No Harm No Foul Case Study

Disclosing confidential patient information without patient consent can happen in the health care field quite often and is the basis for many cases brought against health care facilities. There are many ways confidential information gets into the wrong hands and this paper explores some of those ways and how that can be prevented.

In the health care business, there are certain standards and laws that have been put in place to protect our patients and their personal health information. When a health care facility fails to protect their patient’s confidential information, the US Government may get involved and facilities may be forced to pay huge sums of money in fines, and risk damaging their reputation.

First is the privacy rule, which is meant to guard the confidentiality of all protected health information. This is defined as any information that includes the patient’s name or other identifiers, such as a birth date or medical record number. Protected health information can be data that is written, spoken, or in electronic form. The privacy rule came about because many healthcare workers have been far too willing to talk casually about their patients without thinking how this violates their confidentiality, The Final Rule modifies the Privacy Rule to extend direct liability for disclosures of PHI by business associates. However, the rule does not subject

Information received from someone else I.E. the patient should not be passed on to third parties without the consent of the person that the information was initially received from, as per the data protection act 1998 states this also includes, electronic, verbal, documents, and includes every form of storage of information received or passed on.

Explanation: According to both HIPAA and ARRA regulations, healthcare organizations compels to allow all reasonable efforts to limit the disclosure of information to the minimum necessary data to accomplish the purpose of the request (McWay, 2010). Based on the information provided, the request for PHI fails to specify the date of validity of the release of PHI. According to the HIPAA privacy rule, a request for the release of PHI is invalid if the request meets the following specifications (1) expiration date not specified that is related to purpose of disclosure, or the date on the request for information has elapse, (2) If the authorization request have been revoked, (3) failure to clearly state the intended purpose of release of information, (4) failure to provide signature and date of authorizing the disclosure of information ( or failure to provide specification of the representative’s authority to act on behalf of the patients), and (5) failure to specify the entity disclosing and the recipient entity (Department of Health & Human Services, 2004). There

Describe the responsibility of the medical office specialist to protect all protected health information (PHI).

In August 2000, Kaiser Permanente Online experienced a serious breach in security. The security breach concatenated several hundred individual e-mails containing personal patient data. As a result of the security breach, 19 members receiving private data about other members. Kaiser Permanente was made aware of the breach when two members notified the organization that they had received the concatenated e-mail messages.

Any patient that is seen by a physician within the United States is to be protected by the “Health Insurance Portability and Accountability Act” or HIPAA, which was passed into law in 1996 (Jani, 2009). All health care facilities dealing with any protected health information (PHI) are to ensure that all physical/electronic processes are safeguarded from any third party entity or unauthorized personnel according to HIPAA. All health care data to include any medical insurance

Ten years ago after much challenges and questionable skepticism, the HIPAA policy became effective and has been shaping healthcare one regulatory policy at a time. The evolution of the HIPAA privacy act helped establish the HIPAA Security Rule which was published in 2003 and became effective in 2005, and then eventually led to the HIPAA Enforcement Rules and the Breach Notification Rule. With it joint fortification of the 2009 HITECH Act and HIPAA’s modifications to regulations, it was released in January 2013 to the industry (American Health Information Management Association, 2013).

This case presents a prime example of privacy violation. The Federal privacy rule 42 CFR, part 2 mandated addition privacy protection for any health record that is generated in the treatment of patients in the federal alcohol and drug program (Hughes, 2002). The HIPAA privacy rule dictates that healthcare organizations must not disclose any identifying patient information, or alert any entity that a particular patient is participating in alcohol/drug treatment program. This type of privacy breach must be reported promptly to the internal review board (IRB), compliance officer, risk management office and the privacy officer at the healthcare organization. The Health Information Technology for Economic and Clinical Health (HITECH) act and the American Recovery and Reinvestment (ARRA) act also mandated that any healthcare organization or any covered entity under the HIPAA act should promptly notify individual patients about the accidental disclosure of their medical information; the time from discovery of breach of PHI to patient’s notification must not be more than 60 days. In addition, to patient notification, the covered entity must also report such incidents to the Department of Health and Human Services (DHHS) and to the media if the breach affects more than 500 patients, and if the breach affects less than 500 patients, notifying the patients and the

HIPAA was put in place to help set standards on protecting a patients personal health information, therefore HIPAA does affect a patient’s access to medical records. A patient can review or obtain a copy of their records by submitting, to the physician (covered entity), a request for such in writing or a medical release form. In which case the covered entity can release a “designated record set” of certain personal

Finally, we would like to address Mr. Craven’s assertion that the Hospital used Ms. Reeves’ PHI for “commercial advantage.” The penalties for wrongful disclosure of PHI significantly increase if the offense is committed with the intent to sell or use PHI for that purpose. While HIPAA does prohibit the “sale of PHI” for commercial advantage, it expressly excepts the disclosure of PHI for treatment and payment purposes from the “sale of PHI.” As we discuss in this memorandum, the Hospital did not sell, wrongfully disclose Ms. Reeves’ PHI, or otherwise violate HIPAA.

After he found the issue troubling, he sent an email to

Define breach of PHI by the federal government 's standards including what federal laws dictate the health care organization 's responsibility to protect electronic health information.

Confidentiality was explained to Lorena, and also the exceptions in which, confidentiality would have to be breached. Lorena was asked if she understood this, she replied “Yea”. ACA (2005, Section, 2.3.3.1. Breaching the confidentiality and therefore trust between Lorena and myself in this instance, was necessary and unavoidable, ACA, 2.3.4.1, (2008), and 2.3.4.3 and ACA, , B.2a, B.2c(2005).