writing her up to give her more reason to fire her. So my girlfriend feels that her former boss deserves to be reported to HIPAA for doing the same thing she was repeatedly written up for, not paying attention to detail, and giving out patient information that should have been redacted

None of this has anything to do with you. Your gf has much to learn about how to handle herself in the workplace, and how to handle leaving a position. Any dumb trick she tries to get revenge will most likely follow her to her next job and beyond: that's a good way to make herself unattractive to prospective employers.

 

[Dave1952]

It sounds as if your girlfriend already was aware of the patient information since she was disciplined for a matter regarding Mrs. So-and so. Is that the case? If your friend then shared this information with you then she violated HIPAA.

 

[commentator]

is she filing for unemployment? If so, she might need the information. And I assure you, they're not going to be interested in any alledged HIPAA violations. They'll just want to know if the employer had a valid work related misconduct reason to terminate her.

That's the only place I can possibly imagine the information on the termination papers being the least bit necessary for her to have or important in any way. And they do not in any way release or show interest in social security numbers,etc. They've got everybodys in the world anyhow. You aren't going to get her former employer punished for this.

File for unemployment, get another job and move on. Those are her choices. New employees/managers of of small medical practices are common as deer in the suburbs. They sometimes way overstep themselves. The choice and the alternative and the rights that other employees have is to find another job and move on.

 

[LdiJ]

is she filing for unemployment? If so, she might need the information. And I assure you, they're not going to be interested in any alledged HIPAA violations. They'll just want to know if the employer had a valid work related misconduct reason to terminate her.

That's the only place I can possibly imagine the information on the termination papers being the least bit necessary for her to have or important in any way. And they do not in any way release or show interest in social security numbers,etc. They've got everybodys in the world anyhow. You aren't going to get her former employer punished for this.

File for unemployment, get another job and move on. Those are her choices. New employees/managers of of small medical practices are common as deer in the suburbs. They sometimes way overstep themselves. The choice and the alternative and the rights that other employees have is to find another job and move on.

I dunno...I would certainly be extremely unhappy if I knew that my name, address, DOB and SSN were in the hands of a disgruntled, former employee of my doctor.

If I were the doctor in question, I would be extremely unhappy that my office manager fired an employee, giving them documents containing said information on patients of mine.

I am also uneasy with the idea of destroying the information rather than returning it to the doctor's office.

 

[TigerD]

I think everybody is missing the HIPAA violation - it occurred when the girlfriend show the documents to the poster. The liability belongs to the girlfriend.

TD

 

[LdiJ]

I think everybody is missing the HIPAA violation - it occurred when the girlfriend show the documents to the poster. The liability belongs to the girlfriend.

TD

I do not agree. She was no longer an employee of the doctor when that happened...and she was no longer an employee when she was given the documents. She was already fired. I think that the HIPAA violation occurred when she was given the documents.

However, this is something that we could all debate for days...and said debate would be of little to no use to the poster.

I say return the documents to the doctor's office with a note stating a belief that having the documents in her possession is a HIPAA violation, and move on.