Advice about HIPAA issue

You can report this to the Privacy Officer at the hospital your son was treated at. They can easily see who accessed your son's records. Mail a letter to the Privacy Officer that you believe your son's records were accessed without authorization by so and so and you want them to review his records. You might also be able to find the Privacy Officer's email on the hospital website.

If she did indeed access your son's records, also file a complain with the Privacy Officer of the hospital she worked in.
 
My second concern is, how many of them details came from the teenage girl, abd how much of this is the OP filling in the details?

My guess is that the doctor shares "war stories" with her spouse, talking about interesting cases at home without identifying the patient by name. That mom may have mentioned the systems being linked. My guess is that the mom speculated about the OP's son's medical condition. That the girl had just enough information to sound authoritative. That the OP and her son may have subconsciously filled in details.


If the OP suspects that the doctor really did cross the line, a discussion with the appropriate person at the hospital is in order. But I would take it slow, ask for an investigation to see if there was a breach rather than making accysations without having any facts other than the gossip of a teenage girl.
 
My second concern is, how many of them details came from the teenage girl, abd how much of this is the OP filling in the details?

My guess is that the doctor shares "war stories" with her spouse, talking about interesting cases at home without identifying the patient by name. That mom may have mentioned the systems being linked. My guess is that the mom speculated about the OP's son's medical condition. That the girl had just enough information to sound authoritative. That the OP and her son may have subconsciously filled in details.


If the OP suspects that the doctor really did cross the line, a discussion with the appropriate person at the hospital is in order. But I would take it slow, ask for an investigation to see if there was a breach rather than making accysations without having any facts other than the gossip of a teenage girl.

OP here.

I did not fill in details. My son told me tonight what this girl said.

He was very specific that she said the systems were linked and the doctor mom looked at his CT records and that there was no "medical concussion" (a term I have never used before so not one I would have filled in).

I'm honestly not trying to ruin someone's life. I'm just trying to figure out what to do.
 


My second concern is, how many of them details came from the teenage girl, abd how much of this is the OP filling in the details?

My guess is that the doctor shares "war stories" with her spouse, talking about interesting cases at home without identifying the patient by name. That mom may have mentioned the systems being linked. My guess is that the mom speculated about the OP's son's medical condition. That the girl had just enough information to sound authoritative. That the OP and her son may have subconsciously filled in details.


If the OP suspects that the doctor really did cross the line, a discussion with the appropriate person at the hospital is in order. But I would take it slow, ask for an investigation to see if there was a breach rather than making accysations without having any facts other than the gossip of a teenage girl.

It's a very quick check. All the Privacy Officer has to do is log into his medical record and look at the list of those that have logged into his record. It takes a minute to see if her name is on the list or not. Rather than trying to figure this out, might as well just have the Privacy Officer do this. If the lady's name isn't on the list of those that have logged in, it's over and done with. No harm, no foul.
 
OP here.

I did not fill in details. My son told me tonight what this girl said.

He was very specific that she said the systems were linked and the doctor mom looked at his CT records and that there was no "medical concussion" (a term I have never used before so not one I would have filled in).

I'm honestly not trying to ruin someone's life. I'm just trying to figure out what to do.

If this kid's mom did look in your son's medical record, she brought any consequences of doing so on herself. You aren't ruining anyone's life. EVERYONE that works in a hospital is well aware of the rules in regards to this.
 
I work in a health care facility and people do this all the time. People get fired at least once a year for nosing into someone else's business. Yes, everyone knows not to do it. But it happens everyday. Not everyone gets fired for it, unless a complaint is filed. So I would not be shocked by an MD doing it, I've seen it happen more than once.

File your complaint, it is easy enough to check if she accessed it. She will get fired if she did. And she deserves to get fired. Everyone knows the rules.
 


How do you know the girl is telling the truth about her mother? It really sounds like someone trying to get your son riled up again.

I also doubt that Hospital A would have been sharing records with Hospital B without a signed consent in place. Just from my experience, two unaffiliated hospitals would not have a system in place for employees to look at each other's records. The request would have have to gone through someone at the hospital where your son was treated.

It's absolutely, easily possible. Some medical information systems are multi-entity, meaning that more than one hospital/institution shares the same database. It's the hospital's choice whether or how they restrict personnel at one hospital from accessing patient info at another hospital in the system. So it's entirely possible that ER Mom has an account that will let her access patient data for more than one hospital. Or who knows, maybe she picks up per diem shifts at the other hospital once a month and has an account there for that reason.

If she actually did this, you're right, it's a HIPAA violation, and an serious one. At the hospitals i worked at, this would be a firing offense. All HIS systems in use in the US should be HIPAA compliant by now, which would mean that there is a record of her accessing your son's data.

Personally, I'd report it to the hospital where your son was treated, and the hospital where ER Mom works, and let them sort it out.
 
If the hospitals are not within the same system there is no way that the MD could have viewed your son's electronic records. For her to get your son's records you would have had to sign a release of information form.

That's not the case. I've worked on numerous multi-entity systems where hospitals with no affiliations share a database, and doctors have access to multiple institutions' patient data within the system. We've had unaffiliated hospitals in a community sign an agreement to share IT, because it reduces costs for both institutions.
 
I'm seeking unbiased advice here!

My DS 15 was hit in the head at school by another student. The hit was intentional. DS was confused and could not remember details from his day, but he never lost consciousness. Because of his symptoms, we took him to the ER. They did a CT which was clear, but the ER doctor said he had a mild concussion and should not do PE for two weeks and could stay home from school for 5 days (she wrote him an absence excuse).

He returned to school the next day and took his final exams because he did not want to put them off until after the holidays, but still felt lousy for a few more days.

We and his teachers reported the incident to the school, so the guy who hit him was punished according to school policy. This incident has caused quite a bit of personal trouble for DS because a couple the kids who were his friends no longer speak to him; they blame him for the kid getting in trouble. But we are dealing with that!

Now, about a month after this incident, DS heard from another student (who knows all the kids involved) that her mother, who is an ER doctor at a different hospital and who has never treated my son, accessed his CT records and determined that it was not a "medical concussion" because the CT did not show scarring, that the doctor at that the original ER did not know what she was doing, and that my DS is a "baby."

I am upset that she was looking at his records when she had no business doing so and that she told her daughter about this as well.

Does anyone have advice about what I should do? Should I report this to the hospital? To the federal government as a HIPAA violation? Any thoughts?

Thanks.

I think that there is probably nothing going on here (just to reassure you). I think that this student got your son's goat. I am surprised that so many people are jumping on this with advice to report, report, report.

Physicians and nurses from another hospital - even in the SAME system - often have restricted access in our area. Even within a hospital they often are restricted to information on a need to know basis.

A physician from a totally different hospital would not have access to your sons CT results without your written release. They can't just call up and get them either.

I think that this is probably what happened.

1) Your son got hurt.
2) Your son returned to school.
3) This person teased your son and said the above to try to get at him.
4) How did she know what to say? The student who said this to your son probably guessed that his CT was clear. Or, more likely, he previously said that his CT was clear when he returned to school and she filled in the blanks.

More CT scans are clear than they are not clear. A lot of kids get hit during sports. Clear does NOT mean not hurt. This is a huge misconception.

I think that your accusations are going to be really - odd - when you go reporting them. But you are well within your rights to do so. It is just going to seem fishy and like you are jumping the gun. These are teenagers. They say things to dig at each other.

Like blackpug said - to release to another hospital - you have to sign a release.

And they keep records of everyone who accesses records within the same computer system.

As a provider - people don't spend all day just looking at random records of patients we are not actively taking care of. We are busy. Honestly, I don't really know the names of my daughter's fellow students beyond a select few that come to my home. That is it. I would have to have my DD spell their last names to know them for sure. If one of her fellow classmates got hit in the head - even if I knew that they got wacked - I wouldn't know the kids name or even what they looked like 5 minutes after I heard about it.

I'm too busy dealing with my own kids and own life that I would not have time to track something like this down for my own kid or family - much less a child I don't know. Physicians and nurses are so over scheduled that we do not have time to track something like this down for sheer pleasure.

I surely wouldn't talk about another persons kids with my teenage child and I can't magically read other x-rays or radiology scans at another hospital. :confused3

I'm just saying this from the view of a provider. I would be more worried if she said "my mom saw you in the hospital, and she said you were fine!!". Then I would be all over it.
 
That's not the case. I've worked on numerous multi-entity systems where hospitals with no affiliations share a database, and doctors have access to multiple institutions' patient data within the system. We've had unaffiliated hospitals in a community sign an agreement to share IT, because it reduces costs for both institutions.

Are you sure? Or do they share credentialing privileges?

It is not common in my area - that might be a regional occurrence. Our hospitals are very strict that even if we call up and need to share records - we get releases.
 
There's no way to know if she looked into his record or not without the Privacy Officer looking at the log of those that accessed the medical record.

Rather than speculate, wonder, and be upset, it will take a minute for the Privacy Officer to check and see if she did or not. If the answer is no, that's the end of it.

I actually wouldn't bring it up to the doctor's employer at all, unless it turns out she did indeed access the record.

If the answer is no, you might want to let the lady know what her daughter is saying. If the answer is yes, then I would indeed report it to her employer and Office of Civil Rights.
 
My guess would be that the teen girl is making the whole thing up to upset your son. High school drama at its finest.

I do not think it is the least bit unusual that the child of an ER doctor would be familiar with terms related to concussions and even some of the basics of how they work. Most parents talk about their work days at home, and I imagine ER doctors see concussions pretty often and it has come up.

Heck, I am not a doctor, not related to any doctor, never had a concussion and neither have my kids, don;t even watch medical dramas on TV :rotfl: and even I know all the terms you use just from talking to other parents whose kids have had concussions over the years.


I would call or write the hospital and let them know there is gossip at school and you realize it is probably all made up but want to be sure and ask them to check the file and see who accessed it. You should be able to have your answer very quickly and then know if you need to be outraged and makng reports or not.

BTW--for future reference or for anyone else; it is my understanding that the worst thing you can do with a brain injury is a lot of brain stimulation. The brain itself needs to rest to recover. Personally, the most shocking part of the OP to me is that you sent your child with a concussion in to take finals the next day! To me that would be like a child having a sprained ankle and the doctor said to stay off of it but you sent them in for a hockey game anyway.
 
My opinion is that the girl is lying.

First of all, it's really not all that easy to just access someone's record, even though they are electronic. It's a process that requires documentation and consent forms in order to gain access to a record for a patient that is not currently in the system. Being as though your son was not in the hospital at the time, I seriously doubt that MD mom would've gone through the trouble of accessing his record.

Secondly, most people will NOT risk their license over some school kid drama. I've had people I know personally come through where I work, and even though I've been curious, I knew it was not an option to look at their record to see why they were there. It's very easy to access the record of a patient who is currently in the system because all you have to do is click on their name. However, unless you're directly providing care to them, it's a no-no. Like I said though, it's NOT as easy as clicking on their name once they've been discharged. I highly doubt that MD mom would go out of her way (which she would've had to do) to to bring up your son's record.

Sure, there are people who do things they shouldn't do all the time, and people who do things that you think they'd never do. I just know that myself and most people I know would never risk our jobs by looking up our OWN record (which is also a no-no) much less look up some kid's record our son or daughter goes to school with. It's just not very likely.

Reporting a HIPAA violation is a very serious thing. Have you considered calling and speaking to the mom/MD about this? I would sure like to know if my son or daughter was going around school putting my livelihood at risk rather than having complaints filed against me for something I didn't do. If the mom/MD isn't receptive to your attempt to clear things up, THEN I would consider filing a complaint, but I have a suspicion that she will be mortified and straighten things out really fast with her blabbing daughter. I would!
 
I'm seeking unbiased advice here!

My DS 15 was hit in the head at school by another student. The hit was intentional. DS was confused and could not remember details from his day, but he never lost consciousness. Because of his symptoms, we took him to the ER. They did a CT which was clear, but the ER doctor said he had a mild concussion and should not do PE for two weeks and could stay home from school for 5 days (she wrote him an absence excuse).

He returned to school the next day and took his final exams because he did not want to put them off until after the holidays, but still felt lousy for a few more days.

We and his teachers reported the incident to the school, so the guy who hit him was punished according to school policy. This incident has caused quite a bit of personal trouble for DS because a couple the kids who were his friends no longer speak to him; they blame him for the kid getting in trouble. But we are dealing with that!

Now, about a month after this incident, DS heard from another student (who knows all the kids involved) that her mother, who is an ER doctor at a different hospital and who has never treated my son, accessed his CT records and determined that it was not a "medical concussion" because the CT did not show scarring, that the doctor at that the original ER did not know what she was doing, and that my DS is a "baby."

I am upset that she was looking at his records when she had no business doing so and that she told her daughter about this as well.

Does anyone have advice about what I should do? Should I report this to the hospital? To the federal government as a HIPAA violation? Any thoughts?

Thanks.

I haven't read the other replies. At our hospital (where I work and have to regularly get into patient's electronic charts) there is a signature EVERY time someone accesses a chart for ANY reason. I would contact the facility and ask for the compliance department. Tell them you would like to see if anyone has accessed his imaging records and/or regular chart. They should be able to tell you if anyone was in there who had no cause to be. And trust me, if they were they will be dealt with. I'd do it today.
 
How do you know the girl is telling the truth about her mother? It really sounds like someone trying to get your son riled up again.

I also doubt that Hospital A would have been sharing records with Hospital B without a signed consent in place. Just from my experience, two unaffiliated hospitals would not have a system in place for employees to look at each other's records. The request would have have to gone through someone at the hospital where your son was treated.

I know in our area medical imaging is linked between the local facilities. That way Dr. A can refer a patient to Dr. B across town and the images are right on the "PACS" system- saves having to send hard copies.

Like I said in my previous post, every time some accesses a record they leave and electronic signature or fingerprint- the compliance department can see who was in a record and when.
 
Our PACS is an internal system but there is a very large imaging chain that one of our admin people is able to access even though we have absolutely no affiliation with that imaging chain. This is done only when we have a patient in for a procedure or exam and don't have the prior studies on disk or hard copies of the films. I have no idea how this is done and don't want to know. So yes, it can be done.

That said, everytime you log onto PACS, there is a record of exactly what studies you have gone into and viewed. If this ER doc had accessed your son's exam, I don't think it would be difficult for the PACS administrator at that hospital to confirm it.

As a previous poster also said, it is possible that the doctor also does work for the other hospital as well and has access to their PACS system. A lot of radiologists will read for more than one facility so it is not that farfetched to guess that this doc may do the same.

I would suggest you contact the hospital in question and find out to whom a potential HIPAA violation should be reporter and go from there.
 
Is it possible? Yes. Plausible? No.

The mother of a girl who was not a participant in the situation is going to risk her job, her license abd her career to involve herself in an argument between two boys? In her shoes I might be tempted to look at the records, but to discuss them with her teenage daughter and allow her daughter to share those juicy tidbits?

I'm thinking the daughter might be "embelishing" the truth.

:thumbsup2

This,. I know many nurses and most never intentionally go snooping but the few I asked said even if they did see some one elses records no way would they start blabbing about it. especially to a teenage daughter they know is in the same circles with the patient.
I asked 2 friends and basically I got responses like "Are you high?"

following HIPPA guidelines is such a big deal, I can't imagine this mother/doctor jepordizing her license, her job and a boat load of lawsuits to gossip to her daughter.

I too think daughter is perhaps embelishing. Do you know the mom can you speak to her directly?

What reason would this er doctor have to access your sons records a MONTH after the incident? I just can't see it? for some high school fight?
 
eliza61 said:
:thumbsup2

This,. I know many nurses and most never intentionally go snooping but the few I asked said even if they did see some one elses records no way would they start blabbing about it. especially to a teenage daughter they know is in the same circles with the patient.
I asked 2 friends and basically I got responses like "Are you high?"

following HIPPA guidelines is such a big deal, I can't imagine this mother/doctor jepordizing her license, her job and a boat load of lawsuits to gossip to her daughter.

I too think daughter is perhaps embelishing. Do you know the mom can you speak to her directly?

What reason would this er doctor have to access your sons records a MONTH after the incident? I just can't see it? for some high school fight?

If the mom accessed it, I think she did it right after the incident. My son is not friends with this girl so he does not talk to her regularly.

And it was not a "fight." My son was sitting down and was hit from behind by a kid who has harassed him and other kids before.
 
There's no way to know if she looked into his record or not without the Privacy Officer looking at the log of those that accessed the medical record.

Rather than speculate, wonder, and be upset, it will take a minute for the Privacy Officer to check and see if she did or not. If the answer is no, that's the end of it.

I actually wouldn't bring it up to the doctor's employer at all, unless it turns out she did indeed access the record.

If the answer is no, you might want to let the lady know what her daughter is saying. If the answer is yes, then I would indeed report it to her employer and Office of Civil Rights.

This. All of this. Make the call OP.
 

GET A DISNEY VACATION QUOTE

Dreams Unlimited Travel is committed to providing you with the very best vacation planning experience possible. Our Vacation Planners are experts and will share their honest advice to help you have a magical vacation.

Let us help you with your next Disney Vacation!





Latest posts

Top