I have a sticky situation that I've never seen before and I'm looking for some insight. I'll try to stick to the facts.
1. I'm a case manager for a government agency and I coordinate, oversee and perform care for vulnerable -usally geriatric- patients in the community.
2. I've had this patient for several months now with pretty grievous abuse and repeated violations of patient responsibilities I outlined with the family when the patient was admitted. They agreed to our policies in writing and have been gently reminded multiple times since admission.
3. Pt. Is cared for by a grandchild with some serious anger issues. Constantly threatening and initiating legal action (not against us), refusing to allow patient to receive pain meds resulting in violent and aggressive behavior directed at us - I'm talking drawing blood-, granddaughter constantly screaming and cursing at us.
3. Our program manager refuses to discharge anyone, Including this one, with one FNP actually quitting our program because they couldn't stand the abuse anymore.
4. Pt. Revoked hospice at family request this weekend, again, as a result of gangrene escalating to sepsis to LE complicated by PVD and 100% dependence for bed mobility.
5. As is customary, I went to the hospital to coordinate care with the hospital staff and spoke with the patient's assigned nurse at the nurse's station.
6. While nurse and I were together, speaking in lowered voices in what I was confident was incidental disclosure.......
7. ....I was unaware that one of the CNA's working on the unit had come into the nurse's station and was hovering to eavesdrop on our discussion.
8. Charge nurse was saying some pretty crappy stuff and I was agreeing with and validating her frustrations. Not bad mouthing anyone, just listening to her vent and telling her that she wasn't the only one who'd dealt with all of the above referenced behavior from the patient's family.
9. Aforementioned CNA happened to be a close friend of patient's really angry family member.
10. I received a call this evening from said family member screaming at me, repeating the conversation the nurse and I had almost verbatim. She admitted that the CNA was her "best friend" and the CNA told her everything.
I got the family member calmed down and rational somehow by the grace of God by the time the conversation was over but I'm pretty angry myself. I'm pissed that my boss allows us to be treated this way. I know it's "part of the job" especially at end of life. It is what it is but I as a former hospice administrator and an RN, I have a zero tolerance policy for yelling, threatening and otherwise abuse of staff. It's one thing to vent and work though grief. Quite another to threaten staff, scream, curse, and otherwise bully them and attempt to intimidate with fear.
This CNA violated HIPAA. I'm concerned that this could somehow be turned against me and I take HIPAA pretty seriously because that's just what we do.
Not sure how to proceed as far as telling my boss, who is very open in letting us know he doesn't care and doesn't appreciate us making waves. Lay low, be quiet and "grow the program" (increase pt. Census).
How do I handle this? What should I have done differently ?
Thanks in advance for insight.
***edit: I work in an Interdisciplinary care model very similar to hospice except that we care for patients across at every stage of disease and life, so we frequently discuss and care plan for patient and family behaviors and responses to interventions. Just to clarify that I wasn't gossiping or bad mouthing anyone. No name calling or any of that.
Update: I documented thoroughly and professionally, and by "professionally" I mean: exlcuding the HIPAA violation and only including details of the care coordination encounter with the other nurse.
The CNA in question was actually an RN, a brand new one. Not an aide. I was mistaken on that fact. My supervisor did a "report of contact" with me where he emailed me after "counseling" me following receipt of a complaint from the family member who gave him the name of the nurse who told her so he could verify what happened with her -as the family member had no clue how grievous a hipaa violation this was-; at which point he contacted our privacy officer who told him it was "unintentional disclosure" of patient information and advised him to counsel me and document teaching with me about making sure I protect patient information so it doesn't happen again.
I was livid when I received that email from my boss this morning.
Before I came to is job several months ago I was a hospice clinical director and right before this, an administrator in the private sector for some time. I started as a CNA and worked my way up, so CAHP and joint commission taught me well. He's brand new to leadership so I guess they haven't taught my boss as much yet. I won't make an assumption but I know regs like the back of my hand and I keep my experience to myself because I'm not in leadership anymore and I have no reason to beat anyone over the head with it.
What makes me furious is that I called our privacy officer and recited the rule regarding incidental disclosure including the inclusion of language SPECIFIC to discussions at nurse stations and asked her why she told him to counsel me and then send me an email about why I needed additional HIPAA training about this. Her reply was that she was told the incident occurred in a hallway and not at a nurse's station or she never would've told him to do that. I thanked her, then spoke with HR who told me it wasn't a big deal at all, reminded me that I'm a union employee and he can't use that stupid email he sent me against me in any form or fashion and then told me to reply with corrections including the fact that it occurred at a nurse's station and my conversation with the privacy officer and to hold on to it when it came time for my raise here soon in the event that I "feel that I should need it". He then told me to call our union rep.
My boss is known for being a dirty SOB and he has a horrible reputation. I won't say much except he doesn't report sentinel events to anyone...just not a good guy.
Instead of leaving nursing altogether I took this job and I'm going to stick it out. If it gets bad I can make a lateral move and I'll do so should I feel the need arise. I certainly won't be the first. I'm generally not this angry at all and try to figure out always how I contribute to negative outcomes should they arise. But after getting that email this morning and being talked to Like I'm some kind of moron after a long week I guess I'm venting and I'm won't take this one sitting down. Hopefully that's the last I hear of this.
In the interim, I spoke with the nurse I received report from, her facility has suspended the other nurse pending investigation and I've filed an allegation of breach of HIPAA with my own agency. Who happens to be the federal government, simply because I'm aware of the breach and policy dictates that I have to report knowledge of a known breach.
Specializes in Education, Informatics, Patient Safety.
11 minutes ago, AnonymouseRN said:
My boss is known for being a dirty SOB and he has a horrible reputation. I won't say much except he doesn't report sentinel events to anyone...just not a good guy.
I believe it's your ethical duty to report your boss for this breach of patient safety practice. He is required by the Joint Commission to report sentinel events. If you know he is not reporting them and you don't report him, then you are just as guilty as he is. Please consider reporting him.
I'm so sorry this happened to you. Glad you've got a union to back you up.
The CNA/nurse-family friend repeated - the report- given at the nurse's station to the family - abusive caregiver- who I assume was not authorized by the PT to receive health information.
Note: I’m not defending anyone, just trying to figure it out
As above. A friend of the patient's family was employed at the hospital as an RN. The OP (employed by a government entity that serves vulnerable adults) was at the hospital seeing the patient in an official capacity. While at the hospital nurse's station the OP received a verbal report from the charge nurse at the hospital. The friend of the family who was also a hospital employee eavesdropped and divulged the details of that conversation to the patient's daughter.
That’s not a HIPAA violations as far as I see it. It was gossip that got back to the person being gossiped about. I didn't read that the RN shared diagnoses, Social security numbers, addresses, or other personal data with someone who was not supposed to have that information. Especially considering it sounds like the family has some power of attorney overseeing care. The family is privy to all medical discussions (but that was smack talk, not a medical talk)
It was an overheard convo of grievances against the family. That’s not a HIPAA violation. HIPAA is the illegal sharing of pertinent private patient records/information with those not allowed to have it. Last I checked, sh** talking about the family was not listed in the HIPAA protected information.
Not saying what happened was cool, but I do not see anything illegal. Just people got busted talking smack about the patient’s family, not the patient, and the family got wind of it.
Careful where you open your mouth... the walls have ears... unless that RN was sharing patient records, SSN, insurance, diagnosis, or other medical information with outside people, I don’t see a crime. Sucks, likely not good for hospital relations, but not a criminal act.
I’m interested to see how it plays out. I doubt the RN will have any legal repercussions. He can just say he overheard you talking smack against his friends at the nursing station, and he told them. The volume of your voice is debatable and he is allowed to be there, apparently. He can also say he informed them because he was worried hostile environment would create a lack of proper care for his friend’s family, and that’s why he wanted them to know.
I think you downplayed a little those grievance words your charge used about the family, and maybe your “supportive” replies that got heard too. (I’ve been a nurse for a while)
But that’s not info about the patient, that’s info about staff not liking the family.
I assume it was a lot of very not-nice things the charge was saying (and maybe warranted, as it sounds like the family was horrible). And that smack talk got back to the family.
Unfortunately, that’s just gossip, not HIPAA, from what I’m reading here.
Now you really have to be really careful because the family can make a case for malpractice from discrimination if something goes bad with the patient. There is documented hostility between the Charge Nurse of the Unit and Staff RNs, against the patient’s family.
Gotta step up your game even more now and hope you can get out of this case without legal issues. I would lay low and not poke the bear... this all started with an inappropriate conversation.
Technically that charge should share grievances with his/her superior or HR. Or you discuss outside the hospital—not a charge RN trash-talking a family at the nurses station with the staff RNs that are caring for the patient. That looks bad for you guys.
Especially considering it sounds like the family has some power of attorney overseeing care.
What do you mean/where do you get that idea?
7 hours ago, LouDogg said:
The family is privy to all medical discussions
Maybe or maybe not. And an eavesdropper not involved in the care may not know whether they are or aren't.
7 hours ago, LouDogg said:
I’m interested to see how it plays out. I doubt the RN will have any legal repercussions. He can just say he overheard you talking smack against his friends at the nursing station, and he told them.
I get what you're saying, but to the extent that any of the so-called "smack talk" relates to the volatile and abusive situation in which the patient is living, it could be dicey trying to claim that it was not protected information related to his care and care plan and arrangements being made for his ongoing care.
7 hours ago, LouDogg said:
I think you downplayed a little those grievance words your charge used
The OP has no affiliation or relationship with the smack-talking charge nurse as has been noted a couple of times now. The OP visited the facility in which this charge nurse was on duty; the OP was there to see the patient and participate in care-planning on behalf of a government agency.
7 hours ago, LouDogg said:
Technically that charge should share grievances with his/her superior or HR. Or you discuss outside the hospital—not a charge RN trash-talking a family at the nurses station with the staff RNs that are caring for the patient. That looks bad for you guys.
And if the eavesdropping-staff-RN-friend-of-the-family had concerns her appropriate action would have been to report to management, not to contact the family with information that was gleaned through her role as an employee of a covered entity.
Also please re-read the scenario. 1) The OP visited this hospital unit d/t her role with a government agency that is working with this abusive family. 2) A charge nurse at the hospital shared her perceptions and complaints of the family's behavior with this gov't worker (the OP). 3) The eavesdropper staff RN (who is the best friend of the most problematic family member) recognized that she could wreak havoc for the gov't agency worker who has an ongoing relationship with and is overseeing the abusive family.
I see now, Anonymous RN is a case worker, not the bedside nurse. OK. Doesn't change much here.
Anonymous RN said that the family is refusing to allow the patient to receive pain meds. You would need some control over the case to be able to make that demand, so I assumed. Also said that the granddaughter was the caregiver. That would make the family privy to all med information. But if not, that's fine, my mistake, still doesn't change much here either.
If they are not in control, then obviously they are not privileged to medical files, record, diagnoses, insurance information, etc....
However, none of that private medical information was shared with the family--only the fact that the Charge nurse was "venting" about this horrible family, the Anonymous RN was "supporting" it, and apparently, it all got let out of bag and the family got word of it.... which is not HIPAA protected.
Should that RN have been eavesdropping? No.
Should eavesdropping that RN have brought it to his superior? Maybe if it bothered him that much
Was it illegal? No, he could easily say the conversation was loud, make up a reason for being in the area (even if he says he though he forgot something over there, or whatever) or passing by; and he can say he can't help overhearing something. Short of having recorded your decibel levels, you can't argue the weasel's argument. (he said/she said)
Just playing devils advocate here. I don't agree with the RN's actions. I think that's a weasel thing to do.
I also do not see a legal issue in his actions, definitely not HIPAA.
The walls have ears and eyes. Go to a separate room/outside if you need a truly private conversation--if only to protect yourself. Gossip gets around a hospital faster than a Daytona 500 race.
I have no dog in this fight, just my 2 cents. If he gets charged and convicted of a HIPAA violation, let us know.
Anonymous RN said that the family is refusing to allow the patient to receive pain meds. You would need some control over the case to be able to make that demand, so I assumed. Also said that the granddaughter was the caregiver. That would make the family privy to all med information. But if not, that's fine, my mistake, still doesn't change much here either.
Yeah, I don't know either. I made my guess based on the OP having said that the patient came to the hospital because he revoked his hospice status at family's request. It sounds like they exert various pressures upon him (in addition to whatever leeway they gain by the fact that they live together), but whether or not they can independently make decisions on his behalf, I don't know. Kind of doubt it. It sounds, rather, like he just doesn't have a lot of options other than to put up with them and doesn't necessarily have the resources that would be necessary if he wanted to stop being pressured by them.
14 minutes ago, LouDogg said:
If they are not in control, then obviously they are not privileged to medical files, record, diagnoses, insurance information, etc....
However, none of that private medical information was shared with the family--only the fact that the Charge nurse was "venting" about this horrible family, the Anonymous RN was "supporting" it, and apparently, it all got let out of bag and the family got word of it.... which is not HIPAA protected.
I disagree in principle. For the sake of explaining, let's think about a this situation as if the verbiage being used in the discussion is decidedly not "smack talk," but is still related to the same basic topics and is still of interest to the eavesdropper (who knows that the fact that the family dynamics were being discussed will be an offense all on their own).
For example, if the charge nurse had been reporting (to the OP) things like, "They do not allow him speak for himself, they cut him off before he can express his wishes. He told me that he doesn't like their actions but they threaten him and are very aggressive with him so he doesn't feel he can do anything. I am also concerned because they are very rough in their speech and actions towards him. For example, yesterday his granddaughter grabbed his chin and got right in his face and screamed at him, 'I'm sick of fking arguing about this and I don't want to hear another word about it!!'"
According to your idea of what constitutes PHI, that isn't PHI. Except that it is...it is all about this gentleman's health as related to his safety, including his psychological/emotional well-being, and including information about his living situation, his vulnerabilities as a individual dependent upon others, and his caregivers. The information is being disclosed by an employee of a covered entity to (presumably) an employee of a different covered entity. The eavesdropper is also an employee of the covered entity and was only anywhere near the discussion d/t her status as an employee of the covered entity.
Even if the conversation had been strictly professional in nature, it is still related to the patient's overall health, care, plan of care, etc., etc. and it still may have riled up the patient's family. No outright disclosure of things like name, SSN, address is necessary because all parties involved already know the identity of the patient in question, in other words, whatever the information is, the subject of it is already identified. It is not 'de-identified' information, and it is health-related care information.
I think what you are saying is that due to the unprofessionalism of the manner in which information was being conveyed, it is not PHI because it was just plain old gossip. I think sounds like it was conveyed completely unprofessionally (I'm pretty sure that is the OP's opinion, too) but it is quite unlikely that it had absolutely nothing to do with the patient's overall health and care.
I do think that employers have been conflating their own privacy practices and PR preferences with HIPAA for so long that our ideas about what constitutes a violation can become skewed, mine included.
47 minutes ago, LouDogg said:
Should eavesdropping that RN have brought it to his superior? Maybe if it bothered him that much
Was it illegal? No, he could easily say the conversation was loud, make up a reason for being in the area (even if he says he though he forgot something over there, or whatever) or passing by; and he can say he can't help overhearing something.
Yes. His/her correct action is not to run to the family.
Any of the parties could lie or exaggerate about what really happened. But the most likely thing is that some extent of the information was indeed health related and "official business."
And FTR yes I do think professionalism will have to be stepped up. I'm sure the OP has realized that s/he was not there primarily to affirm the hospital staff's struggles with the family, but primarily to care for the patient. In the future will have to maintain strict professional composure so as to ensure that motives could not be mistaken.
The CNA violated HIPAA for bringing it outside of the workplace. You were behind the nursing station where no outside person was in proximity. The CNA signs paperwork during orientation and annual training about that. She wasn't a private aide, she worked for your company so therefore she should be terminated.
I'm with LouDogg, there is no obvious HIPAA violation here.
It was certainly inappropriate and likely violated any number of organizational policies and expectations, but not a clear HIPAA violation.
First, this scenario would have to involve Protected Health Information, the charge nurse's personal frustration with the patient's family is not PHI.
Second, assuming there was PHI involved, it would have had to have been obtained by an intentional and deliberate method of obtaining PHI the person is not allowed access to. So if the CNA had admitted "I was only at the nursing station to overhear information I am not allowed access to", and PHI was involved, then that would be a potential violation. If being at the nurse's station is something that occurs as part of normal job activities, then that is an incidental exposure and not a HIPAA violation. If PHI was disclosed to someone not allowed access to that PHI then that would also be a violation, but it sounds as though PHI was already being shared with family, and regardless it would need to be PHI we're talking about, not the charge nurse's annoyance with the family.
Those are good thoughts from you @MunoRN and @LouDogg, but I still kind of think it could be pieced together in either direction. HHS's definition of treatment includes "provision, coordination, or management of health care and related services." There is nothing to suggest they mean to limit this definition strictly to services related to physical conditions only (besides, one could make the case that the patient's living situation, including his difficult family members, is directly related to his health and healthcare anyway). As I said, I doubt the charge nurse's comments were the extent of the conversation and just because the eavesdropper may not have conveyed the full contents of the convo to the family member doesn't mean a protected context didn't exist.
I don't know ??♀️, you two may very well be correct--but I kind of believe that if a formal complaint were made to OCR they would not look kindly on an employee of a covered entity divulging social-health-related information that was obtained from the context of a likely-protected conversation. I know you are noting that it was gossipy in nature, but I don't know if they would get into the weeds like that or just be very displeased that the contents were passed on, related to a patient, by an employee of a covered entity.
I guess it's interesting to think about either way.
AnonymouseRN
4 Posts
Update: I documented thoroughly and professionally, and by "professionally" I mean: exlcuding the HIPAA violation and only including details of the care coordination encounter with the other nurse.
The CNA in question was actually an RN, a brand new one. Not an aide. I was mistaken on that fact. My supervisor did a "report of contact" with me where he emailed me after "counseling" me following receipt of a complaint from the family member who gave him the name of the nurse who told her so he could verify what happened with her -as the family member had no clue how grievous a hipaa violation this was-; at which point he contacted our privacy officer who told him it was "unintentional disclosure" of patient information and advised him to counsel me and document teaching with me about making sure I protect patient information so it doesn't happen again.
I was livid when I received that email from my boss this morning.
Before I came to is job several months ago I was a hospice clinical director and right before this, an administrator in the private sector for some time. I started as a CNA and worked my way up, so CAHP and joint commission taught me well. He's brand new to leadership so I guess they haven't taught my boss as much yet. I won't make an assumption but I know regs like the back of my hand and I keep my experience to myself because I'm not in leadership anymore and I have no reason to beat anyone over the head with it.
What makes me furious is that I called our privacy officer and recited the rule regarding incidental disclosure including the inclusion of language SPECIFIC to discussions at nurse stations and asked her why she told him to counsel me and then send me an email about why I needed additional HIPAA training about this. Her reply was that she was told the incident occurred in a hallway and not at a nurse's station or she never would've told him to do that. I thanked her, then spoke with HR who told me it wasn't a big deal at all, reminded me that I'm a union employee and he can't use that stupid email he sent me against me in any form or fashion and then told me to reply with corrections including the fact that it occurred at a nurse's station and my conversation with the privacy officer and to hold on to it when it came time for my raise here soon in the event that I "feel that I should need it". He then told me to call our union rep.
My boss is known for being a dirty SOB and he has a horrible reputation. I won't say much except he doesn't report sentinel events to anyone...just not a good guy.
Instead of leaving nursing altogether I took this job and I'm going to stick it out. If it gets bad I can make a lateral move and I'll do so should I feel the need arise. I certainly won't be the first. I'm generally not this angry at all and try to figure out always how I contribute to negative outcomes should they arise. But after getting that email this morning and being talked to Like I'm some kind of moron after a long week I guess I'm venting and I'm won't take this one sitting down. Hopefully that's the last I hear of this.
In the interim, I spoke with the nurse I received report from, her facility has suspended the other nurse pending investigation and I've filed an allegation of breach of HIPAA with my own agency. Who happens to be the federal government, simply because I'm aware of the breach and policy dictates that I have to report knowledge of a known breach.