Advice about HIPAA issue

[Disney Doll]

Originally Posted by badblackpug

Okay, because they won't pressure her. Ever.

Honestly, I know how this works, like I said, in a perfect world....

... but that's not the reality.

I'm just saying, it won't be as easy and cut and dried as everyone makes it.

Actually, working in a hospital IT setting, it will be that cut & dried. I've seen it happen.

Person A requests a list of who accessed their medical record electronically, The Privacy Officer may ask "why do you want to know?" to which the requestor can respond "I'd just like to see who accessed the medical record". The Privacy Officer cannot refuse to provide the information because the requestor is not giving a reason why. The Privacy Officer should provide the list with the caveat "if you have any concerns that privacy issues have been violated, please contact me". The OP doesn't even have to say "I want to know if Dr. ER/Mom looked at the record". All she has to say is "I want to see who accessed my son's record".

[Disney Doll]

Originally Posted by badblackpug

This may be how you handle it, or how your institution handles it, but this is not how it is handled in all institutions. Where I work, as soon as there is ANY complaint every single person that had ANY involvement with the patient is questioned.

Well, if those being questioned did nothing wrong, then they will have nothing to worry about, now will they?

Using your example, the ER MD Mom shouldn't even be questioned because she would not have accessed the chart since she had no direct care relationship with the patient. Therefore, she wouldn't even know an investigation was happening. If she did access the chart, then she should be questioned.

[okeydokey]

Originally Posted by badblackpug

Been there, done that. Some people don't respond well to pressure tactics. I'm just letting you all know that it isn't always "just that easy."



I agree, I'm just telling people that it isn't always, again, "just that easy." Hospital administration is very in tune and very worried about the possibility of a law suit. They will go to any end to head one off. Again, been there, done that.

Also, the OP's son is having backlash at school for just this kid getting in trouble, just imagine if he is now the kid that is trying to get Suzy's mom fired. I wouldn't go accusing unless I thought the probability was high that it was true.


This may be how you handle it, or how your institution handles it, but this is not how it is handled in all institutions. Where I work, as soon as there is ANY complaint every single person that had ANY involvement with the patient is questioned.

Any institution that has multiple people call to harass the person filing for the information is one that needs to be investigated and at the very least a retraining of staff and admin is in order. I do not believe that your scenario is true in most or even many cases, as these kinds of violations can cause the institution lots of problems. I am not buying it.

And even if it were true, it certainly wouldn't chase me off if I wanted that information. That hospital would have even a bigger problem on their hands if they tried to bully me into dropping my request.

[badblackpug]

I do hope you all realize that different places do operate differently, some are more employee friendly than others. It's just a fact of life. ...and yes, theoretically, if you didn't do anything wrong, then, no, you shouldn't have anything to worry about, but there is still the stress of being involved in an investigation.

...and yes, my last employer, would, and did, have people who would contact you at home. It would not be an inquisition, but they would, definitely, try to worm whatever info they could out of you. They would be very polite, act very concerned, but they would still do it, because they are very, very worried about being sued. This is also an institution that will send anyone who complains about any petty thing a Target or Wawa gift card. Yes, even if you complain the blanket left lint on your black pants, or you didn't like the choice of television programming in the lobby (which, BTW, was CNN)

I am just of the mindset that jobs are hard to come by, and that before I would jeopardize someone's professional reputation I would be darn sure that there was a basis to do so.

Not to mention I have no desire to feed into, or be involved with, high school drama. Trust me, if all those kids that have dropped the OP's son as a friend, or who are already harassing him get wind of this, it will be worse. That would be especially a shame if it was all over nothing.

I would approach the mother first.

[MrsToad]

Originally Posted by okeydokey

Any institution that has multiple people call to harass the person filing for the information is one that needs to be investigated and at the very least a retraining of staff and admin is in order. I do not believe that your scenario is true in most or even many cases, as these kinds of violations can cause the institution lots of problems. I am not buying it.

And even if it were true, it certainly wouldn't chase me off if I wanted that information. That hospital would have even a bigger problem on their hands if they tried to bully me into dropping my request.

I agree. This is one of the reasons we, as patients, need to understand our rights. Should any facility choose not to release the information to a patient, or try to stonewall the patient until questions are answered, that entity faces HEAVY fines unless there were legal reasons not to release said information (such as in certain mental illness or other scenarios). All a patient would have to do if denied this type of information is state that they will be filing a complaint with the OCR.

Edit: Actually, now that I think about it, I am wondering - the disclosure accounting rules would apply if the information was being disclosed outside the original facility, but I am not as sure whether the hospital would have to tell the patient each employee who accessed the information, though they do, indeed, have to log that information internally. I want to look that up.

[badblackpug]

Originally Posted by okeydokey

Any institution that has multiple people call to harass the person filing for the information is one that needs to be investigated and at the very least a retraining of staff and admin is in order. I do not believe that your scenario is true in most or even many cases, as these kinds of violations can cause the institution lots of problems. I am not buying it.

And even if it were true, it certainly wouldn't chase me off if I wanted that information. That hospital would have even a bigger problem on their hands if they tried to bully me into dropping my request.

...and, yes, it is true. If you file ANY complaint, the nurse manager of the department will call you, or email, or whatever your preferred method of contact is. It moves up the chain from there if they feel they haven't resolved the situation. It isn't harassing. They call with "concern." "We are concerned about...." "We want to make sure you are not upset about..." "We wanted to discuss and make sure XXX is resolved..." "We want to know if there is anything we can do about..."

It happens every day. They read the Press-Gainey survey results, and they contact from there. Someone comes in and says, "My son was a patient in XXX department, and I would like his records to see accessed his chart." It will go right to the manager who would contact you, "making sure there is nothing we can do to help..." and it might move up from there.

It may not be the way you, or your job handles things, but, trust me, been there, done that, it happens.

[badblackpug]

Originally Posted by MrsToad

I agree. This is one of the reasons we, as patients, need to understand our rights. Should any facility choose not to release the information to a patient, or try to stonewall the patient until questions are answered, that entity faces HEAVY fines unless there were legal reasons not to release said information (such as in certain mental illness or other scenarios). All a patient would have to do if denied this type of information is state that they will be filing a complaint with the OCR.

Sorry for the multiple answers. They don't try to stonewall, you will get whatever info you ask for, with ease, but they will want more info, and they will try to very nicely worm it out of you so they can launch their own internal investigation to attempt to head off any law suits.

[DebbieB]

I was at the gyn earlier this week and while I was waiting in the exam room, I heard a discussion about someone's pap & hpv test coming from the hallway! I don't know if it was a nurse and the doctor or what but they said the woman's name! There wasn't anything bad, I think she said both were negative and was questioning when they need to be repeated. But I was thinking HIPPA violation.

[ccgirl]

Originally Posted by Tam1067

I'm seeking unbiased advice here!

My DS 15 was hit in the head at school by another student. The hit was intentional. DS was confused and could not remember details from his day, but he never lost consciousness. Because of his symptoms, we took him to the ER. They did a CT which was clear, but the ER doctor said he had a mild concussion and should not do PE for two weeks and could stay home from school for 5 days (she wrote him an absence excuse).

He returned to school the next day and took his final exams because he did not want to put them off until after the holidays, but still felt lousy for a few more days.

We and his teachers reported the incident to the school, so the guy who hit him was punished according to school policy. This incident has caused quite a bit of personal trouble for DS because a couple the kids who were his friends no longer speak to him; they blame him for the kid getting in trouble. But we are dealing with that!

Now, about a month after this incident, DS heard from another student (who knows all the kids involved) that her mother, who is an ER doctor at a different hospital and who has never treated my son, accessed his CT records and determined that it was not a "medical concussion" because the CT did not show scarring, that the doctor at that the original ER did not know what she was doing, and that my DS is a "baby."

I am upset that she was looking at his records when she had no business doing so and that she told her daughter about this as well.

Does anyone have advice about what I should do? Should I report this to the hospital? To the federal government as a HIPAA violation? Any thoughts?

Thanks.

Haven't read all of the replies but I used to work in Hospital IT and this would be a HUGE violation. Having said that, unless the hospitals are connected in some way, I am not sure how she would have accessed his records. You can call the hospital your son was treated in and say it has been brought to your attention that an authorized person accessed your son's medical records and you would like to have his medical records audited. We got these requests all the time. We could pull a report of all users who accessed a particular record and if they had no reason to access my hospital had a policy of immediate termination and, sadly, it happened on more than one occasion. If it was a nurse or doctor that worked on the department, in this case the ER, we would not question that person at all. However, if it was a user from another department, or another facility (other than the Primary Care doctor) we would begin an investigation.

It may just all be rumors so I would not give her name. It could be her son spreading rumors not realizing the ramifications to his mother.

Good luck.

[aristocatz]

Originally Posted by LoriABil

As a medical professional, I think you should make a written statement and formal complaint to BOTH hospitals. I would simply state the facts, who said what, and that you feel there may be a violation of your privacy.

That said, I don't assume the mom, MD is guilty of anything. The daughter may be making stuff up! But that is why it is up to each hospital to investigate and determine if a violation is made. If it is via computer, there are trails left for such a case, and they will know which physician looked at your son's record and where.

It is a federal mandate that all ER's be able to share info, so it is possible these 2 separate hospitals have their systems in place already.

Follow up with the hospitals, and if a violation was made and you feel it is appropriate, complain to the Federal government, AMA, even the hospital's accreditation board. It is unprofessional conduct if from the mother and should at least be investigated, if no legal action taken. And if it is that the daughter is spreading such rumors, mom needs to know about it and have a lonnnng talk with the daughter.

I 100% agree. Report it and let the investigators decide if it is worth taking action. I work in the field of behavioral health & a violation like that is a very serious issue.

[chloelovesdisney]

Without having read all the pages of replies since last night, Privacy Officers are pretty good at handling requests with discretion (in my experience). If they can't do that, no one can. I've both submitted requests, and been contacted regarding possible violations by others (to confirm that they had reason to be in the record). It's always been handled in a confidential matter, and leaking the information would hold serious consequences for myself. In all but one case no wrongdoing was found, and that was the end of the matter.

[chloelovesdisney]

Originally Posted by Lorelei Lee

Yes, but if the doctor didn't do it, the gossip about it will kill her. which is why a discrete inquiry is the way to go.

I've dealth with inquiries before, there's never been ANY gossip. It's always been treated in a strictly confidential manner, as it should be. If a Privacy Officer is giving out this information to others, they need to be replaced.

[chloelovesdisney]

Originally Posted by eliza61

Yes she can also decide to get an attorney and sue op for defamation of character (just taking it to an extreme)

Remember folks the daughter can easily say, "I never said any thing at all". Why should ER mom believe some random 16, 17 year old over any other.

Folks lets remember op did not directly hear this. she is getting this 2nd, 3rd possible 4th hand.

Her son told her, not to say he is lying but he too might be ramping this up, after all he is not totally unemotionally involved. On top of that he has said he really does not talk to this girl.

How is he going to prove to ER mom that her daughter is spreading a rumor?

Everyone here is automatically assuming that this "girl" definitely said what supposedly she said. with absolutely no proof.

Call me crazy but if you come to me accusing my son of starting a rumor you'd better have some thing more than, "well sally said, that john said that billy told him".... which is all op has.

I'm not sure why you think the OP has to make an accusation. The list of those that have logged into her son's records will show her name, or it won't. There doesn't have to be an accusation, she only needs the list of who logged into the record.

[chloelovesdisney]

Originally Posted by Disney Doll

It's simple. The OP calls the privacy officer and says "I'd like a list of every person who electronically accessed my son's medical record". The Privacy Officer provides this information. If the ER MD mom's name is on the list, there is the answer. The electronic footprint does not lie.

The OP can then decide which steps she wants to take next, if any. She can then file a formal complaint again the ER MD mom or she can choose to speak to her directly.

I would urge the OP not to make any kind of statement/accusation until she has the facts... ie-the report from the Privacy Officer listing who electornically accessed the medical record.

It's hard to sue someone for defamation of character when they can actually prove that you did what they said you did.

Ditto.

[JusbKoz]

Like the previous poster I haven't read all of the post. Yes you can look at other sister systems. BUT another possibility is she could of requested copies of his cat scan (the films)and sent to her by a courier. She may of never actually seen the films but called the Radiologist group that read the films and discussed the case with them and or called and got a copy of the medical report. All this is easy to do if you are a medical personnel from any hospital. Not to long ago a bunch of medical personnel got fired over accessing medical records of some famous people.
The way the story was told it sounds like the doc did look at some kind of info on the son. If doc knows both parties involved and was a friend with the family that had hit her son I wouldnt put it pass the family to ask the doc "look" into it for them. Just in case there was a civil suit. Would the doc risk doing this and the discuss it with her daughter?? I would say Yes because I have worked with over hundreds of doctors and believe it or not they are not the angels that patients tend to hold them up to be.