Ms. Reeves PHI Case Study

For this week’s discussion I have read the article assigned this week regarding HIPAA violations. I will summarize the case against the physician and what the HIPAA law states. I will also discuss what the penalties are for a HIPAA violation and if this physician could have faced further charges.

The purpose of this study was to prove that HIPAA protects individuals against the unfair reveal of their health information.

Our case assignment clearly shows that Dr. Williams acted unethically and violated HIPAA by showing his patient’s health record while seeking advice from a friend. His violation was specifically indentified in the Privacy Rule, which protects PHI “held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral” (Office for Civil Rights, Privacy Brief, 2003). Whether Dr. Williams is a covered entity or a business associate with a contract is unclear but we can be sure that electronic health care transactions occur in his clinic subjecting him to the Privacy Rule along with other federal statutes and regulations.

HIPPA is a government act signed into law to ensure portability of insurance between jobs, and to safeguard patient information confidentiality in an effort to protect patients and reduce healthcare fraud and abuse. Protected Health Information (PHI) includes anything “personally identifiable” within a patient’s healthcare information, the unregulated sharing of which can cause unwanted complications within a patient’s life, including but not limited to, emotional distress and discrimination by others. HIPPA is intended to regulate the release of PHI by focusing on three major focus areas in the healthcare workforce.

Since the adoption of the Health Insurance Portability and Accountability Act (HIPAA) of 1996, there had been some modifications and interpretations made to its provisions to ensure that the requirements of the law are strictly adhered to. Thus, the “two sets of federal regulations were implemented… the Privacy Rule and the Security Rule” (McGonigle & Mastrian, 2015, p. 157). Briefly, the Privacy Rule addresses the limited use and disclosure of patients’ health information, while the Security Rule refers to the need to safeguard “patients’ health information from improper use or disclosure” (McGonigle & Mastrian, 2015, p. 157). The case scenario discussed in this paper relates to the Privacy Rule and Security Rule of HIPAA.

Exploiting patients is also discussed and can be called into question. When presenting examples or discussing patient’s certain information should never be disclosed due to HIPPA laws as well as confidentiality.

The importance of protecting patient’s health information is not something that can be taken lightly. As employees in the healthcare field, we are given the responsibility of protecting patient information. HIPAA has given us rules and procedures to follow that make protecting this highly classified and vital information easy, if those rules and procedures are followed to the letter. When an employee does not follow the procedures that have been given to them, they are in clear violation of these rules and should be punished.

Release of Information in healthcare is critical to the quality of continuing the care provided to patients. It plays an important role in billing, reporting, research and other functions. The HIPAA privacy rule has specific rules for the management of health information to ensure confidentiality of each individual. The rule will balance the need for prompt and informed delivery of health care services with that of protecting the individual. There are no standard uniform state privacy law in use of all 50 states, yet the territories. State laws focus on for example HIV generic information as well as a degree of strictness or protectiveness of patient privacy. Some states need that additional patient authorization be obtained prior to release, but some states do not. The law required that healthcare organizations develop, implement and maintain policies, processes and procedures around release of information. Overall management of those HIM processes that shows the fundamental to confidentiality, security and compliance in releasing protected health information. It is important that the organization 's policies and procedures include the management practices that support the process of disclosure and it 's oversight.

Security: - which states that Protected Health Information (PHI) should not be distributed without patient authorization, unless there is a clear basis for doing so, and the individuals who receive the information must safeguard it.

The HIPAA Security and Privacy Rules mandate that healthcare providers and organizations and their respective business associates abide by HIPAA rules when they create and follow procedures that must be transmitted, obtained, handled, or shared. In addition, during these processes, the confidentiality and security of all protected health information (PHI) must be achieved and maintained (Hernandez, 2015). Moreover, there are instances when PHI can and cannot be disclosed. Stanford (n.d) differentiates between information that is “shared” and “disclosed.” Shared applies to PHI utilized within the covered entity; whereas, “disclosed” pertains to PHI shared outside of the covered entity (Stanford,

There are a number ethical implication that Thrive Healthcare is faced with and must take into consideration when implementing new work flows, process, and standard practices. The largest ethical dilemma it faces it the proper handling of patients and members personal and medical information. Committed to operating under integrity, Thrive Healthcare take special precaution to ensure that they adhere to Protected Health Information (PHI) and Health Insurance Portability and Accountability (HIPAA) laws and guidelines. HIPAA laws were established in 1996, which obligated the Security of the U.S Department of Health and Human Services (HHS) to create regulations that protect the privacy and the security of particular health information (HSS, n.d). This is embedded in the culture and business practices of the organization, it is the expressed expectation and apart of annual compliance training as a condition of employment. This is to ensure that every employee across the continuum knows and understands how to handle PHI and HIPAA.

Misappropriation of PHI involves staff of the health facilities or any other person that is not authorized to have the health information of another. For that the penalties according to the US Department of Justice are; a penalty of up to fifty thousand dollars and incarceration of up to one year for those who knowingly obtain and disclose PHI of another person.

The Department of Health and Human Services (HHS) indicates that HIPAA violations have been generally increasing throughout the years. Now that electronically maintained patient information exists, it has become increasingly difficult to limit information sharing in a manner that guarantees usage for its intended genesis. Personal information travels across several channels, to include healthcare providers, third party payers, and other business associates. Few controls exist to regulate how this information is maintained, or disseminated. If state law or local legislation does not forbid accessing patient health records or sharing patient information, any information held by a provider or business associate could be passed

Any HIPPA covered entity should be extremely knowledgeable about HIPPA regulations. Any potential and even harmless disclosure of a patient’s protected health information can leave a physician susceptible to several criminal and civil penalties. A breach or violation of HIPAA occurs when a healthcare provider impermissibly uses or discloses information that compromises the security or privacy of the “protected health information”. In order to compete in the market without being liable for sanctions, a healthcare provider must have a thorough understanding of how to properly run a business without violating HIPAA.

Regulations are established to expand the effectiveness and efficacy of the healthcare organization. One of biggest health care issue among the system is Health Insurance Portability and Accountability Act (HIPAA) violations. It was passed by the Congress in 1996. Mandating this rule serves several purposes to all individuals for privacy and security. This includes all information that is verbal, written, or electronic. The Privacy Rule is the protection health information (PHI) of a patient and it cannot be disclosed without patient’s written authorization (Schulman, 2005). The Security Rule is emphasized on administrative, technical and physical safeguards specifically for electronic protection health information from unapproved access (Schulman, 2005).