Mercy Health Case Study

Disclosing confidential patient information without patient consent can happen in the health care field quite often and is the basis for many cases brought against health care facilities. There are many ways confidential information gets into the wrong hands and this paper explores some of those ways and how that can be prevented.

In the health care business, there are certain standards and laws that have been put in place to protect our patients and their personal health information. When a health care facility fails to protect their patient’s confidential information, the US Government may get involved and facilities may be forced to pay huge sums of money in fines, and risk damaging their reputation.

Safeguard all confidential patient information to include, but not limited to, personal, health, financial, genetic, and outcome information. Chis should have never agreed to let the attorney who subpoenaed the records view the records because now the attorney has more information to use against the other person. Chris should have explained to the attorney that she could not let him/her view the records for it was a violation of privacy.

There are many problems that could arise from a patient’s information landing into the hands of a stranger, a boss, an enemy, or any other individual that does not have permission to view that information.

In order to minimize the risks for potential privacy breaches, the health information management (HIM) director has to understand all facets of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). This should include conducting an audit of their practices. In this scenario, an audit would have been useful to detect the improper access by the employee sooner. HIPAA uses both its privacy and security regulations to “protect consumer’s health information, allow consumers greater access and control to such information, enhance health care, and finally to create a national framework for health care privacy protection” (Amaguin, n.d.). These privacy and security regulations serve as the “only national set of regulations that governs

The significance of patient privacy and the security of confidential information are increasingly vital given the approval of electronic health records. Healthcare providers have recognized striking prices due to security threats and subsequent breaches. According to U.S. Department of Health and Human Services (2002), under the Privacy Rule healthcare establishments must establish protections that establish procedures and rules that guarantee least levels of privacy in relation to patient information. When violations are recognized, it is required that a compliant be created by the individual or unit experiencing the violation. In the complaint, the name of the person who participated in the violation, in addition to the nature of the violation, must be comprehensive. The filing of the complaint initiates an investigation by the Secretary of the U.S. Department of Health and Human Services under HIPAA values (U.S. Department of Health and Human Services, 2013). The establishment of a procedure related to privacy violations has resulted in many cases relating to electronic data breaches. Next is a consideration of two such cases to demonstrate the role of privacy in regards to HIPAA and electronic health database breaches.

A breach is usually described as “an impermissible use (or disclosure) under the Privacy Rule that compromises the security or privacy of protected health information.” There are three exceptions to the definition of “breach.” The first exception applies to the unintentional acquisition, access, or use of protected health information by a workforce member. This can also apply to a person acting under the authority of a covered entity or business associate. If such acquisition, access, or use was made in good faith and within the scope of authority, it qualifies as an exception. The second exception applies to the inadvertent disclosure of protected health information by a person authorized to access protected health information at a covered entity or business associate to another person authorized to access protected health information at the covered entity or business associate, or organized health care arrangement in which the covered entity participates. In both cases, the information cannot be further used or

Last week it was reported that 500 patient records had been compromised. Our IT Security department has done an extensive audit and concluded that there are many issues with our security system regarding the protection of our patient’s privacy. Outlined below are some issues that were found and how they are going to be addressed going forward.

Patient privacy is imperative and it is needed to comply with The Health Insurance Portability and Accountability Act (HIPAA) If patient information is visible or accessible the information could be stolen. During the audit multiple floors were inspected and no patient data was found on copy machines, printers or easy access areas.

Once a patient creates a physician-patient relationship the patient has given his/her doctor the implied consent to be treated by that doctor. Now as the medical assistant one of our various task is to inform the patient of the doctor’s notice of privacy, these are the papers you have to read and sign to state that you understand the information, before seeing their new physician. In those papers, which most people sign without reading, tell you how your personal and private information will be used and divulged, how your information will be protected by the healthcare workers, and what you, the patient, can do if you feel that your private health information has been breached. (Association) Most if not all of these codes fall under one law, one very important law that any healthcare related worker would get fired if they violated the patients notice of privacy practice documents each patient signs.

Robin R. Nelson, MSA, patient relations manager, privacy officer, and recipient rights director is responsible for monitoring and assuring the facilities compliance with regulations pertaining to the privacy of patient records. Robin has a bachelor’s degree in Health Administration; a master’s in Public Health Administration and holds a registration in social work. She had originally intended to work in substance abuse, counseling, education, however according to her “it wasn’t a right fit” so transferred over to long-term care and worked as a an admissions manager. It was there, she established her relationship with MidMichigan health. When the patient relations director retired, she applied and got the job and has been working for MidMichigan Health since.

This presentation represents the role of Human Resource Management under HIPAA Privacy Law/PHI (Protected Health Information). Group 3 decided to do a skit based on a situation of an employee is out for a medical issue and it being discussed amongst the Supervisor and staff. This will demonstrate, as stated in the instructions, how these concepts are applied in an actual situation. You would be able to assess the problem in the presentation and consider a solution to the problem.

There are a number ethical implication that Thrive Healthcare is faced with and must take into consideration when implementing new work flows, process, and standard practices. The largest ethical dilemma it faces it the proper handling of patients and members personal and medical information. Committed to operating under integrity, Thrive Healthcare take special precaution to ensure that they adhere to Protected Health Information (PHI) and Health Insurance Portability and Accountability (HIPAA) laws and guidelines. HIPAA laws were established in 1996, which obligated the Security of the U.S Department of Health and Human Services (HHS) to create regulations that protect the privacy and the security of particular health information (HSS, n.d). This is embedded in the culture and business practices of the organization, it is the expressed expectation and apart of annual compliance training as a condition of employment. This is to ensure that every employee across the continuum knows and understands how to handle PHI and HIPAA.

The first thing that happens is determining who got protected health information they should not have had and how much information was exposed. Sometimes, sending a letter to the wrong address does not expose enough information to be considered a breach. In such cases, sometimes a letter of concern is sent advising the customer of the incident and also assuring them no problems are

The department of Health and Human Services protects and guides the health and well being of individuals here in America (Thacker, 2014). They fulfill these duties providing Americans with adequate and efficient health and human services and monitoring services designed to increase the efficiency of care in the health system (Thacker, 2014). One of the services being monitored by the department of Health and Human Services is the electronic health record system, which carries private and vital information of patient’s health record enabling all eligible participating health workers access to these records (Thacker, 2014). A breach of the protective health information of patients in a health organization creates chaos as these are against the health insurance portability and accountability (HIPAA) law (Thacker, 2014). Hence, measure will have to be put in place to determine what caused the breach and how to rectify it to ensure the breach never happens again (Thacker, 2014).