Advice about HIPAA issue

[badblackpug]

If the administration asks why, the OP just has to say I'm verifying who has had access to my son's information. There doesn't need to be any additional information provided.

Okay, because they won't pressure her. Ever.

Honestly, I know how this works, like I said, in a perfect world....

... but that's not the reality.

I'm just saying, it won't be as easy and cut and dried as everyone makes it.

 

[Lorelei Lee]

Okay, because they won't pressure her. Ever.

Honestly, I know how this works, like I said, in a perfect world....

... but that's not the reality.

I'm just saying, it won't be as easy and cut and dried as everyone makes it.

If pressured, my response would be something like "I don't want to ruin a good person's reputation if my suspicions are unfounded," and I'd stick to my guns about what my rights are.

 

[badblackpug]

If pressured, my response would be something like "I don't want to ruin a good person's reputation if my suspicions are unfounded," and I'd stick to my guns about what my rights are.

I'm just being honest about how it works. She will have to sign paper work to get the records. The will pressure, they will call, they will have multiple people call. They will sound concerned and caring, like they are trying to help. There will be a big investigation and a chart audit in CYA style even if she doesn't give a reason.

I'm just preparing people for the truth that it won't just be a phone call saying "I want a record of everyone that accessed the records."

 

[okeydokey]

I'm just being honest about how it works. She will have to sign paper work to get the records. The will pressure, they will call, they will have multiple people call. They will sound concerned and caring, like they are trying to help. There will be a big investigation and a chart audit in CYA style even if she doesn't give a reason.

I'm just preparing people for the truth that it won't just be a phone call saying "I want a record of everyone that accessed the records."

How do you know that is what will happen. And so what? She is under no obligation to tell them why.

I would totally request the records, that is what the law is for.

 

[sunshinehighway]

I'm just being honest about how it works. She will have to sign paper work to get the records. The will pressure, they will call, they will have multiple people call. They will sound concerned and caring, like they are trying to help. There will be a big investigation and a chart audit in CYA style even if she doesn't give a reason.

I'm just preparing people for the truth that it won't just be a phone call saying "I want a record of everyone that accessed the records."

None of that is her problem nor should it be her concern. She has every right to find out if this happened and she shouldn't feel bad about how the hospital handles her request.

 

[ZellyB]

I'm just being honest about how it works. She will have to sign paper work to get the records. The will pressure, they will call, they will have multiple people call. They will sound concerned and caring, like they are trying to help. There will be a big investigation and a chart audit in CYA style even if she doesn't give a reason.

I'm just preparing people for the truth that it won't just be a phone call saying "I want a record of everyone that accessed the records."

That's not at all how it works in our hospital. As a PP stated, if OP wants she has the legal right to simply ask for a listing of anyone who has accessed her son's chart. Yes, she has to come in and sign for it so the hospital can make sure she is who she says she is, but that's it. So, she doesn't even have to lodge a complaint and can look for herself.

I've been involved personally in several complaints placed through our privacy officer when they are trying to determine if there was an inappropriate access. In the vast majority of cases, I'm able to determine if my staff member had reason for looking at the chart, and if appropriate I tell the Privacy Officer so and that's the end of the story. The employee never knows anything about it. The employee is only questioned if there is no clear work-related reason for them to view the chart. If this doctor never looked at the chart, the Privacy Officer can quickly determine that and it will be the end of the story.

 

[OceanAnnie]

None of that is her problem nor should it be her concern. She has every right to find out if this happened and she shouldn't feel bad about how the hospital handles her request.

ITA. The OP has every right. I would want to know if someone was larking about in my child's medical records and speaking about it. Bottom line is I would want to know. Her child's medical records are off limits to anyone that doesn't need access. If there is ANY suspicion after all her son has gone through, it should be followed up on. He's been assaulted by a peer, harassed by some girl throwing out what she knows about his records. She and her son does deserve to know if it's true. If it is, the doctor deserves whatever the HIPPA law states.

There is nothing wrong with finding out. The OP could state it was something the doctor's daughter told her son and she wanted to know the truth. If the doctor didn't do it, the daughter would get a stern talking to, if she did well then let the chips fall where they may.

I wouldn't stand by with the possibility of my child being a victim of something like that and not do a thing. He's already been assaulted and missed how many days of school. Oh no. That would be it. I would HAVE to know.

What would be wrong is to not investigate.

 

[sookie]

Op, what is the school doing for your son in this situation? It sounds like he has a terrible situation. I'd report the girl to the school guidance counselor. HIPPA violations are very serious and she should know she is jeopardizing her mom's job by repeating private information. You could request that the counselor leave you out of it, and just say it was brought to her attention that she is speaking about another student's medical condition (maybe others overheard her and/or she has spoken to others about it) and how unethical and serious it is.

What did the school do about the assault? Does your son have a plan to keep this from happening to him again? Some school counselors have the victims of assault accompanied at all times in the school. It does help to thwart further assaults. Oh, and I would file assault charges. Maybe then the boy will think twice before sucker punching your son again.

Lastly, I would want to know. As others have stated, speculation is one thing. I would want it confirmed one way or the other. Leave it open ended, stick to the facts as you know them, and ask for an investigation. Also request a follow up with you on the matter. If the doctor didn't do it, great. If she did do it, it's out of your hands. Hospitals have protocols for this. The doctor of all people, knows it.

Good luck. It sounds like your son has really been through it.

I would go down this route.
I wonder if your son talked about his condition since it came up a month later. Most of the kids I know walk out of the ER knowing what happened to them - if they have concussion or not, how their CT was, and what their instructions are. If they are in sports - we are VERY clear to them that even if they have a clear CT that they cannot play until they are cleared by their PCP. And that they will be out of sports for several weeks and school for several days.
This ticks them off royally. They do not understand why they cannot play (sports especially) with a "clear CT". The mothers, fathers, and the sons will almost always ask us multiple times why they cannot play with a clear CT even if they have a pounding, screaming headache - they want to play sports.
Anyway - I don't want to get off track but we will always talk to them about their results. So it is possible that concerned teens talked to your son about his test results - by way of asking how he felt. They probably wanted to check on him. Maybe he told other kids about his test results. Maybe word got around he had a "clear CT" or whatever and then he turned around and got teased about it.
Maybe a situation like that could have been what was leading to the current situation. Then this girl tried to lend credence to her gossip by saying "my mom is a doctor!"
I would report it to the school, not the hospital. Start there and then move forward.

 

[Disney Doll]

Yes she can also decide to get an attorney and sue op for defamation of character (just taking it to an extreme)

Remember folks the daughter can easily say, "I never said any thing at all". Why should ER mom believe some random 16, 17 year old over any other.

Folks lets remember op did not directly hear this. she is getting this 2nd, 3rd possible 4th hand.

Her son told her, not to say he is lying but he too might be ramping this up, after all he is not totally unemotionally involved. On top of that he has said he really does not talk to this girl.

How is he going to prove to ER mom that her daughter is spreading a rumor?

Everyone here is automatically assuming that this "girl" definitely said what supposedly she said. with absolutely no proof.

Call me crazy but if you come to me accusing my son of starting a rumor you'd better have some thing more than, "well sally said, that john said that billy told him".... which is all op has.

It's simple. The OP calls the privacy officer and says "I'd like a list of every person who electronically accessed my son's medical record". The Privacy Officer provides this information. If the ER MD mom's name is on the list, there is the answer. The electronic footprint does not lie.

The OP can then decide which steps she wants to take next, if any. She can then file a formal complaint again the ER MD mom or she can choose to speak to her directly.

I would urge the OP not to make any kind of statement/accusation until she has the facts... ie-the report from the Privacy Officer listing who electornically accessed the medical record.

It's hard to sue someone for defamation of character when they can actually prove that you did what they said you did.

 

[badblackpug]

How do you know that is what will happen. And so what? She is under no obligation to tell them why.


I would totally request the records, that is what the law is for.

Been there, done that. Some people don't respond well to pressure tactics. I'm just letting you all know that it isn't always "just that easy."

None of that is her problem nor should it be her concern. She has every right to find out if this happened and she shouldn't feel bad about how the hospital handles her request.

I agree, I'm just telling people that it isn't always, again, "just that easy." Hospital administration is very in tune and very worried about the possibility of a law suit. They will go to any end to head one off. Again, been there, done that.

Also, the OP's son is having backlash at school for just this kid getting in trouble, just imagine if he is now the kid that is trying to get Suzy's mom fired. I wouldn't go accusing unless I thought the probability was high that it was true.

That's not at all how it works in our hospital. As a PP stated, if OP wants she has the legal right to simply ask for a listing of anyone who has accessed her son's chart. Yes, she has to come in and sign for it so the hospital can make sure she is who she says she is, but that's it. So, she doesn't even have to lodge a complaint and can look for herself.

I've been involved personally in several complaints placed through our privacy officer when they are trying to determine if there was an inappropriate access. In the vast majority of cases, I'm able to determine if my staff member had reason for looking at the chart, and if appropriate I tell the Privacy Officer so and that's the end of the story. The employee never knows anything about it. The employee is only questioned if there is no clear work-related reason for them to view the chart. If this doctor never looked at the chart, the Privacy Officer can quickly determine that and it will be the end of the story.

This may be how you handle it, or how your institution handles it, but this is not how it is handled in all institutions. Where I work, as soon as there is ANY complaint every single person that had ANY involvement with the patient is questioned.

 

[Disney Doll]

Okay, because they won't pressure her. Ever.

Honestly, I know how this works, like I said, in a perfect world....

... but that's not the reality.

I'm just saying, it won't be as easy and cut and dried as everyone makes it.

Actually, working in a hospital IT setting, it will be that cut & dried. I've seen it happen.

Person A requests a list of who accessed their medical record electronically, The Privacy Officer may ask "why do you want to know?" to which the requestor can respond "I'd just like to see who accessed the medical record". The Privacy Officer cannot refuse to provide the information because the requestor is not giving a reason why. The Privacy Officer should provide the list with the caveat "if you have any concerns that privacy issues have been violated, please contact me". The OP doesn't even have to say "I want to know if Dr. ER/Mom looked at the record". All she has to say is "I want to see who accessed my son's record".

 

[Disney Doll]

This may be how you handle it, or how your institution handles it, but this is not how it is handled in all institutions. Where I work, as soon as there is ANY complaint every single person that had ANY involvement with the patient is questioned.

Well, if those being questioned did nothing wrong, then they will have nothing to worry about, now will they?

Using your example, the ER MD Mom shouldn't even be questioned because she would not have accessed the chart since she had no direct care relationship with the patient. Therefore, she wouldn't even know an investigation was happening. If she did access the chart, then she should be questioned.

 

[okeydokey]

Been there, done that. Some people don't respond well to pressure tactics. I'm just letting you all know that it isn't always "just that easy."



I agree, I'm just telling people that it isn't always, again, "just that easy." Hospital administration is very in tune and very worried about the possibility of a law suit. They will go to any end to head one off. Again, been there, done that.

Also, the OP's son is having backlash at school for just this kid getting in trouble, just imagine if he is now the kid that is trying to get Suzy's mom fired. I wouldn't go accusing unless I thought the probability was high that it was true.


This may be how you handle it, or how your institution handles it, but this is not how it is handled in all institutions. Where I work, as soon as there is ANY complaint every single person that had ANY involvement with the patient is questioned.

Any institution that has multiple people call to harass the person filing for the information is one that needs to be investigated and at the very least a retraining of staff and admin is in order. I do not believe that your scenario is true in most or even many cases, as these kinds of violations can cause the institution lots of problems. I am not buying it.

And even if it were true, it certainly wouldn't chase me off if I wanted that information. That hospital would have even a bigger problem on their hands if they tried to bully me into dropping my request.

 

[badblackpug]

I do hope you all realize that different places do operate differently, some are more employee friendly than others. It's just a fact of life. ...and yes, theoretically, if you didn't do anything wrong, then, no, you shouldn't have anything to worry about, but there is still the stress of being involved in an investigation.

...and yes, my last employer, would, and did, have people who would contact you at home. It would not be an inquisition, but they would, definitely, try to worm whatever info they could out of you. They would be very polite, act very concerned, but they would still do it, because they are very, very worried about being sued. This is also an institution that will send anyone who complains about any petty thing a Target or Wawa gift card. Yes, even if you complain the blanket left lint on your black pants, or you didn't like the choice of television programming in the lobby (which, BTW, was CNN)

I am just of the mindset that jobs are hard to come by, and that before I would jeopardize someone's professional reputation I would be darn sure that there was a basis to do so.

Not to mention I have no desire to feed into, or be involved with, high school drama. Trust me, if all those kids that have dropped the OP's son as a friend, or who are already harassing him get wind of this, it will be worse. That would be especially a shame if it was all over nothing.

I would approach the mother first.

 

[MrsToad]

Any institution that has multiple people call to harass the person filing for the information is one that needs to be investigated and at the very least a retraining of staff and admin is in order. I do not believe that your scenario is true in most or even many cases, as these kinds of violations can cause the institution lots of problems. I am not buying it.

And even if it were true, it certainly wouldn't chase me off if I wanted that information. That hospital would have even a bigger problem on their hands if they tried to bully me into dropping my request.

I agree. This is one of the reasons we, as patients, need to understand our rights. Should any facility choose not to release the information to a patient, or try to stonewall the patient until questions are answered, that entity faces HEAVY fines unless there were legal reasons not to release said information (such as in certain mental illness or other scenarios). All a patient would have to do if denied this type of information is state that they will be filing a complaint with the OCR.

Edit: Actually, now that I think about it, I am wondering - the disclosure accounting rules would apply if the information was being disclosed outside the original facility, but I am not as sure whether the hospital would have to tell the patient each employee who accessed the information, though they do, indeed, have to log that information internally. I want to look that up.

 

[badblackpug]

Any institution that has multiple people call to harass the person filing for the information is one that needs to be investigated and at the very least a retraining of staff and admin is in order. I do not believe that your scenario is true in most or even many cases, as these kinds of violations can cause the institution lots of problems. I am not buying it.

And even if it were true, it certainly wouldn't chase me off if I wanted that information. That hospital would have even a bigger problem on their hands if they tried to bully me into dropping my request.

...and, yes, it is true. If you file ANY complaint, the nurse manager of the department will call you, or email, or whatever your preferred method of contact is. It moves up the chain from there if they feel they haven't resolved the situation. It isn't harassing. They call with "concern." "We are concerned about...." "We want to make sure you are not upset about..." "We wanted to discuss and make sure XXX is resolved..." "We want to know if there is anything we can do about..."

It happens every day. They read the Press-Gainey survey results, and they contact from there. Someone comes in and says, "My son was a patient in XXX department, and I would like his records to see accessed his chart." It will go right to the manager who would contact you, "making sure there is nothing we can do to help..." and it might move up from there.

It may not be the way you, or your job handles things, but, trust me, been there, done that, it happens.

 

[badblackpug]

I agree. This is one of the reasons we, as patients, need to understand our rights. Should any facility choose not to release the information to a patient, or try to stonewall the patient until questions are answered, that entity faces HEAVY fines unless there were legal reasons not to release said information (such as in certain mental illness or other scenarios). All a patient would have to do if denied this type of information is state that they will be filing a complaint with the OCR.

Sorry for the multiple answers. They don't try to stonewall, you will get whatever info you ask for, with ease, but they will want more info, and they will try to very nicely worm it out of you so they can launch their own internal investigation to attempt to head off any law suits.

 

[DebbieB]

I was at the gyn earlier this week and while I was waiting in the exam room, I heard a discussion about someone's pap & hpv test coming from the hallway! I don't know if it was a nurse and the doctor or what but they said the woman's name! There wasn't anything bad, I think she said both were negative and was questioning when they need to be repeated. But I was thinking HIPPA violation.

 

[ccgirl]

I'm seeking unbiased advice here!

My DS 15 was hit in the head at school by another student. The hit was intentional. DS was confused and could not remember details from his day, but he never lost consciousness. Because of his symptoms, we took him to the ER. They did a CT which was clear, but the ER doctor said he had a mild concussion and should not do PE for two weeks and could stay home from school for 5 days (she wrote him an absence excuse).

He returned to school the next day and took his final exams because he did not want to put them off until after the holidays, but still felt lousy for a few more days.

We and his teachers reported the incident to the school, so the guy who hit him was punished according to school policy. This incident has caused quite a bit of personal trouble for DS because a couple the kids who were his friends no longer speak to him; they blame him for the kid getting in trouble. But we are dealing with that!

Now, about a month after this incident, DS heard from another student (who knows all the kids involved) that her mother, who is an ER doctor at a different hospital and who has never treated my son, accessed his CT records and determined that it was not a "medical concussion" because the CT did not show scarring, that the doctor at that the original ER did not know what she was doing, and that my DS is a "baby."

I am upset that she was looking at his records when she had no business doing so and that she told her daughter about this as well.

Does anyone have advice about what I should do? Should I report this to the hospital? To the federal government as a HIPAA violation? Any thoughts?

Thanks.

Haven't read all of the replies but I used to work in Hospital IT and this would be a HUGE violation. Having said that, unless the hospitals are connected in some way, I am not sure how she would have accessed his records. You can call the hospital your son was treated in and say it has been brought to your attention that an authorized person accessed your son's medical records and you would like to have his medical records audited. We got these requests all the time. We could pull a report of all users who accessed a particular record and if they had no reason to access my hospital had a policy of immediate termination and, sadly, it happened on more than one occasion. If it was a nurse or doctor that worked on the department, in this case the ER, we would not question that person at all. However, if it was a user from another department, or another facility (other than the Primary Care doctor) we would begin an investigation.

It may just all be rumors so I would not give her name. It could be her son spreading rumors not realizing the ramifications to his mother.

Good luck.

 

[aristocatz]

As a medical professional, I think you should make a written statement and formal complaint to BOTH hospitals. I would simply state the facts, who said what, and that you feel there may be a violation of your privacy.

That said, I don't assume the mom, MD is guilty of anything. The daughter may be making stuff up! But that is why it is up to each hospital to investigate and determine if a violation is made. If it is via computer, there are trails left for such a case, and they will know which physician looked at your son's record and where.

It is a federal mandate that all ER's be able to share info, so it is possible these 2 separate hospitals have their systems in place already.

Follow up with the hospitals, and if a violation was made and you feel it is appropriate, complain to the Federal government, AMA, even the hospital's accreditation board. It is unprofessional conduct if from the mother and should at least be investigated, if no legal action taken. And if it is that the daughter is spreading such rumors, mom needs to know about it and have a lonnnng talk with the daughter.

I 100% agree. Report it and let the investigators decide if it is worth taking action. I work in the field of behavioral health & a violation like that is a very serious issue.