Question

Audrey has worked for Dr. Jason for 6 years and has always been recognized as a model employee. While working for Dr. Jason she has also been attending college, which has prevented her from staying in touch with friends and family. In the past year she has kept in touch with friends through a social network website. When Dr. Jason’s Privacy Compliance Officer brought Audrey into her office and announced Audrey’s employment was being terminated for disclosing patient information, Audrey was shocked and stated she would never do such a thing. Audrey then discovered that one day at the office she had taken a picture of her desk to show where she worked, then published it on the social network. In the picture was a medical document with a patient’s name.

Questions

1. Even though it was not deliberate, could Audrey or Dr. Jason be legally liable for disclosing patient information?

2. Who is responsible to train staff in regard to HIPAA rules and regulations?

3. What sections of HIPAA define the regulations to safeguard protected health information (PHI)?

Answer 1

Patient confidentiality should be controlled access and should against unauthorized access. In this situation when accidental or unintentional disclosure PHI should be informed to privacy officers. This incident need to be investigated and risk assessment must be done. BReath report to be sent to the department of health and human service office for civil rights. A simple errors can make a major incidents. it needs disciplinary action and penalties as per HIPAA rules. data breaches to be reported to the covered entity within the 60days of discovery. it causes potentially penalties for Audrey.
HIPAA needs covered entities to train their workers for workforce. Trainees, volunteers and facility person and paid for training person can train staff on HIPAA regulations.
HIPAA security rules need physicians to protect patient data electronically stored with PHI using appropriate safeguards to ensure confidentiality, security, and integrity of this information. It establishes national standards to protected and maintained patient health information by the covered entities. these security rules safeguard patient health information with appropriate administrative, physical and technical protection.