HIPAA scapegoat

Nurses HIPAA

Published

First of all I wanted to say that I created this account for my wife. She is fighting either an unbelievable level of incompetence or unimaginable level of malice from her now former employer. I figured we are at the point where we need to crowd source some ideas from people that are in her field.

(I am a programmer who works in the healthcare realm, just for background on me)

Background:

-Floor nurse on a telemetry floor for 3 years on 3rd shift in upstate NY.

-Terminated for supposed HIPAA violation.

Narrative:

My wife was brought into an early morning meeting after her shift ended to discuss a problem. She was confronted about accessing ED Pt records ‘view’ screen. She said yes, I look at the chief complaint as do most other nurses to get a sense of potential Pt admissions. (the ED EHR main screen when logging in has First, Last, DOB it does not have chief complaint for her).

She said she thought it was acceptable since other nurses do the same thing (common practice she learned on the floor) and the newer nurses now have chief complaint on the main screen (no need to click ‘view’). The hospital administrators in the meeting were shocked that the newer nurses could see chief complaint by default.

My wife had already accepted a new job at another hospital and already had her resignation letter in her pocket to hand to her manager, which she did immediately after this meeting. With two shifts left before leaving on good terms she gets a phone call where they terminate her for this ‘HIPAA violation’.

She was also accused of looking at Pts on another unit, but that was debunked during the meeting where they fired her by her manager because she picks up shifts on that other unit and the access was appropriate. (yes, they didn’t even know where she worked before accusing her and firing her)

Some of the other RNs were also investigated for doing the same thing, but so far no one else has been fired. They would have to fire half the RNs in the hospital if the same standard was applied. The ombudsman was helpful at first, but now seems useless. HR wont even talk to her and says, via the ombudsman, they don’t have to follow the employee handbook because she ‘broke the law’.

Questions:

A. What can she expect with this type of HIPAA violation?

B. Is there any recourse to fight this?

C. Will her new employer be notified of the violation?

D. Is there any whistle-blower protection since she notified them of their own HIPAA violations (by their definition, not hers)?

E. Is the hospital simply using her as a scapegoat so they can say the 'problem was fix' so they don't have to report themselves?

F. Any Pro bono lawyers or groups that deal with libel in the health care world?

Please feel free to ask any questions and we both really appreciate any help that can be provided.

13 hours ago, FolksBtrippin said:

Jory, I think you are missing that when an employee violates HIPAA the employer is also responsible.

This is what I learned.

If I am wrong on this, someone correct me, but I am pretty sure employers are responsible in some way for an employee's hipaa violation. That's why they spend all that time and money educating. It's also why they discipline employees who violate.

They are responsible for maintaining their own policies, but no...employers don't get sued/sanctioned because one employee made the choice to go rogue. I have never, ever seen a case where risk management sent a notification to a family because one nurse accessed a few files she wasn't supposed to.

15 hours ago, inthealpine said:

You are 100% a 'company person'. The first sentence of the first post you accused my wife of lying.

You defended the hospital blindly in ways even they don't have the audacity to do.

You now say 'dont stir the pot' as though keeping your mouth shut takes priority over Pt care and the truth.

This was not idol curiosity, it was observation of 3 years of common practice on multiple units and RNs doing what they thought was best for patient care. I'm so glad my wife already found a new job because those RNs left on those units are petrified of doing their jobs because of 'company persons' second guessing every minute they are on the clocked in.

...to those reading and interested, my wife's now ex manager is going to the head of HR to protest. Fingers crossed this all ends soon.

Again...some people have to learn the hard way. You are so out of touch with what HIPAA actually constitutes...it's not even worth discussing. Get a healthcare license..then you'll understand.

Good luck.

Specializes in OR, Nursing Professional Development.

Working on another floor is only part of the issue. The opening of another unit’s patient list in and of itself is enough of a violation. I can’t decide I just want to randomly take a look at the patients listed in ICU when I don’t work there just because one of them might need to come to the OR. Continuing to press the issue would not be wise.

4 Votes

HIPAA regulations are based on "need to know". If you don't need to know anything about that patient, right now, you don't need access to their chart.

Telemetry nurses work as a team and they need access to any patient chart that is currently receiving telemetry. They cannot, however, look up patient charts that are not on telemetry...HAVING ACCESS is not the same as having the right to look.

Case Managers usually have the capability of pulling up every chart of every patient in the entire hospital. They can only access the patient charts on their assigned floor for the day and any patients they are helping with if another case manager is running behind--it doesn't give them the right to see how Joe Cool is doing on another floor.

OR, ICU, or any other floor is notified when a patient is being transferred from the ER or from another floor. Until that happens you don't have the right to access that chart.

Some RNs in some hospitals, also have the capability, of pulling up every patient in the hospital because any day they come in they may get pulled to work in other floors. It doesn't mean if they are working in ICU or PCU they can constantly pull up the ER holds/admissions to see who may be coming up. If the patient comes up, then you "need to know" about that patient, but until you have received that patient, what is going on in the ER, is frankly, none of anyone's business.

The House Supervisors have access to the full ER and the entire hospital because they are responsible for patient/staffing flow. They need time to call in staff, etc.

You are confusing "having access" to actually "pulling up" charts. These are not the same thing. HIPAA requires you have access to only the patient care areas where you MIGHT work, but HIPAA and professional standards also place a degree of trust in every healthcare professional to use HIPAA appropriately and not access charts for patients where they are not assigned or assisting another healthcare professional.

4 Votes

Honestly i'm sorry this happened to your wife. I think we have gone a little crazy on the HIPAA front but sadly it is how it is:

1) Looking at the charts of any patient who is not in your care, right now, is a HIPPA violation. Checking on potential future patients or past patients even with the best of intentions is a violation.

2) Computer access is set up by tech guys, they make mistakes. I have had to precept more than one nurse with the exact same job/ unit as me with access that has been configured totally differently to mine. Normally someone in IT gave them the wrong access, whoops it happens. Also if a nurse floats to the ER or had worked there in the past they would have a different access to your wife's potentially allowing them to see more about these patients.

3) Your wife states all the nurses look and that many nurses can see the diagnosis without clicking "view". Right here is why your wife was fired and they weren't. Your wife viewed/ accessed the charts of patients not in her care. If the others nurses can see the chief complaint without opening the chart even though their intent was the same and they may end up with exactly the same information only one action actually breaks the rules. Is that unfair, of course it is. Is it an excuse you wife could use as a defense? I doubt it, but i'm a nurse not a lawyer.

4) I really can't see how the Whistleblower act would apply here. Your wife wasn't retaliated against for reporting an issue. She was accused of breaking a rule and after they found evidence- viewing charts of ER patients, she was fired for the violation.

5) I've never been licensed in NY but a lot of states I have been licensed in required you to self report issues like this or at a minimum disclose them when you renew your license. I would suggest she carefully read the information on the BON website.

6) Sadly although she had accepted another position and had a letter of resignation in her pocket when all this happened, hospitals do sometimes refuse to accept resignations and choose to list the person as fired with HR. If it's legal to do so in your state is a question for a lawyer. It's also worth noting that most employers ask if you have ever been fired and a few other very broad questions about employment history and will fire you if they find out down the line you withheld information.

I hope you find some sort of legal assistance to guide you through this. I personally would thing the getting qualified legal advice is an urgent priority right now. Best of luck.

1 Votes
Specializes in EMS, ED, Trauma, CEN, CPEN, TCRN.
On 6/12/2019 at 11:26 AM, Jory said:

Case Managers usually have the capability of pulling up every chart of every patient in the entire hospital. They can only access the patient charts on their assigned floor for the day and any patients they are helping with if another case manager is running behind--it doesn't give them the right to see how Joe Cool is doing on another floor.

Yep! Having the capability of seeing a patient list or chart does not give me the right to view it. I work in infection prevention/epidemiology and I have access to all patients on all units; however, unless I am covering for a coworker who is out, I only do infection surveillance on my assigned units.

Our charting system shows very clearly who has accessed a patient's chart, I can see all the names myself, including mine. It could be that in pulling up the individual patient to view the chief complaint without actually clicking into the chart put the OP's wife's name on the "accessed" list. Either way, it's none of her business what is in the ER until she has a patient from the ER assigned to any of her beds. Doesn't matter what anyone else is doing. If she clicks in to view a chief complaint on a patient that she will never see and now knows that John Smith is in the ER for a small bowel obstruction, how does she have the right to that information? She doesn't.

2 Votes
Specializes in Medsurg.

move on. Nurses resign all of the time employers get mad that you quit then fire folks. Been going on a very long time. MOVE ON. If you get reported to the BON get a lawyer, if ocr or hhs get a lawyer. just say the pt was in the ER. I thought he would be assigned to me, I wanted to be prepared to take care of him, I ended up not getting assigned the patient. It was only for a few seconds and you have no recollection of the patients name or condition. THE END.
She may have ticked off the wrong person somewhere and they were looking, she might have been a few months shy of being vested (common). Or they might be able to find someone cheaper.

Charge nurses get alerted to possible admits all of the time and we usually tell our nurses. Hey there is MR £€>#% in the ER that might get admitted. They will go in room &$) and will need a sitter Or not the nurse usually looks this up. And sometimes the patient gets sent to step down instead.

Always guard the passwords. Always lock the computer if you have to leave it. Do not look over anyone’s shoulder at a patient file when someone else is logged in. Do not leave your computer unlocked for a second. Do not ever use a company computer to do anything personal EVER not even a simple google search that you can’t justify. Do not use hospital WiFi on your smartphone always use cellular data. Never use company email for personal business ever. Never comment anything on Facebook during working hours and lock up your Facebook so tight it squeaks. Don’t discuss anybody’s names This includes places that sound like names. while in the work place. I almost had a hipaa violation.
Sometimes it is not what actually happened but what it looks like happened. I went on vacation to London in 2013. I was excited to get back and tell everyone about the trip. I was in the elevator and told a coworker “London was great but I thought buckingham palace was a little run down and the city smelled like diesel. A little old lady heard “buckingham rundown smelled”and thought I was talking about a patient.
She filed a Well meaning complaint for mr buckingham.
I had to sit before a board of about 7 administrators and hipaa compliance people (That flew in)(they were there for other stuff too I hope ) sitting around a very nice conference table drilling me about violating the patients trust and family members trust. I was able to prove I was talking about buckingham palace, the nurse I told backed me up and I had pictures of the palace date stamped the week before the complaint, Passport stamps and travel documents.
There were no patients named With a first or last name buckingham Or a first or last name of palace in our entire computer database.
That was my saving grace.
They asked we not discuss any names of ANY persons or places while in the elevator.
These were federal investigators drilling me and they were very intimidating, this went on for What seemed like hours before they let me explain.
So if I could get in this much trouble for this and the stress associated with it. I can only imagine how bad it could have been if there had been an inkling of a violation. They never did punish me for it. It was never put in my personnel file. And I haven’t thought of this in 6 years. Move on.......
I retired from there 5 years later.

1 Votes

To the OP:

When you are responding within a quote to another poster, it's not always easy to tell which are your words and which are the words of the poster to whom you are replying. I quit trying to figure it out.

If you are going to post within the quote, could you please consider putting your responses in bold or italics? That would make it easier for the reader.

+ Add a Comment