Investigation

[hotdish22]

I violated HIPAA by accessing a patient record that was not part of my job duties. I thankfully was allowed to keep my job since it was the first time. Since then, the patient whose record that I have accessed has made new complaints that I have discussed with others that I have seen them in the office for appointments, actively seek their appointment times out and that I have discussed with others the information that was accessed by me. Neither of these are true but I am having a hard time proving myself since I did access the file initially. I know the patient and they, to my knowledge, are assuming that it was me that accessed their record since they saw me working that evening. My employer did not disclose my name as part of the investigation according to them. Can I get in trouble based on a patients word that I am doing this?

[Wuzzie]

If you are using an EMR they can track who accessed what in the chart and when. If you truly did not access the chart any further you likely are okay but keep your computer locked down and try to stay under the radar.

[hotdish22]

Yes, we do use EMR. My worry is that the patient has claimed that I have discussed the information that I viewed with my friends and family members. It is now being investigated based on the patients claims that I not only went into the record but that I am now discussing what I saw with my friends and family.

[Wuzzie]

Well, that’s just stupid. How would they know if you talked? How can they prove it? Please tell me you didn’t.

[JKL33]

The patient has been informed (as part of the investigation) that their information was accessed by someone inappropriately and separately, because they know that you work there, they are guessing that you're the one who accessed the record? And so they've decided to create more trouble over it? Is that correct as far as you know?

I don't know....there's a decent chance your employer is going to tire of this/take definitive action. The problem is that this might have some legs that it otherwise wouldn't because you did access the record/violated the exact spirit of HIPAA (your ethics/judgment rep has taken a hit).

If you did not share the information you learned, all you can do is emphatically reinforce that fact to your employer. Also, if there is a compelling (and not totally self-incriminating) story behind why this person might lie about this you could carefully consider informing your employer. Use discretion.

[hotdish22]

Yes, but more specifically, I saw them there and accessed the record after they left. We have mutual friends but I'm not sure how the first investigation started. They probably asked for a record check which was dumb on my part since I know them and all they have to do is suspect that i might have at one point looked into their chart. We do have mutual friends but at this point I've only talked to my friends about the investigation and my punishment from that.

[Wuzzie]

The problem is that discussing the investigation at this point likely reveals too much. Probably best to not mention it at all to anyone going forward. Including here on AN.