Advice about HIPAA issue

[dbrn]

HIPAA requires that covered entities, including hospitals, have an individual designated as a Privacy Officer. That is the person I would recommend you ask to speak with at the hospital where your son was treated. He or she can investigate the allegation further, including performing an audit trail to find out who accessed the record.

[Lorelei Lee]

It amazes me how some people are ready to file all sorts of complaints against the doctor and threaten her license and livelihood over the gossip of a teenage girl.


Three scenarios popped into my head.

1. Doctor Mom chose to involve herself in this matter by looking up OP's son's nedical record even though she was not the treating physician and had no direct involvement with this matter. Doctor Mom shared this priviledged and confidential information with her teenaged daughter, so that daughter could share information with other students.

2. Doctor Mom never looked at medical records. OP told us that her son returned to school the next day to take exams, even though his treating physician wanted him to stay home. I'm sure that was cause for speculation amoung those who were gossiping about the incident. Doctor Mom could have been speculating about OP's son's medical condition based on publicly known information, i. e., he went back to school the next day so he "really wasn't hurt." Teenage daughter may be repeating and embelishing her mother's conjecture.


3. Doctor Mom never said a word about any of this abd her daughter made the whole story up.


Sorry, but I'm just not buying that a doctor who has apparently been practicing for many years would risk her license to inject herself into this situation.

[OceanAnnie]

Originally Posted by akcire

If the doc mom has privileges or any of her partners have them she probably has access to any electronic medical records.


I would call the hospital that treated your son and ask to speak to their general counsel. I would ask him to launch an investigation at his hospital via it. If she accessed the record there should be log in information. I would also ask him to contact the general counsel at the non treating hospital.

Finally if the kid intentionally hit your son, I'd file criminal charges but that's me.

I would too.

Originally Posted by DisFam11

If the hospitals are in the same system she could have easily looked up your son's information. It is very simple now that the hospitals use electronic medical records. I would call the hospital and file a complaint and also report the HIPAA violation. But I would go a step further and report the doctor to your state's licensing board. This is a major violation and on top of it she gave the information to her child who in turned used it to bully your son. This is not something that you can or should let go.

Indeed.

[OceanAnnie]

Originally Posted by Lorelei Lee

It amazes me how some people are ready to file all sorts of complaints against the doctor and threaten her license and livelihood over the gossip of a teenage girl.


Three scenarios popped into my head.

1. Doctor Mom chose to involve herself in this matter by looking up OP's son's nedical record even though she was not the treating physician and had no direct involvement with this matter. Doctor Mom shared this priviledged and confidential information with her teenaged daughter, so that daughter could share information with other students.

2. Doctor Mom never looked at medical records. OP told us that her son returned to school the next day to take exams, even though his treating physician wanted him to stay home. I'm sure that was cause for speculation amoung those who were gossiping about the incident. Doctor Mom could have been speculating about OP's son's medical condition based on publicly known information, i. e., he went back to school the next day so he "really wasn't hurt." Teenage daughter may be repeating and embelishing her mother's conjecture.


3. Doctor Mom never said a word about any of this abd her daughter made the whole story up.


Sorry, but I'm just not buying that a doctor who has apparently been practicing for many years would risk her license to inject herself into this situation.

Strange a teenager would make up something about hospital systems being linked. Maybe the mother confided in her daughter thinking the daughter wouldn't tell anyone?

I have heard of people accessing records and talking about it. It isn't out of the realm of possibility. Maybe the ER doc did. Maybe she didn't. The least I would do is start an investigation. I wouldn't blow it off. If it was done, it's a serious violation.

Professionals in all walks of life, do all sorts of risky activities thinking they won't get caught or are above being caught. It happens.

[JessB320]

Originally Posted by Lorelei Lee

It amazes me how some people are ready to file all sorts of complaints against the doctor and threaten her license and livelihood over the gossip of a teenage girl.

Three scenarios popped into my head.

1. Doctor Mom chose to involve herself in this matter by looking up OP's son's nedical record even though she was not the treating physician and had no direct involvement with this matter. Doctor Mom shared this priviledged and confidential information with her teenaged daughter, so that daughter could share information with other students.

2. Doctor Mom never looked at medical records. OP told us that her son returned to school the next day to take exams, even though his treating physician wanted him to stay home. I'm sure that was cause for speculation amoung those who were gossiping about the incident. Doctor Mom could have been speculating about OP's son's medical condition based on publicly known information, i. e., he went back to school the next day so he "really wasn't hurt." Teenage daughter may be repeating and embelishing her mother's conjecture.

3. Doctor Mom never said a word about any of this abd her daughter made the whole story up.

Sorry, but I'm just not buying that a doctor who has apparently been practicing for many years would risk her license to inject herself into this situation.

Normally I would agree but the fact that the teen girl used the correct language, mentioning that the scan was clear, there was no scarring, this wasn't a medically or trauma caused concussion. If teen girl was just making it up I would think she would be more vague and just say my moms a dr and she says your fine. It still could be a lie but I think worth looking into to find out

[chloelovesdisney]

You can report this to the Privacy Officer at the hospital your son was treated at. They can easily see who accessed your son's records. Mail a letter to the Privacy Officer that you believe your son's records were accessed without authorization by so and so and you want them to review his records. You might also be able to find the Privacy Officer's email on the hospital website.

If she did indeed access your son's records, also file a complain with the Privacy Officer of the hospital she worked in.

[chloelovesdisney]

If it's confirmed file a complaint with your regional Office of Civil Rights that enforces HIPAA violations -

http://www.hhs.gov/ocr/privacy/hipaa...nts/index.html

[Lorelei Lee]

My second concern is, how many of them details came from the teenage girl, abd how much of this is the OP filling in the details?

My guess is that the doctor shares "war stories" with her spouse, talking about interesting cases at home without identifying the patient by name. That mom may have mentioned the systems being linked. My guess is that the mom speculated about the OP's son's medical condition. That the girl had just enough information to sound authoritative. That the OP and her son may have subconsciously filled in details.


If the OP suspects that the doctor really did cross the line, a discussion with the appropriate person at the hospital is in order. But I would take it slow, ask for an investigation to see if there was a breach rather than making accysations without having any facts other than the gossip of a teenage girl.

[Tam1067]

Originally Posted by Lorelei Lee

My second concern is, how many of them details came from the teenage girl, abd how much of this is the OP filling in the details?

My guess is that the doctor shares "war stories" with her spouse, talking about interesting cases at home without identifying the patient by name. That mom may have mentioned the systems being linked. My guess is that the mom speculated about the OP's son's medical condition. That the girl had just enough information to sound authoritative. That the OP and her son may have subconsciously filled in details.


If the OP suspects that the doctor really did cross the line, a discussion with the appropriate person at the hospital is in order. But I would take it slow, ask for an investigation to see if there was a breach rather than making accysations without having any facts other than the gossip of a teenage girl.

OP here.

I did not fill in details. My son told me tonight what this girl said.

He was very specific that she said the systems were linked and the doctor mom looked at his CT records and that there was no "medical concussion" (a term I have never used before so not one I would have filled in).

I'm honestly not trying to ruin someone's life. I'm just trying to figure out what to do.

[chloelovesdisney]

Originally Posted by Lorelei Lee

My second concern is, how many of them details came from the teenage girl, abd how much of this is the OP filling in the details?

My guess is that the doctor shares "war stories" with her spouse, talking about interesting cases at home without identifying the patient by name. That mom may have mentioned the systems being linked. My guess is that the mom speculated about the OP's son's medical condition. That the girl had just enough information to sound authoritative. That the OP and her son may have subconsciously filled in details.


If the OP suspects that the doctor really did cross the line, a discussion with the appropriate person at the hospital is in order. But I would take it slow, ask for an investigation to see if there was a breach rather than making accysations without having any facts other than the gossip of a teenage girl.

It's a very quick check. All the Privacy Officer has to do is log into his medical record and look at the list of those that have logged into his record. It takes a minute to see if her name is on the list or not. Rather than trying to figure this out, might as well just have the Privacy Officer do this. If the lady's name isn't on the list of those that have logged in, it's over and done with. No harm, no foul.

[chloelovesdisney]

Originally Posted by Tam1067

OP here.

I did not fill in details. My son told me tonight what this girl said.

He was very specific that she said the systems were linked and the doctor mom looked at his CT records and that there was no "medical concussion" (a term I have never used before so not one I would have filled in).

I'm honestly not trying to ruin someone's life. I'm just trying to figure out what to do.

If this kid's mom did look in your son's medical record, she brought any consequences of doing so on herself. You aren't ruining anyone's life. EVERYONE that works in a hospital is well aware of the rules in regards to this.

[FlyingDumbo]

I work in a health care facility and people do this all the time. People get fired at least once a year for nosing into someone else's business. Yes, everyone knows not to do it. But it happens everyday. Not everyone gets fired for it, unless a complaint is filed. So I would not be shocked by an MD doing it, I've seen it happen more than once.

File your complaint, it is easy enough to check if she accessed it. She will get fired if she did. And she deserves to get fired. Everyone knows the rules.

[Lynne M]

Originally Posted by teacherforhi

How do you know the girl is telling the truth about her mother? It really sounds like someone trying to get your son riled up again.

I also doubt that Hospital A would have been sharing records with Hospital B without a signed consent in place. Just from my experience, two unaffiliated hospitals would not have a system in place for employees to look at each other's records. The request would have have to gone through someone at the hospital where your son was treated.

It's absolutely, easily possible. Some medical information systems are multi-entity, meaning that more than one hospital/institution shares the same database. It's the hospital's choice whether or how they restrict personnel at one hospital from accessing patient info at another hospital in the system. So it's entirely possible that ER Mom has an account that will let her access patient data for more than one hospital. Or who knows, maybe she picks up per diem shifts at the other hospital once a month and has an account there for that reason.

If she actually did this, you're right, it's a HIPAA violation, and an serious one. At the hospitals i worked at, this would be a firing offense. All HIS systems in use in the US should be HIPAA compliant by now, which would mean that there is a record of her accessing your son's data.

Personally, I'd report it to the hospital where your son was treated, and the hospital where ER Mom works, and let them sort it out.

[Lynne M]

Originally Posted by badblackpug

If the hospitals are not within the same system there is no way that the MD could have viewed your son's electronic records. For her to get your son's records you would have had to sign a release of information form.

That's not the case. I've worked on numerous multi-entity systems where hospitals with no affiliations share a database, and doctors have access to multiple institutions' patient data within the system. We've had unaffiliated hospitals in a community sign an agreement to share IT, because it reduces costs for both institutions.

[sookie]

Originally Posted by Tam1067

I'm seeking unbiased advice here!

My DS 15 was hit in the head at school by another student. The hit was intentional. DS was confused and could not remember details from his day, but he never lost consciousness. Because of his symptoms, we took him to the ER. They did a CT which was clear, but the ER doctor said he had a mild concussion and should not do PE for two weeks and could stay home from school for 5 days (she wrote him an absence excuse).

He returned to school the next day and took his final exams because he did not want to put them off until after the holidays, but still felt lousy for a few more days.

We and his teachers reported the incident to the school, so the guy who hit him was punished according to school policy. This incident has caused quite a bit of personal trouble for DS because a couple the kids who were his friends no longer speak to him; they blame him for the kid getting in trouble. But we are dealing with that!

Now, about a month after this incident, DS heard from another student (who knows all the kids involved) that her mother, who is an ER doctor at a different hospital and who has never treated my son, accessed his CT records and determined that it was not a "medical concussion" because the CT did not show scarring, that the doctor at that the original ER did not know what she was doing, and that my DS is a "baby."

I am upset that she was looking at his records when she had no business doing so and that she told her daughter about this as well.

Does anyone have advice about what I should do? Should I report this to the hospital? To the federal government as a HIPAA violation? Any thoughts?

Thanks.

I think that there is probably nothing going on here (just to reassure you). I think that this student got your son's goat. I am surprised that so many people are jumping on this with advice to report, report, report.

Physicians and nurses from another hospital - even in the SAME system - often have restricted access in our area. Even within a hospital they often are restricted to information on a need to know basis.

A physician from a totally different hospital would not have access to your sons CT results without your written release. They can't just call up and get them either.

I think that this is probably what happened.

1) Your son got hurt.
2) Your son returned to school.
3) This person teased your son and said the above to try to get at him.
4) How did she know what to say? The student who said this to your son probably guessed that his CT was clear. Or, more likely, he previously said that his CT was clear when he returned to school and she filled in the blanks.

More CT scans are clear than they are not clear. A lot of kids get hit during sports. Clear does NOT mean not hurt. This is a huge misconception.

I think that your accusations are going to be really - odd - when you go reporting them. But you are well within your rights to do so. It is just going to seem fishy and like you are jumping the gun. These are teenagers. They say things to dig at each other.

Like blackpug said - to release to another hospital - you have to sign a release.

And they keep records of everyone who accesses records within the same computer system.

As a provider - people don't spend all day just looking at random records of patients we are not actively taking care of. We are busy. Honestly, I don't really know the names of my daughter's fellow students beyond a select few that come to my home. That is it. I would have to have my DD spell their last names to know them for sure. If one of her fellow classmates got hit in the head - even if I knew that they got wacked - I wouldn't know the kids name or even what they looked like 5 minutes after I heard about it.

I'm too busy dealing with my own kids and own life that I would not have time to track something like this down for my own kid or family - much less a child I don't know. Physicians and nurses are so over scheduled that we do not have time to track something like this down for sheer pleasure.

I surely wouldn't talk about another persons kids with my teenage child and I can't magically read other x-rays or radiology scans at another hospital.

I'm just saying this from the view of a provider. I would be more worried if she said "my mom saw you in the hospital, and she said you were fine!!". Then I would be all over it.