HIPAA Law Violation

What is the name of your state? Illinois.

I was struck by a car while biking. No police report was filed and I was not transported in an ambulance. I visited the emergency room. The next business day I received two phone calls on my cell phone from a lawyer who claimed I was referred to him. I was not referred to, nor have I contacted, a lawyer (and no, a well-meaning family member did not, either, as I have no family in the area). The only record of my accident along with my name and cell phone number is at the emergency room. It is clear that somehow, the personal information of accident victims who visited that emergency room is being given to lawyers. I am filing a complaint with the Department of Human Services Office of Civil Rights, but I would like to know if I have any other rights. Thanks.

What are your damages (i.e. why do you want to sue)?

I'd also report the "leak" to the Director of the Hospital. If you really want to get down and dirty, contact the local Bar Association and report the lawyerwho contacted you.

Sadly, it's a fairly common occurrance for a low-level hospital worker to dish out patient information.

I didn't say that I wanted to sue - though I would if I had a case. I can't reasonably say that much damage has been incurred so far. However, I know that someone has my cell phone number and name and is likely to have the other information I provided on the form/s at the ER (social security number, address, date of birth, etc). The potential to do damage with this information still exists.

Most of all, I want the hospital to be held liable for what has been happening (and will, in all likelihood, continue to happen). I talked to the hospital administration, and while shocked, they didn't even bother to ask me for the lawyer's info (which I have).

HIPPA is federal, http://www.hipaa.org/
there are state regulations you need to look into http://www.state.il.us/
http://www.legis.state.il.us/search/iga_search.asp?scope=ilcs
http://www.idph.state.il.us/about/ill_hospitals.htm
the bar http://www.illinoislawhelp.org/
licensing complaints http://www.dpr.state.il.us/proflist.asp
is this a HMO hospital that will make a difference.
JACHO for the hospital, http://www.jcaho.org/
An attorney can best advise you on your options, don't forget you were hit by a car. However you can without cost still make a positive difference by administratice complaints, this is in the service of public policy.

I sincerely doubt the information came from the hospital or is any violation of HIPPA. Perhaps the hospital did communicate with the police as it was a vehicular accident resulting in injury. In all likelihood, there is a police report and an accident report of some kind.

Most likely, the attorney got the information from law enforcement or a scanner and not from healthcare.

EC

Of course, this all assumes the lawyer who called you isn't the one who ran you over on the bike...


{edit}
And in response to the reply above, if you really think this doesn't happen, you must have worked in the Greatest Hospital on Earth. In NYC, it is one of the prime methods by which the PI shysters get their leads. They have "contacts" in the hospital (typically the record room filing clerk) who get very illegal "reimbursements" for each case they inform the lawyer about. The sexier the injury, the higher the reimbursement.

The other way is for a large employers disability "nurses" moonlighting for the HMO that covers the majority of employees, thus when a disability is reported they can access the work and confidential healthcare records, sometimes remotely, deny the claim because there is no appeal, I know of at least one such case, the RN was caught and fired at both jobs and eventually lost her license, but the disability denial still remained in effect and the person was truly disabled and forced back to work. Names and cel phone numbers should not be given out on scanners, however the police log may have names but not cel phone numbers. It has to be an inside job somewhere, or possibly from the driver of the other car if you exchanged information?

Sorry, EC, but it the information did come from the hospital. Believe me, there was no accident report filed with the police. No police even arrived on the scene. Nobody at the ER asked me if I wanted to contact them (I was not injured that badly). I was hit by a taxi and the driver barely said a word, so I highly doubt he felt like marching down to the police station and giving them information (of which he had none of mine). A bystander wrote down his information and gave it to me, which I haven't done anything with.

I know for a fact that the hospital leaked the info and that is what I am most concerned with. If this happens at many hospitals, then so be it. It still doesn't make it right.

Then state, once and for all, who leaked the information to the attorney. The admission clerk? The ER MD? The ER RN? If you know for a fact who leaked the information, then I will direct you to the portion of the HIPPA law that applies.

You were not the only party in this accident and the hospital is not the only entity involved, either. Hospitals don't even like attorneys, so I'll keep my suspicions until you state exactly who revealed your private information and how it was done. Each matters in determining a HIPPA violation.

EC

I make no claims to know who in the hospital leaked the information to the attorney (how would one know that?), or I would have stated that outright. All I know is that it that it came from the hospital. Period. When you are in an accident, the other party involved has NONE of your information, no police came, and all you visited was the ER, what other "entities", besides the hospital, would be involved? I am sure hospitals don't like attorneys, but I wouldn't go as far as to say that all hospital employees don't like attorneys, especially when a little collaboration could earn them some $$$.

Suspicions alleviated, EC?

You have no HIPPA violation and no means to file a complaint because you have no idea how the attorney got your name and cell phone number. End of story.

EC

It is not the responsibility of the injured party to investigate and determine who leaked the information, if they don't know. That would ruin the chain of evidence. She has good reason to make her claim, by exclusion and has reported it to the hospital administration in good faith. When the claim is investigated, they will determine who leaked the information. I gave the link to HIPPA and information about complaints is found there.

Thank you for your helpful advice, rmet4nzkx. I have now also filed a complaint with the Joint Commission on Accredidation of Healthcare Organizations. I am sorry that I am not a good enough detective for EC to deem this an actual HIPAA violation.

Chitown
You have wasted your time and effort in filing a complaint with JCAHO and you will waste your time and effort in filing a complaint with HIPPA.

In June of this year, just a couple of weeks ago, I completed a professional course on HIPPA and the recent changes to HIPPA, so I know that I what I am telling you is fact.

HIPPA realized that healthcare facilities had taken the interpretation of HIPPA laws to the extreme, thereby creating patient safety issues and confusing the public as to the intent and requirements of HIPPA.

These are the requirements that must be met:
Healthcare organizations must have standards to meet HIPPA regulations and staff education on HIPPA regulations. The standards and education must state/teach:
that the patient has the right to decide 'who, when, and how' their information will be shared (outside of necessary communication in the healthcare delivery system);
that confidentiality is the obligation of the provider to maintain the patient's privacy;
that a good faith effort must be made by each provider;
that other than within the healthcare system, information may be shared with legally mandated reporting or disclosure;
and that information is to be provided on a need to know basis.

What do you expect HIPPA to do? Rush down and interrogate each hospital employee? Ain't gonna happen.

If the police department, or the taxi driver, or the taxi company, or the taxi's insurance provider, called the hospital and asked for your name and number, the hospital is within HIPPA compliance in providing information on a need to know basis. Your diagnosis, treatment, prescriptions, etc. were not disclosed; just the information the caller already knew--you were hit by a taxi and the need to contact you existed--that's all they received, your name and your number.

You do not fall into a protected classification of patients for whom there are civil or criminal penalties. Even if by the slightest chance it was determined that an employee incorrectly gave out your name and cell phone number, you will not be awarded anything at all.

I'm glad you received an answer that you wanted; I'm sure it makes you feel better. It just doesn't create a HIPPA violation and it surely doesn't create a JCAHO violation.

EC

EC, I seriously doubt your ability to comment on HIPAA laws, as you do not even know the acronym for them! It’s HIPAA, not HIPPA, which stands for Health Insurance Portability and Accountability Act.

You seem very convinced that someone at the hospital did not leak the information illegally. If you read my posts closely, instead of just making assumptions, you would see that I have posted numerous times that the taxi driver never got any of my information, nor did the police, who, once again, were not involved. Besides, would the taxi driver really want to contact the hospital so that a lawyer could be referred to me? Would the taxi company actually want to provide me with a means to sue? Your logic simply doesn’t pan out.

I have consulted with someone who just completed a HIPAA course as well. His first reaction upon hearing my story was that it was a clear violation of HIPAA. The administration at the hospital even called it a HIPAA violation. Furthermore, the HIPAA requirements you posted merely confirm my claim: “confidentiality is the obligation of the provider to maintain the patient's privacy”. If you can cite some HIPAA requirements that actually prove there was no violation, please feel free to share them.

Even if you concede that it is more than likely the hospital did leak the info, and that it is a HIPAA violation, I suppose you can still fall back on your statement of: “What do you expect HIPPA to do? Rush down and interrogate each hospital employee? Ain't gonna happen.” Call me an optimist, EC, but I have a feeling HIPAA laws weren’t created to be shelved and not enforced.

According to the HIPAA website:

“Enforcement will be primarily complaint-driven. OCR will investigate complaints and work to make sure that consumers receive the privacy rights and protections required under the new regulations. When appropriate, OCR can impose civil monetary penalties for violations of the privacy rule provisions. Potential criminal violations of the law would be referred to the U.S. Department of Justice for further investigation and appropriate action.”

You say I am just “wasting my time”. Actually, HIPAA and JCAHO complaints are surprisingly easy to make. It’s a mere matter of typing a paragraph explaining the incident and providing the name and address of the hospital. Good thing I made a complaint, huh?

EC, your initial speculation was warranted, but it is clear you are taking this too far. You came into this with the attitude that you could shoot my claim full of holes. I'm sorry that didn't happen. In dispensing advice, EC, why not and let accuracy and logic be your guide instead of trying to bolster your ego?