HIPAA Violation

[muffin1968]

What is the name of your state (only U.S. law)? California

I work in the insurance billing department of a large hospital. I found issues of fraudulant billing and reported them to my HR department about 6 months ago and also called the compliance hotline.
Upon returning from a doctor's ordered stress leave, I was called into the manager's office and told I am suspended for an unknown amount of time for violating HIPAA law.
I had looked up an employee's birthdate and emailed it to another employee to let him know how old she was. I did this over 4 months ago and my supervisor stated she went through my deleted emails to follow up on 'something'. Before going on leave, I deleted everything in my email...even deleted the 'deleted' file.

First of all, I realize I was wrong in telling someone's birthdate. I have written a statement of events (of what I remember since it was so long ago) and also apologized for my actions stating I have learned a valuable lesson and will never do this again.

My question is, can I be fired for this? I understand being written up or suspended for a specific amount of time but to have to sit and wait for them to decide...over a birthdate.
Also, I feel I am being retaliated against since I reported the billing issues. Is there something I can do?

I've informed the other employee and he has not been questioned by HR regarding the information I gave him. Shouldn't HR talk with him? His supervisor says it was an innocent offense used to get a date, not information to ruin someone's life.

Please help me in the matter ASAP, I appreciate any information you can give me.What is the name of your state (only U.S. law)?

 

[Beth3]

My question is, can I be fired for this? Yes. You had no business looking up that information and sharing it with someone else.

Also, I feel I am being retaliated against since I reported the billing issues. Is there something I can do? No. Whether the fraudulent billing you reported has anything to do with this, you clearly violated hospital policy and perhaps HIPAA regulations.

I've informed the other employee and he has not been questioned by HR regarding the information I gave him. Shouldn't HR talk with him? That's up to them. Asking you for the information was inappropriate however your providing the information is the major problem here.

Before going on leave, I deleted everything in my email...even deleted the 'deleted' file. It makes little sense that you would do that unless you had something to hide. However as you discovered, deleted emails and other electronic documents are never really deleted. They still live on in your employer's server and can be fairly easily retrieved. Perhaps your supervisor did indeed need to look for something in your email and it was the fact that you'd deleleted everything made her suspicious and led her on a search.

The ball is in your employer's court. All you can do is wait and see what they decide.

P.S. It makes no sense that your employer would retaliate against you for reporting possible fraudulent billing. All medical providers and insurance carriers are constantly on the look out for that. It amounts to billions of dollars annually.

 

[commentator]

Yes, I tend to think that the reporting of the fraudulent billing and the being caught given out the birthdate information are two different incidents. Even if they are not, there is no "whistleblower's" protection for you because of the billing situation.

There might be a connection in that another employee who is involved in the fraudulent billing might report you for something they know you did, just because you reported the billing situation, to get you back, so to speak. That still doesn't mean you didn't violate the rule, or that the company cannot fire you for this if they want to.

In the meantime, keep doing your job to the best of your ability and let the chips fall where they may. Stop discussing this situation with your co-workers right away. DO NOT QUIT the job, as that would mean you had no chance to get unemployment benefits while looking for another job. But if they do come to you and terminate you, file for unemployment benefits and begin looking for another job. You may have a slight chance of being approved for unemployment insurance if fired under these circumstances, but it's not a great one, and you certainly have no case for any kind of wrongful termination.

 

[FlyingRon]

Divulging someone's age using privilged files would certainly be somewhere between a severe reprimand and a firing offense here even without HIPAA.
As a covered entity you need to have exerted even MORE control.

 

[swalsh411]

Have you been suspended without pay? If so file for unemployment right away. Suspended without pay is the same as terminated in terms of unemployment. Do not let anybody least of all your employer tell you that you have to wait until you are "officially" terminated. It is in their best interest for you NOT to file for benefits.

 

[davew128]

Ok before everyone else jumps down the OP's throat for looking up an employee's birthday, OP, what was the reason WHY you looked it up? Was it general curiousity or being nosy on the part of the person you have the info to or was it to get a birthday cake in the office on the employee's birthday?

 

[Beth3]

Dave - doesn't matter even if it was for a completely harmless reason. The patient's birthdate was in their medical file therefore it was protected medical information.

 

[davew128]

Dave - doesn't matter even if it was for a completely harmless reason. The patient's birthdate was in their medical file therefore it was protected medical information.

It wasn't a patient that was accessed, it was an employee.

 

[swalsh411]

It doesn't matter at all whether it was HIPAA protected information or what the intentions were. The suspension/termination was not illegal.

 

[FlyingRon]

It wasn't a patient that was accessed, it was an employee.

Doesn't matter. Once you're a covered entity, large classes of records including any employees records that have anything to do with your own benefits come under protection.

 

[Betty]

Agree, just looking up an employee's DOB & furnishing it to someone else is enough to be cause for suspension/termination.

 

[Hot Topic]

What you "feel" is irrelevant. What matters is what you can prove.

 

[muffin1968]

Ok before everyone else jumps down the OP's throat for looking up an employee's birthday, OP, what was the reason WHY you looked it up? Was it general curiousity or being nosy on the part of the person you have the info to or was it to get a birthday cake in the office on the employee's birthday?

My friend in another department had an interest in this girl. He wondered how old she was. The following day, I looked it up and emailed it to him. That was it, no address, ssn, phone number....just "Her DOB is...."

I have been fired for "accessing company software for personal reasons other than work related". My friend spoke with his boss assuming HR would at least contact him to see if he'd used the info. His boss said, "It's an innocent thing to get a date, not a malice reason to get info to use against the employee." Needless to say, his boss is much nicer than mine was.

If I was the boss, I would have written me up and even taken access to that program away and possibly put me on a probation, but.....

I have filed for unemployment and will just look for a better job. I consider that job a waste of 3 years!!!

Thanks for all the help

 

[muffin1968]

My question is, can I be fired for this? Yes. You had no business looking up that information and sharing it with someone else.

Also, I feel I am being retaliated against since I reported the billing issues. Is there something I can do? No. Whether the fraudulent billing you reported has anything to do with this, you clearly violated hospital policy and perhaps HIPAA regulations.

I've informed the other employee and he has not been questioned by HR regarding the information I gave him. Shouldn't HR talk with him? That's up to them. Asking you for the information was inappropriate however your providing the information is the major problem here.

Before going on leave, I deleted everything in my email...even deleted the 'deleted' file. It makes little sense that you would do that unless you had something to hide. However as you discovered, deleted emails and other electronic documents are never really deleted. They still live on in your employer's server and can be fairly easily retrieved. Perhaps your supervisor did indeed need to look for something in your email and it was the fact that you'd deleleted everything made her suspicious and led her on a search.

The ball is in your employer's court. All you can do is wait and see what they decide.

P.S. It makes no sense that your employer would retaliate against you for reporting possible fraudulent billing. All medical providers and insurance carriers are constantly on the look out for that. It amounts to billions of dollars annually.

I realize I made a huge mistake. First one in 3 years I've worked there. Second, you don't know these people. I have seen first hand the fraud they are pulling on a particular LARGE insurance company. Every time I brought these issues to my supervisor, she would get uneasy or irritated.
I plan on calling 3 large insurance companies and alert them of what is going on.
Thank you.....

 

[Proserpina]

My friend in another department had an interest in this girl. He wondered how old she was. The following day, I looked it up and emailed it to him. That was it, no address, ssn, phone number....just "Her DOB is...."

Do you think that is acceptable?

I have been fired for "accessing company software for personal reasons other than work related". My friend spoke with his boss assuming HR would at least contact him to see if he'd used the info. His boss said, "It's an innocent thing to get a date, not a malice reason to get info to use against the employee." Needless to say, his boss is much nicer than mine was.

His boss was, frankly, an ass. Yours did the right thing.

If I was the boss, I would have written me up and even taken access to that program away and possibly put me on a probation, but.....

I have filed for unemployment and will just look for a better job. I consider that job a waste of 3 years!!!

Thanks for all the help

I guess neither you nor your friend thought about how this might bother you know, the actual girl involved? Having someone access her personal info and share it with a third party because that third party thinks she's tappable?

Don't hold your breath for unemployment.