Curiosity Killed the Cat and Got 50 Hospital Employees Fired

[Lorie Brown RN, MN, JD]

You're Fired!

Out of curiosity, over 50 hospital employees, including nurses, decided to check the celebrity's medical records. Many said they didn't go past the name screen but that was enough to be a HIPAA violation. Those individuals lost their jobs.

Anything that you do online in the hospital is trackable. You cannot access the medical records of anyone unless you are involved in that patient's care. Even being only on the face page for any amount of time as little as 17 seconds is a HIPAA violation if you are not involved in the care for that patient.

Audit Trails

Authorities can find your path if you wrongfully access a record because of what's called "audit trails.” The same rules apply if you are changing a medical record such as making a late entry and you will need to properly identify the late entry. Although you may be able to simply replace or add to your prior charting, this can be discovered.

Your employer or an attorney can go through the audit trails to see exactly how the records may have been changed. Cases which might pique an attorney's curiosity, such as a heel ulcer developed overnight and yet all the proper preventative records were checked that they were done in the medical record and sudden changes in condition. In these situations, an attorney may get the audit trail to show that the entries placed in the record were entered late after they knew of the heel ulcer or the change in condition.

Also, be careful when copying and pasting previous notes. Again, those actions can be tracked and the attorney may question whether you actually performed a new assessment.

What is HIPAA?

HIPAA established national standards to protect an individual's medical record as well as other personal health information. Patients' have the right to privacy for their medical records. Any intrusion into the medical records can result in a significant fine to the hospital. Therefore, most facilities have a zero tolerance policy if the privacy rights of any patient are violated. Improperly accessing records could result in termination as this is what happened to more the 50 health care workers at Northwestern.

With medical records and portability information, it is even more important nowadays to be aware of the rules to protect patients' privacy as well as protecting your license.

Privacy and confidentiality also are important when you are conversing with another health care professional outside of the medical area such as in elevators or while having lunch. You never know who may be listening. Even if you avoid using the patient's name, there may enough information revealed to identify the patient.

This is not the first time that a celebrity's medical information has been improperly accessed. Britney Spears was hospitalized in a psychiatric unit when several employees improperly accessed her records. They were all terminated.

Social media is another big issue. All attorneys advise not to post anything, zilch, about work on any of the social media. Again, you can never know all who may be reading your posts or who may even forward that information to other pages.

Violation of HIPAA may result in fines of from $100 to $50,000 per violations and up to $1,500,000.00 a year. Hospitals must designate a HIPAA officer to make sure that the hospital is in compliance.

According to the HIPAA Journal, the average HIPAA data breach costs an organization $5,900,000.00. This is astronomical! No wonder hospitals take this so seriously.

Do your part by never accessing patient information for which you are not authorized to do.

[Emergent, RN]

I just looked up this patient and his former show on Wikipedia. He's accused of faking a racist letter and probably the attack for publicity. He sounds very troubled.

His Mother is African American and his Father Jewish. He was quoted as say that his father would have killed anyone who said he, the father, wasn't black. So, the father has a screw loose apparently. His father was largely absent from his life it said.

I think the breakdown of the family is contributing to many of our societal problems.

[Toadette, MSN, RN]

9 hours ago, RobbiRN said:

What am I missing? Every staff member in our ER can see the name of every patient in our department, their presenting complaints, orders pending and completed, along with a lot of other information, whenever we access our main dashboard screen. The list balloons up to fifty patients at a time, and we work as a team. If I'm caught up on my patients, the first thing I do is scroll the dashboard looking for who may need help. I may click on several patients to determine who is most at risk and highest priority even though I may not care for several of them whose records I access. Any patient in the department is a potential recipient of care from any staff member at any given time. It is ridiculous to imagine we are to myopically focus on our own patients and sacrifice our ability to quickly reallocate our resources to where they are most needed. If teamwork within a department is a HIPAA violation, we've thrown the baby out with the bathwater.

From my understanding, those that were in the chart were not potential caregivers working on the unit of the individual; they were curious hospital employees who had either seen the media coverage of his hospital visit or had heard about it.

There are lots of people who are in charts all the time who are not direct caregivers--managers, supervisors, QI, billing, case managers, UR. They're all OK as long as they're viewing only the minimum necessary information to do their jobs. Recently, a non-clinical person in my place of employment had the responsibility to view demographics information to make a patient assignment based on geography (I do not work in a hospital). This person viewed the medication list out of curiosity and received appropriate discipline and re-training when it was discovered on an audit.

HIPAA covers teamwork within a unit for those who would be caregivers or have a reasonable need to be in the chart. It does not cover every hospital employee for every patient that is in-house. I can see this as a true violation of the patient's privacy - rather than the suggestion that we do not provide great care as a healthcare team.

[Rose_Queen, BSN, MSN, RN]

3 hours ago, Emergent said:

I just looked up this patient and his former show on Wikipedia. He's accused of faking a racist letter and probably the attack for publicity. He sounds very troubled.

His Mother is African American and his Father Jewish. He was quoted as say that his father would have killed anyone who said he, the father, wasn't black. So, the father has a screw loose apparently. His father was largely absent from his life it said.

I think the breakdown of the family is contributing to many of our societal problems.

What, exactly, does this have to do with the willful flaunting of HIPAA by those employees who were terminated?

My facility requires annual training on HIPAA compliance for all employees who have the potential to come into contact with a patient. Such training is also included in orientation. There is zero excuse for this.

[Emergent, RN]

36 minutes ago, Rose_Queen said:

What, exactly, does this have to do with the willful flaunting of HIPAA by those employees who were terminated?

My facility requires annual training on HIPAA compliance for all employees who have the potential to come into contact with a patient. Such training is also included in orientation. There is zero excuse for this.

My post was branching off into the subject of the TV star who is part of this story. If you're not interested, feel free to ignore and discuss HIPAA

[guest655229]

As a 17 year RN in ICU and ER, I would have known not to access any patients chart that was not in my direct care. No celebrity is worth a job, especially Smollet...Surely we are training our new nurses that this is not allowed? One should know better, there is no excuse. Hard lesson to learn...

[Rose_Queen, BSN, MSN, RN]

2 hours ago, Emergent said:

My post was branching off into the subject of the TV star who is part of this story. If you're not interested, feel free to ignore and discuss HIPAA

To me it makes no difference if the one whose privacy was breached is a famous TV star, a "regular person", or anyone else. All are entitled to the exact same privacy.

[Emergent, RN]

2 hours ago, Rose_Queen said:

To me it makes no difference if the one whose privacy was breached is a famous TV star, a "regular person", or anyone else. All are entitled to the exact same privacy.

Of course, but that's not what I said in my post. I was sharing what I read about the star in question.

[klone, MSN, RN]

46 minutes ago, Emergent said:

Of course, but that's not what I said in my post. I was sharing what I read about the star in question.

Which was an entirely odd non sequitur.

[Emergent, RN]

43 minutes ago, klone said:

Which was an entirely odd non sequitur.

I consider allnurses posts a conversation. I think it's more interesting that way. It's also funny that an informational tidbit about the background of the TV star who was the subject of the violation apparently pushed someone's buttons..

Fascinating

[canoehead, BSN, RN]

I have checked to see if a patient is still in hospital with the purpose of finding out whether they survived the night after their ER visit. That's just looking at the name, and death is public record, but I suppose I ought to think about the implications.

[audreysmagic, RN]

12 hours ago, Toadette said:

From my understanding, those that were in the chart were not potential caregivers working on the unit of the individual; they were curious hospital employees who had either seen the media coverage of his hospital visit or had heard about it.

This. It's my understanding that the employees fired were not at all involved in the individual's care. They were literally just peeking. I work on a small unit in which we work as a team as well. I would absolutely get familiar with the charts of the patients on our unit - or even go back through past visits that relate to their current one when I have time. Especially because our unit has a longer expected length of stay than most. But that doesn't give me any license to look up, for example, a patient I once knew at another facility to see if she'd had visits - I'm not involved in her care anymore.

[Davey Do]