Advice about HIPAA issue

[Caropooh]

The privacy is to protect the patient, it is not to protect the staff.

Exactly, I understand that. That's why I asked if they the hospital would even release information to the mother. Her son is between 13 and 18, which is the age our doctors practice does allow the online access for us. They still have the electronic records in the practice for DD though.

 

[chloelovesdisney]

Exactly, I understand that. That's why I asked if they the hospital would even release information to the mother. Her son is between 13 and 18, which is the age our doctors practice does allow the online access for us. They still have the electronic records in the practice for DD though.

They aren't giving her medical information and they would likely just give it to her, but if not, her son just needs to sign a form to give the okay.

 

[JusbKoz]

Like I said prior this Mother/ doctor could of see easily seen your sons ct report with out it ever being "on record" so getting access to see who looked at his records may not give you the whole truth.
There are numerous ways to do this and by what you said about how this mother/doctor said it "wasn't a medical concussion" sounds like this mother/doctor looked at your sons ct report only and not the physical exam report the er doctor did on your son to get the mild concussion diagnosis.
I will second the idea a previous poster about going to the schools counselor for your son. Then I would talk/report this to some one at the hospital your son went to and not the hospital this mother/doctor works at.

 

[dbrn]

I think the best way to handle it would be to let the Privacy Officer handle it - give him/her all the information about why you suspect there was a breach, who you think committed the breach, and what was said. That's the best way for the Privacy Officer to determine what happened. That individual is not going to gossip to others about the concern, and the doctor won't be notified unless it's necessary to delve further into the investigation beyond an audit report. If you don't tell him/her the concern, you limit what he/she can do to help you. There will be no stigma for the doctor if she did nothing wrong; she'll probably never know about it. If she did, there are consequences that she's already well aware of.

It is crazy to think that someone would risk so much to look at a patient's record, but there are a lot of individuals who have been fired, sued, fined thousands of dollars, and even jailed for what amounts to curiosity and snooping.

 

[luvmy3]

I still seriously doubt it happened, but if you do find out it isn't true, I would contact the mother. Very likely, she doesn't know her daughter said this, and very likely, the daughter doesn't understand HIPAA or realize how damaging something like this could be to her mother's reputation. The mother should, at least, have the opportunity to have a dialogue with her daughter about spouting off at the mouth.
The mother shouldn't be punished for her daughter doing something that is very typical of dramatic teen girls, that she, probably, had no knowledge of.

Wait, you seriously think that if the OP finds out the dr. mom did look at her ds' records she should contact the dr. mom so she can have a talk with her own dd about ruining her rep? If that is what you are saying, then the Dr. mom should have known in the first place to 1) not look at the OP's ds' record and 2) not to say anything about them to her dd. Why should the OP concern herself with those people and the dialogue they should be allowed to have?

OP, contact the hospital. You have the legal right to see who accessed those records. If it turns out that the dr mom did, you requesting those records will not be the cause of anything that happens to her for accessing them. Good luck

 

[Jennasis]

Wait, you seriously think that if the OP finds out the dr. mom did look at her ds' records she should contact the dr. mom so she can have a talk with her own dd about ruining her rep? If that is what you are saying, then the Dr. mom should have known in the first place to 1) not look at the OP's ds' record and 2) not to say anything about them to her dd. Why should the OP concern herself with those people and the dialogue they should be allowed to have?

OP, contact the hospital. You have the legal right to see who accessed those records. If it turns out that the dr mom did, you requesting those records will not be the cause of anything that happens to her for accessing them. Good luck

No. Pug said the OP should contact Dr. mom if she finds out the doc DID NOT access her son's record.

 

[OceanAnnie]

No. Pug said the OP should contact Dr. mom if she finds out the doc DID NOT access her son's record.

I understand why Pug said it. But I would let the school guidance counselor handle it. No reason for the OP to insert herself. It could get really ugly, real quick --- like kill the messenger type thing. The guidance counselor knows how to handle it and there would be a level of decorum built in so to speak.

 

[luvmy3]

No. Pug said the OP should contact Dr. mom if she finds out the doc DID NOT access her son's record.

Thank you. I was wondering what the heck she was thinking for saying the OP should contact the mom.

Sorry, Pug I misread your post.

 

[DisneyATlast]

I don't see anything "stupid" about a mother contacting another mother to try to resolve a problem (that may or may not even be a problem) before involving everybody and their brother. Everyone has a right to their own opinion.

I think the majority of people in general are a little naive when it comes to HIPAA though. Everyone is making something that is very complex seem so cut and dried. It's not. Just because you didn't meet a person and shake their hand doesn't mean that they were not "involved in your care" or that they don't have the right to access your record.

Who's to say that an MD from hospital ABC didn't request that an MD (mom?) at hospital XYZ look at the CT and collaborate about the findings? The "minimum extent necessary" and all those other phrases you'll find throughout HIPAA are determined by the providers, not the patients. Everyone seeking medical care signs papers that say just that.

So, even if the mom's name is on this list that everyone thinks is going to be a piece of cake to obtain, that doesn't automatically mean that she violated HIPAA. Assuming that the mom did access the record and had a reason to do so, it would be nearly impossible to prove that she said anything to her daughter. Thankfully, people can't lose their jobs because Bobby's mom said that Suzy's mom did such and such.

More than one person would have to be involved in MD mom's ability to obtain records that she shouldn't have access to. She couldn't just go and pull up the record from another hospital on her own without any help. Help being someone at the other hospital giving her access, and I just don't believe this high school rumor is really the conspiracy that it would have to be for this story to be true. It'll be interesting to see what the outcome is either way.

 

[Disney Doll]

I haven't seen this addressed any where yet. Does the HIPPA law even allow the OP to see who has viewed her son's records? I know that with our doctors office (multi doctor/office health care system) we have an online system where we can make appts, check test results, leave messages for doctor, request prescription refills, etc. My DD13's acct was disabled once she turned 13 due to HIPPA. Once she turns 18, she can have an acct again. Trust me I went round and round with them on it, it's crazy. It's all due to privacy.

Well then the request can from the OP's son. It's his record.

 

[dbrn]

I don't see anything "stupid" about a mother contacting another mother to try to resolve a problem (that may or may not even be a problem) before involving everybody and their brother. Everyone has a right to their own opinion.

I think the majority of people in general are a little naive when it comes to HIPAA though. Everyone is making something that is very complex seem so cut and dried. It's not. Just because you didn't meet a person and shake their hand doesn't mean that they were not "involved in your care" or that they don't have the right to access your record.

Who's to say that an MD from hospital ABC didn't request that an MD (mom?) at hospital XYZ look at the CT and collaborate about the findings? The "minimum extent necessary" and all those other phrases you'll find throughout HIPAA are determined by the providers, not the patients. Everyone seeking medical care signs papers that say just that.

So, even if the mom's name is on this list that everyone thinks is going to be a piece of cake to obtain, that doesn't automatically mean that she violated HIPAA. Assuming that the mom did access the record and had a reason to do so, it would be nearly impossible to prove that she said anything to her daughter. Thankfully, people can't lose their jobs because Bobby's mom said that Suzy's mom did such and such.

More than one person would have to be involved in MD mom's ability to obtain records that she shouldn't have access to. She couldn't just go and pull up the record from another hospital on her own without any help. Help being someone at the other hospital giving her access, and I just don't believe this high school rumor is really the conspiracy that it would have to be for this story to be true. It'll be interesting to see what the outcome is either way.

This is exactly why I recommend telling the privacy officer exactly what the concern is so that the concern can be investigated fully, not just relying on an audit trail list as interpreted by a layperson. The privacy officer will conduct the investigation thoroughly, taking the audit trail and any other supporting information into account, and no one will get in trouble if nothing was done wrong.

Even if the doc had good reason to look at the record, it would still be inappropriate to pass that information along to her daughter.

 

[DisneyATlast]

Sorry, I don't get this. What good does calling the mom do? If she says "yes, I looked and told my DD", shouldn't she be punished? If she says "no, I didn't look", you don't know if she's lying or not.

As I said, if she's not satisfied after talking with mom then the record is still going to be there. What is there to LOSE by talking to the mom directly?

Some people are good at reading other people's reactions, tone of voice, etc. If the MD mom is shocked and has no idea who this person is contacting her then that would be a good sign (to me anyway) that it isn't true and not worth dragging everyone (including the child/victim) through the mud.

 

[zurgswife]

I don't see anything "stupid" about a mother contacting another mother to try to resolve a problem (that may or may not even be a problem) before involving everybody and their brother. Everyone has a right to their own opinion.

I think the majority of people in general are a little naive when it comes to HIPAA though. Everyone is making something that is very complex seem so cut and dried. It's not. Just because you didn't meet a person and shake their hand doesn't mean that they were not "involved in your care" or that they don't have the right to access your record.

Who's to say that an MD from hospital ABC didn't request that an MD (mom?) at hospital XYZ look at the CT and collaborate about the findings? The "minimum extent necessary" and all those other phrases you'll find throughout HIPAA are determined by the providers, not the patients. Everyone seeking medical care signs papers that say just that.

So, even if the mom's name is on this list that everyone thinks is going to be a piece of cake to obtain, that doesn't automatically mean that she violated HIPAA. Assuming that the mom did access the record and had a reason to do so, it would be nearly impossible to prove that she said anything to her daughter. Thankfully, people can't lose their jobs because Bobby's mom said that Suzy's mom did such and such.

More than one person would have to be involved in MD mom's ability to obtain records that she shouldn't have access to. She couldn't just go and pull up the record from another hospital on her own without any help. Help being someone at the other hospital giving her access, and I just don't believe this high school rumor is really the conspiracy that it would have to be for this story to be true. It'll be interesting to see what the outcome is either way.

But if her name is on the list then it would be the job of the Privacy Officer to determine if she was legally allowed to access the records. The OP will not have to do anything but let them know she wants to know whether they had authority to access his records and why?

 

[DisneyATlast]

This is exactly why I recommend telling the privacy officer exactly what the concern is so that the concern can be investigated fully, not just relying on an audit trail list as interpreted by a layperson. The privacy officer will conduct the investigation thoroughly, taking the audit trail and any other supporting information into account, and no one will get in trouble if nothing was done wrong.

Even if the doc had good reason to look at the record, it would still be inappropriate to pass that information along to her daughter.

It would definitely be inappropriate to say the least, but proving that it happened would be difficult if not impossible to do.

 

[zurgswife]

As I said, if she's not satisfied after talking with mom then the record is still going to be there. What is there to LOSE by talking to the mom directly?

Some people are good at reading other people's reactions, tone of voice, etc. If the MD mom is shocked and has no idea who this person is contacting her then that would be a good sign (to me anyway) that it isn't true and not worth dragging everyone (including the child/victim) through the mud.

If she contacts the Privacy Officer and follows protocol nobody is being "dragged through the mud". It is all done privately and nobody is the wiser unless they find an issue.

 

[Disney Doll]

See bolded

I don't see anything "stupid" about a mother contacting another mother to try to resolve a problem (that may or may not even be a problem) before involving everybody and their brother. Everyone has a right to their own opinion.

I think the majority of people in general are a little naive when it comes to HIPAA though. Everyone is making something that is very complex seem so cut and dried. It's not. Just because you didn't meet a person and shake their hand doesn't mean that they were not "involved in your care" or that they don't have the right to access your record. True. But then the Privacy Officer would have the person explain exactly how they were involved in the patient's care. If the attending MD for the OP's DS (let's call him Dr.X) asked Dr.ER Mom to review his CT scan for some reason, then the explanation by Dr.ER Mom would be "Yes, I did review that CT scan as part of the patient's trauma work-up as requested by the patient's attending physician Dr.X". Of course then the issue becomes "so, you had legitimate access to the patient's chart and a couple of days later your DD comes to school stating to the patient that you said the patient wasn't injured"....still a problem because now someone with legitimate access to the patient's chart then violated HIPAA. Or at least her DD says she did. At the very least the DD needs to be taught how much trouble she can get her mother in by shooting her mouth off and at the very most the Dr.ER Mom needs to be reprimanded if it can, in fact, be proven that she violated HIPAA.

Who's to say that an MD from hospital ABC didn't request that an MD (mom?) at hospital XYZ look at the CT and collaborate about the findings? The "minimum extent necessary" and all those other phrases you'll find throughout HIPAA are determined by the providers, not the patients. Everyone seeking medical care signs papers that say just that. Then Dr.ER Mom would be able to explain that, as noted above.

So, even if the mom's name is on this list that everyone thinks is going to be a piece of cake to obtain, that doesn't automatically mean that she violated HIPAA. Assuming that the mom did access the record and had a reason to do so, it would be nearly impossible to prove that she said anything to her daughter. Thankfully, people can't lose their jobs because Bobby's mom said that Suzy's mom did such and such. True, but when Suzy says directly to Bobby "My Mom the ER MD said she looked at your CT scan and you didn't have a concussion", it becomes a bit more of an issue. How would Suzy know that other wise? Even if Suzy's Mom had legitimate access to the record, speakign about the contents of it is still a HIPAA violation. Like if I am taking care of a friend of my mother's, I cannot come home and say "Mom I took care of Mrs.Smith today and she has pneumonia and is on antibiotics". Actually I can't tell Mom I even took care of Mrs.Smith unless Mrs.Smith tells me it's OK.

More than one person would have to be involved in MD mom's ability to obtain records that she shouldn't have access to. She couldn't just go and pull up the record from another hospital on her own without any help. Help being someone at the other hospital giving her access, and I just don't believe this high school rumor is really the conspiracy that it would have to be for this story to be true. It'll be interesting to see what the outcome is either way. Yes it will.

 

[DisneyATlast]

But if her name is on the list then it would be the job of the Privacy Officer to determine if she was legally allowed to access the records. The OP will not have to do anything but let them know she wants to know whether they had authority to access his records and why?

Exactly, but in order for the privacy officer to do this they will have to be given a name. The majority of the responses I saw here are telling mom to just request a list of names period. That's not sufficient proof.

 

[OceanAnnie]

But if her name is on the list then it would be the job of the Privacy Officer to determine if she was legally allowed to access the records. The OP will not have to do anything but let them know she wants to know whether they had authority to access his records and why?

It's two fold. A HIPPA violation isn't just accessing the records. It's also talking about it. If the doctor did access the records it doesn't fare well with her daughter bragging about her mother's impressions of the child's medical condition.

I don't know about "proving". How would the daughter know the mother accessed the boy's chart if the mother didn't talk to her about it? That's full circle, if in fact the doctor did do it.

ETA: Sorry quoted the wrong post.

 

[Nancyg56]

It's two fold. A HIPPA violation isn't just accessing the records. It's also talking about it. If the doctor did access the records it doesn't fare well with her daughter bragging about her mother's impressions of the child's medical condition.

I don't know about "proving". How would the daughter know the mother accessed the boy's chart if the mother didn't talk to her about it? That's full circle, if in fact the doctor did do it.

ETA: Sorry quoted the wrong post.

I agree with you. I don't understand why this should not be considered a huge issue, it would be for me. My BIL was a DR before he passed away, my sister is a Resp therapist and for 6 years was a FRT, my older sister is a charge nurse in a nursing home and prior to that was an asst director in a huge nursing home. Believe me, accessing private records happens and it is not good. Records that are on the same system can be accessed electronically and if that happens the medical personnel have been known to "peek". If this happens there should be repercussions and they should be severe.

If this may have happened to any parent here, would it be okay? Would you want any information concerning your family to be accessed and then discussed with your child's peers? How about with your peers in your workplace?

I think that the OP should register a complaint with the appropriate people at the hospital her son was treated. IF the DR did access the information there would have been a reason. If the Dr shared any information with her DD she should be reprimanded. IF the DD knew the information about the OP's son the DR better have a darn good explanation.

 

[sam_gordon]

As I said, if she's not satisfied after talking with mom then the record is still going to be there. What is there to LOSE by talking to the mom directly?

Some people are good at reading other people's reactions, tone of voice, etc. If the MD mom is shocked and has no idea who this person is contacting her then that would be a good sign (to me anyway) that it isn't true and not worth dragging everyone (including the child/victim) through the mud.

The only thing I see to "lose" by talking to the mom is her possibly "circling the wagons". What I don't get is what is there to GAIN by talking to the mom?