HIPAA Issue?

[kennyv519]

What is the name of y our state? Pennsylvania

I went to an urgent care facility last week for a work injury. I had to fill out forms prior to treatment that asked for medications I take as well as all surgeries I have had. After the visit this information was sent to my employer who now has been calling me on a daily about certain medications I take and having to get certifications from my doctors that they prescribed this medication. Are these facilities only required to release information pertaining to the work injury solely or can they disclose my entire health history to my employer?

 

[quincy]

What is the name of y our state? Pennsylvania

I went to an urgent care facility last week for a work injury. I had to fill out forms prior to treatment that asked for medications I take as well as all surgeries I have had. After the visit this information was sent to my employer who now has been calling me on a daily about certain medications I take and having to get certifications from my doctors that they prescribed this medication. Are these facilities only required to release information pertaining to the work injury solely or can they disclose my entire health history to my employer?

If you filed a workers compensation claim, your medical information/medical history can be disclosed.

I question your employer questioning you about your medication, though.

 

[quincy]

Here is a link with access to Pennsylvania's workers compensation laws:
https://www.dli.pa.gov/Individuals/Workers-Compensation/publications/Pages/WC Act/WC-Act-Landing-Page.aspx

 

[cbg]

FYI workers comp cases are expressly exempt from HIPAA

 

[quincy]

FYI workers comp cases are expressly exempt from HIPAA

Right. The employee grants access to the medical records when filing a workers compensation claim.

 

[kennyv519]

There was no "offficial" claim filed as of then. It was just a visit to the urgent care facility contracted by my company to handle the preliminary examination. The "official" claim number was just issued yesterday through AIG.

 

[PayrollHRGuy]

There was no "offficial" claim filed as of then. It was just a visit to the urgent care facility contracted by my company to handle the preliminary examination. The "official" claim number was just issued yesterday through AIG.

The time that AIG produces a claim number has nothing to do with it. You reported the injury to your employer and that it was work-related.

Not that I think it matters for HIPAA did you complete a First Report of Injury Form?

 

[quincy]

If you filled out an injury form, I believe that has an authorization clause.

The employee/employer's insurance provides payments for necessary medicines - but there are now special record and reporting requirements with some drugs, which might have been a reason for your employer's inquiries.

 

[kennyv519]

Thank you, everyone, for your help with this. I appreciate the time!

 

[quincy]

We all appreciate the thanks, kennyv519, so thank you.

I hope you recover quickly from your workplace injury.

 

[kennyv519]

All,

I found out today that this urgent care facility sent all of my personal and private medical information to my actual work site through their portal and not to the corporate nurse practitioner which they should have done. All of the managers and anyone else in the building with access can read this information where it should have been just the nurse in charge at my company. I actually spoke to this nurse in charge and she fully agrees that a violation on their part occurred. She's actually flying in to speak with this place directly.

This affirms to me that my privacy has been compromised! I have the actual report that was sent to my local site in hand and it shows it all. Where this facility should have simply sent the details of my injury and the recommended plan of action to my local site, they sent the entire file!

I have emailed their privacy line as well as reported this to the OCR office. Whether or not anything will be done other than a "sorry for the mistake" remains to be seen.

With this newly discovered information, should I maybe look into getting an attorney for help with this?

 

[bcr229]

You can report it here: https://www.hhs.gov/hipaa/filing-a-complaint/index.html

 

[quincy]

All,

I found out today that this urgent care facility sent all of my personal and private medical information to my actual work site through their portal and not to the corporate nurse practitioner which they should have done. All of the managers and anyone else in the building with access can read this information where it should have been just the nurse in charge at my company. I actually spoke to this nurse in charge and she fully agrees that a violation on their part occurred. She's actually flying in to speak with this place directly.

This affirms to me that my privacy has been compromised! I have the actual report that was sent to my local site in hand and it shows it all. Where this facility should have simply sent the details of my injury and the recommended plan of action to my local site, they sent the entire file!

I have emailed their privacy line as well as reported this to the OCR office. Whether or not anything will be done other than a "sorry for the mistake" remains to be seen.

With this newly discovered information, should I maybe look into getting an attorney for help with this?

There is no private cause of action for you to pursue when a health care provider violates HIPAA.

If you find that the disclosure of your medical information to others has resulted in personal harm with demonstrable damages, however, you could discuss with an attorney in your area your legal options.

 

[bertha01]

FYI workers comp cases are expressly exempt from HIPAA

Agree ....

 

[quincy]

Although your posts have been very nice, Bertha, the “like” feature is a good alternative to adding to an older thread if you wish to show agreement with or appreciation for a post’s content.