nurse hipaa violation cases

Large Health System Restricts Provider's Use of Patient Records An OCR investigation indicated that the form the HMO relied on to make the disclosure was not a valid authorization under the Privacy Rule. Covered Entity: Private Practice Read more, Arbour Hospital, a mental health clinic in Boston, MA, failed to provide a patient with the requested medical records within 30 days. MIE also settled a multi-state action with state attorneys general and paid a penalty of $900,000. The. The case was settled and a financial penalty of $28,000 was paid. The new procedures were instituted in Medicaid offices and independent health care programs under the jurisdiction of the municipal social service agency. Upon learning of the incident, the hospital placed both employees on leave; the orderly resigned his employment shortly thereafter. A complainant alleged that a private practice physician denied her access to her medical records, because the complainant had an outstanding balance for services the physician had provided. Skagit County agreed to pay OCR $215,000 following the exposure of data of seven individuals. Read More, OCR received a complaint from a patient of California-based Riverside Psychiatric Medical Group in March 2019 alleging he had not been provided with a copy of his medical records. However, as violations of HIPAA are so severe, then CEs will choose to terminate the . A violation of HIPAA attributable to ignorance can attract a fine of $100 - $50,000. Employees were trained to provide only the minimum necessary information in messages, and were given specific direction as to what information could be left in a message. When state laws are violated, the individuals whose ePHI has been compromised may be able to take legal action against the breached entity if it can be proven that an individual has suffered harm due to the negligence of a Covered Entity or Business Associate. Under the revised process, if a subpoena is received that does not meet the requirements of the Privacy Rule, the information is not disclosed; instead, the hospital contacts the party seeking the subpoena and the requirements of the Privacy Rule are explained. OCR investigated and uncovered multiple potential violations of the HIPAA Rules: A risk analysis failure, risk management failure, lack of information system activity reviews, and insufficient technical policies to prevent unauthorized ePHI access. And when data breaches like this occur, it's usually because of a HIPAA violation. 3. Read More, OCR agreed to settle multiple alleged HIPAA violations with Cottage Health for $3,000,000. OCR also identified issues with the notice of privacy practices and there was no HIPAA privacy officer. The minimum fines are $100 per violation for tier 1, $1,000 per violation for tier 2, $10,000 per violation for tier 3, and $50,000 per violation for tier 4. Issue: Access. Issue: Impermissible Use and Disclosure. Read More, Brigham and Womens Hospital was fined for allowing an ABC film crew to record footage of patients as part of the Boston Med TV series, without first obtaining consent from patients. Read More, Puerto Rico Blue Cross Blue Shield licensee Triple S Management Corporation has agreed to pay a HIPAA violation fine of $3.5 million to the Department of Health and Human Services Office for Civil Rights. After OCR notified the entity of the allegation, the entity released the complainants medical records but also billed him $100.00 for a records review fee as well as an administrative fee. Among other actions taken to satisfactorily resolve this matter, the hospital took further disciplinary action with the nurse, which included: documenting the employee record with a memo of the incident; one year probation; referral for peer review; and further training on HIPAA Privacy. If an organization fails to take corrective action after having been issued a fine, the HHS Office of Civil Rights can impose subsequent fines. Among other corrective actions to resolve the specific issues in the case, OCR required the health insurer to train its staff on the applicable policies and procedures and to mitigate the harm to the individual. The case was settled for $160,000. Read More, Erie County Medical Center Corporation in Buffalo, NY, failed to provide a patient with timely access to his medical records. The privacy breaches occurred shortly after each other in 2013. The medical center had also failed to enter into a BAA with a business associate. Nurses may violate HIPAA if they use non-approved channels to transmit patient information. The containers had labels that included the PHI of patients. HMORevises Process to Obtain Valid Authorizations A nurse at a Texas children's hospital has been fired for violating Health Insurance Portability and Accountability Act (HIPAA) Rules by posting protected health information on a social media website. OCR investigated the allegation and found no evidence that the law firm had impermissibly disclosed the customers PHI. Shaila Mae. The case was settled for $1,040,000. For example, texting or calling a coworker to ask about a shared patient's case would be a HIPAA violation. OCR determined that the private practice denied the individual access to records to which she was entitled by the Privacy Rule. The case was settled for $1,000,000. An organizations willingness to assist with an investigation is also taken into account. If not, the form is invalid and any information released to a third party would be in violation of HIPAA regulations. Although the Center gave the complainant the opportunity to review her medical record, this did not negate the Centers obligation to provide the complainant with a copy of her records. Read More, A patient submitted a complaint to OCR about an impermissible disclosure of PHI in a mailing. A nurse in a New York clinic found herself at the center of an ugly HIPAA violation case when her sister-in-law's boyfriend was diagnosed with an STD. Case Examples by Covered Entity. Since HIPAA's enactment in 1996, we've witnessed almost 20 reported cases of unauthorized personnel looking up the medical records of celebrities. Mental Health Center Provides Access after Denial HIPAA Fails Kim Kardashian In 2013, medical employees decided to "Keep Up With The Kardashians," and it cost them their jobs. Read more, Wake Health Medical Group, a Raleigh, NC-based provider of primary care and other health care services, failed to provide a patient with timely access to the requested medical records. Violating HIPAA law can result in fines, job termination, loss of licensure, and criminal charges. This case study involving one nursing education program's experience with a HIPAA violation illustrates how one nursing college dealt with a student's HIPAA . OCR imposed a civil monetary penalty of $100,000. After being notified by OCR about a proposed fine of $105,000, Dr. Brockley requested a hearing with an Administrative Law Judge, but settled out of court and agreed to a fine of $30,000. The first bar in the group of three per year represents the complaints closed in which there was no violation, the second in which there was corrective action, and the third reflects the total closures. Covered Entity: Health Care Provider / General Hospital It took 5 months from the initial request for the complete set of medical records to be provided. Some of these were accidental. Another potential HIPAA violation that's easily overlooked is discussing information over the phone. A grocery store based pharmacy chain maintained pseudoephedrine log books containing protected health information in a manner so that individual protected health information was visible to the public at the pharmacy counter. A Nurse's Guide to the Use of Social Media discusses the case of a hospice nurse whose cancer patient had posted about her depression. Read More, After the permanent closure of the company, paperwork containing former patients PHI was discarded by FileFax. Read More, Skagit County, Washington is paying the price for failing to implement the appropriate controls and safeguards to protect the data it held. The nurse received the board notice for a hearing and the allegations against her, which involved breaching her duty to protect the patients' confidentiality and privacy rights in violation of the state's nurse practice act and administrative rules. All rights reserved. The details come from . November 30, 2021 - New York-based Huntington Hospital began notifying 13,000 patients of a data breach that exposed protected health information (PHI) and resulted in a former . Data were accessed by unknown third parties after ePHI data was unwittingly transferred to a server accessible to the public. In order to resolve this matter to OCRs satisfaction and to prevent a recurrence, the covered entity: terminated the nurse practitioners access to its electronic records system; reported the nurse practitioners conduct to the appropriate licensing authority; and, provided the nurse practitioner with remedial Privacy Rule training. The case was settled for $3,500. The directory contained files that included the protected health information (PHI) of 307,839 individuals. QCA Health Plan has agreed to settle the HIPAA violations with OCR for $250,000. As HIPAA violations are so severe, and may result in huge fines for Covered Entities, if . OCR also identified issues with the notice of privacy practices and a HIPAA privacy officer had not been appointed. A public hospital, in response to a subpoena (not accompanied by a court order), impermissibly disclosed the protected health information (PHI) of one of its patients. Scott Harris and the rest of our team at S J Harris Law will be ready to help you pursue any option available that allows you to keep your license and continue working, no matter what industry you are in. Operating as Agape Health Services, the company experienced a breach of the ePHI of 1,263 patients. Among other corrective actions to resolve the specific issues in the case, the HMO created a new HIPAA-compliant authorization form and implemented a new policy that directs staff to obtain patient signatures on these forms before responding to any disclosure requests, even if patients bring in their own authorization form. Read more, The owner of the Fairhope, AL, dental practice impermissibly disclosed patients PHI to a campaign manager and a third-party marketing company in relation to a state senate election campaign. OCR has increased its enforcement activities in recent years. Read More, A patient of Elite Dental Associates submitted a complaint to OCR stating her PHI had been disclosed by Elite Dental Associates in response to a review on Yelp. As of July 2022, there have been 38 HIPAA Right of Access cases under this compliance initiative that resulted in financial penalties. All staff was trained on the revised procedures. The minimum fines are $100 per violation for tier 1, $1,000 per violation for tier 2, $10,000 per violation for tier 3, and $50,000 per violation for tier 4. Read More, The Department of Health and Human Services Office for Civil Rights has sent another warning to HIPAA-covered entities about the need to obtain signed, HIPAA-compliant business associate agreements with all vendors prior to disclosing any protected health information. The case was settled for $15,000. The revised policies are applicable to all individual stores in the pharmacy chain. The man sued the clinic, even though it had already dismissed the nurse from her job. The office informed all its employees of the incident and counseled staff on proper faxing procedures. However, the court also legitimized private cause for action in HIPAA lawsuits, which could set a precedent for HIPAA related legal action. Your Privacy Respected Please see HIPAA Journal privacy policy. Read More, A $2.5 million settlement has been agreed upon with CardioNet to resolve potential HIPAA violations. Case Examples by Issue. An employee's medical record is protected by the Privacy Rule, even though employment records held by a covered entity in its role as employer are not. OCR intervened but received a second complaint a month later when the records had still not been provided. Prison Time for Scheme to Frame Nurse for HIPAA Violations. St. Joseph Health has agreed to pay OCR $2,140,500. Read More, In March 2019, OCR received a complaint from a patient who alleged she had not been provided with a copy of her medical records in the requested electronic format despite making repeated requests. Further information on the penalties for HIPAA violations are detailed here. According to the Massachusetts General Law, Chapter 112, Section 77, the Board must report disciplinary actions to national data reporting systems. The Center did not, however, provide the complainant with the opportunity to have the denial reviewed, as required by the Privacy Rule. The default security settings were left in place, which allowed any individual with an Internet connection to gain access to the ePHI in the files. The OCR investigation revealed a lack of business associate agreements, insufficient access rights, a risk analysis failure, a failure to respond to a security incident, a breach notification failure, media notification failure. OCR provided technical assistance but received another complaint from the same patient that the records had still not been provided. CHCS failed to perform a comprehensive risk analysis since September 23, 2013. A violation of HIPAA attributable to ignorance can attract a fine of $100 $50,000. OCR's investigation determined that a flaw in the health plan's computer system put the protected health information of approximately 2,000 families at risk of disclosure in violation of the Rule. The financial consequences of violating HIPAA depend on the level of negligence and if a breach has occurred the number of records potentially exposed by the breach and the risk posed by the unauthorized disclosure: The figures listed above represent the fines that can be imposed by OCR. Among other corrective actions to resolve the specific issues in the case, OCR required the covered entity to revise its policy. There are four tiers of HIPAA violation penalties for nurses, ranging from unknowing violations to willful neglect of HIPAA Rules. $("#wpforms-form-28602 .wpforms-submit-container").appendTo(".submit-placement"); ACMHS has agreed to settle the case with OCR for $150,000. Violations related to HIPAA laws have serious consequences, including job loss and other penalties. A staff member of a medical practice discussed HIV testing procedures with a patient in the waiting room, thereby disclosing PHI to several other individuals. After the investigation, Ms D was informed that she was being terminated from her job based on her violation of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) for . Read More, Lifespan Health System Affiliated Covered Entity is a Rhode Island healthcare provider. The 2020 increase is largely due to OCRs HIPAA Right of Access enforcement initiative, which was launched in late 2019. The table above will be updated when the new penalty amounts for 2023 are finalized by the HHS. The case was settled for $70,000. Pharmacy Chain Revises Process for Disclosures to Law Enforcement The complainant alleged that a mental health center (the "Center") refused to provide her with a copy of her medical record, including psychotherapy notes. Activities considered preparatory to research include: preparing a research protocol; developing a research hypothesis; and identifying prospective research participants. Background: Inappropriate use of social media necessitates health institutes, academic institutes, nurses and educators to consider occupational ethical principles while creating a policy and guide on the usage of social media. The case was settled for $38,000. Read More, An OCR investigation into an impermissible disclosure of 9,255 individuals PHI by Advanced Care Hospitalists, a business associate of a HIPAA-covered entity, revealed serious HIPAA compliance failures including a lack of a BAA, insufficient security measures to protect ePHI, and no documentation showing there had been any HIPAA compliance efforts prior to April 1, 2014. OCRs investigation revealed that the radiology practice had relied upon incorrect billing information from the treating hospital in submitting the claim. However, the patient was not covered by workers compensation and had not identified workers compensation as responsible for payment. The incident for which the fine has been issued dates back to 2009 when a data security complaint was filed by a patient of one of its doctors. Five Memphis healthcare workers charged with conspiracy, HIPAA violations. Read More, Coastal Ear, Nose, and Throat in Florida received a request from a patient for a copy of medical records on December 15, 2020, and again on January 8, 2021, but the records were not provided until May 20, 2021. Raleigh Orthopaedic has agreed to pay OCR $750,000 for failing to enter into a business associate agreement (BAA) with a vendor before handing over the protected health information (PHI) of 17,300 patients in 2013. OCR intervened and provided technical assistance on the HIPAA Right of Access but received a second complaint when the records had still not been provided. Read More, The city of New Haven in Connecticut was investigated over an incident where a former employee accessed its systems after termination and copied a file containing the ePHI of 498 individuals. An OCR investigation confirmed allegations that a dental practice flagged some of its medical records with a red sticker with the word "AIDS" on the outside cover, and that records were handled so that other patients and staff without need to know could read the sticker. Issue: Impermissible Uses and Disclosures. Here are the top five misconceptions about FERPA and HIPAA that I regularly address in my work with schools. OCR intervened and closed the case but received a second complaint a month later when the records had still not been provided. In the first half of 2018, more than 56% of the 4.5 billion compromised data records were from social media incidents. Read More, QCA Health Plan, Inc. of Arkansas reported the theft of a laptop from a car that contained unencrypted data on 148 patients. Read More, Bayfront Health St. Petersburg was investigated following receipt of a complaint from a patient on August 14, 2018. The HIPAA Right of Access violation was settled with OCR for $160,000. Read More, Southwest Surgical Associates in Texas took 13 months to provide a patient with all of the requested records between February 11, 2020, and March 5, 2021. There may be a viable claim, in some cases, under state laws. OCR settled the case for $5,000. Settlements have previously been agreed upon with healthcare providers, health plans, and business associates of covered entities, but this is the first time OCR has settled potential HIPAA violations with a wireless health services provider. OCR determined that there had been an impermissible disclosure of 34,883 patients ePHI due to a lack of encryption. To resolve this matter to the satisfaction of OCR, the hospital: retrained an entire Department with regard to the requirements of the Privacy Rule; provided additional specific training to staff members whose job duties included leaving messages for patients; and, revised the Departments patient privacy policy to clarify patient rights to accommodation of reasonable requests to receive communications of PHI by alternative means or at alternative locations. Read More, OCR launched an investigation into the Carroll County, GA ambulance company, West Georgia Ambulance, after being notified about the loss of an unencrypted laptop computer that contained the PHI of 500 patients. Covered Entity: Health Plans / HMOs This will have long-lasting ramifications. They split the fines and charges into two categories: reasonable cause and willful neglect. Read More, Danbury Psychiatric Consultants in Massachusetts received a request for medical records on March 24, 2020, but access to the records was refused due to an outstanding bill. The Center provided OCR with a valid authorization, signed by the complainant, permitting the release of information to the auto insurance company. The doctor was retiring and received a delivery of 71 boxes of medical files containing up to 8,000 patient records; however, the delivery was made, and the boxes were left on the doctors driveway while he was out of the house. The case was settled for $5,100,000. Hospital Revises Email Distribution as a Result of a Disclosure to Persons Without a "Need to Know" Issue: Impermissible Use and Disclosure, A complainant, who was both a patient and an employee of the hospital, alleged that her protected health information (PHI) was impermissibly disclosed to her supervisor. HIPAA violations don't just occur when a nurse posts something of their own accord. Read More, The HHS has announced that Lahey Hospital and Medical Center has agreed to settle a case with the Office for Civil Rights over alleged HIPAA violations following a data breach that occurred in October 2011. The practice trained all staff on the newly developed policies and procedures. North Memorial has agreed to pay $1,550,000 to OCR to settle the HIPAA violation charges. U.S. Department of Health & Human Services