Need Advice, please help! (HIPAA)

[StarNurse2006]

I really hope that you all can help me with your opinions/professional knowledge on this topic:

I am a nurse in a LTC. I have been caring for a particular patient for the past year. During this time her family has been very involved and has had a hand in all of her care, decisions, finances, etc. She is her own responsible party, but I believe her son has POA. She has never had any problem with her son and daughter in law having a hand in her care, and has in fact, encouraged them to advocate for her.

She was recently discharged to home. She is now living with her family down the street from me. As you can imagine, we have all developed a good relationship and so I thought nothing of her daughter stopping by yesterday to say hi and update me on how she is doing at home. She asked me about some labwork we had been waiting for, stating that the home health agency needed it and no one at the facility had updated her when she called. I told her that to the best of my knowledge there had been a snafu (an error on the part of the nurse/facility) and that she should perhaps either ask it to be repeated by home health or she could call me on my next day on and I would look into it. She thanked me, we chatted some more, and she left. I completely forgot about the encounter.

I got a call from my boss last night, and she very rudely informed me that I had violated HIPAA. She told me not to come to work for the next 3 scheduled days and to come sign my write-up when I returned. I didn't say much on the phone because I was baffled. Here was a patient who was no longer our patient, and I gave information to the very same person that we gave all information to every day for the past year. I believe that she was upset because she got called out by the family for letting the ball drop on the labwork. Her tone and the way she spoke to me said "retaliation" rather than actual concern for the situation.

I am not trying to give too much info here, but from this can someone please tell me if I was in the wrong? At this point, I have no intention of signing the write-up, but I fear for my job. All opinions are welcomed!

Thanks!

[FireStarterRN, BSN, RN]

I agree, it sounds like she's using HIPPA as a weapon to punish and scare you, inappropriately. How is saying that there must have been a snafu about lab results a violation of HIPPA?

You may have violated some unwritten company policy not to speak for the organization off the clock, but not HIPPA. Next time, advise her or anyone else to call the facility or doctor's office and request that they track down the missing lab results instead of offering to help.

Your supervisor is way off base with her accusations.

[nurseshepherd]

I totally agree with Chatsdale, you need to go in prepared with a written statement of facts to safeguard yourself. I would not sign a thing until I hand wrote my statement on the write up. You can hand them your typed version of what happened (in detail), but I'd write on the write up form as well to make sure my side of the story doesn't get misplaced. It does not sound like any PHI was shared and the NM probably got raked over the coals for the lab snafu and is taking it out on you. Good luck!

[nurseshepherd]

Don't forget, you can always file a grievance if you feel you have been wronged. You may not want to do this initially, but if this matter is not resolved, you may want to consider it. Lots of folks are uncomfortable with this but is is a necessary tool sometimes. You would need to send a letter to your NM stating your case and send a copy to her supervisor. A formal typed letter would be best, but handwritten will work too. I only know of 2 people who have ever done this, both involved poor evaluations from vindictive NMs and both were given better evaluations after administration told them to redo the evals (1 was leaving anyway and just wanted his eval to reflect his level of performance and the other is still employed by the hospital - over a decade). I'm sure there will be others who didn't fare as well, but grievances are made for situations when you have done all you can do. Good luck and God bless.:)

[flashpoint]

I don't see the HIPAA issue at all. The daughter-in-law contacted you at home about some lab that was done while the resident was still in the facility...home health needed the lab results...you told the daughter-in-law that it sounded like something was messed up and that if she called you to remind you, that you would look into it. Is that about right?

So...what I see happening, is that someone at the facility either won't give home health a copy of the lab or won't release the information about the lab to the daughter-in-law? It sounds to me like the facility has messed up, not you.

Even if she has left the facility, she still has a right to information about events during her stay there...you were just telling the daughter-in-law to call you at work where you had access to her records and you would help her out.

I wonder what the daughter-in-law might have said when she called the facility after talking to you.

I think sometimes people confuse general confidentiality and HIPAA. Things like staffing issues or facility issues are not HIPAA. I've seen facilities lecture staff about HIPAA when they are talking about a staff member being terminated...or how much the new furniture in the lobby cost...or the fact that someone's office is being painted.

I hope things turn out OK for you!

[queenjean]

I agree with nurseshepard. I don't see where you did anything wrong.

Write up your version of the events (including your conversation with the NM), send copies to your NM, her supervisor, and HR. Request that a copy be placed in the HR department's file, and you keep a copy at home.

If there is a meeting, do not sign anything unless your version is a physical part of the paper, AND you understand everything that is on what they want you to sign. If you *don't* then you need to lawyer up. Tell them you aren't signing it without your lawyer present. You DO NOT want to inadvertantly sign anything that may indicate that you violated HIPAA laws (if your version of the events is indeed correct, it sounds like you did not).

Have a little compassion for your NM, though. I wonder how the family approached her? Could they have become angry with her, saying something like "StarNurse told us you completely f'd this up! She had to be the ones to tell us about the lab results! If anything happens to my mother, you'll be talking to our lawyer!" You really don't know how that situation played out, and it might have been very different than what you imagine, you know? The family might have implied somehow (intentionally or not) that you did in fact give out protected medical information. You definitely need to get your version of events out there.

Based on what you have presented, though, it sounds like your NM is taking things out on you.

Good luck.

[Thornbird]

I would definitely file a grievance on this. It is in no way HIPAA related. You gave the woman no info that she did not already have. Doesn't matter who the POA is, if a patient hasn't objected to information sharing with a particular person, it's OK. The laws were recently updated.

In the future, though, remember that once the patient is discharged you can't help them with any issues that happened while they were your patient. You should have just said there may have been a "snafu", they should follow up with the current providers. In most facilities where I have worked, all access to the patient records is removed once they are discharged. If you access these records, it is a HIPAA violation because you are no longer entitled to PHI. The exception being if you have a need to make a late entry or sign something already in the records.

If you didn't actually access the records, you have not violated HIPAA.

[Pauligirl]

If the poster of this thread actually looked up the medical information of a former patient (the neighbor) I can understand how this could be considered a HIPAA violation and/or violation of the workplace confidentiality agreement.

Caring for a patient doesn't give us the right to look up the patient's medical information when we are no longer directly caring for the patient. So when a patient is transferred to another unit or discharged we are not permitted to pull up the medical record out of concern, curiosity, or what not.

From what I've seen a lot of the HIPAA regulations are open to interpretation which is probably why most if not all facilities have their own guidelines and confidentiality agreements. And even then it is still confusing!

[StarNurse2006]

If the poster of this thread actually looked up the medical information of a former patient (the neighbor) I can understand how this could be considered a HIPAA violation and/or violation of the workplace confidentiality agreement.

I just want to clarify, I did not access any records. This incident occured on my day off, and now, with the suspension, I do not return to work until next week. When I told her I would look into it, it was my intention to ask the discharging nurse if she had any information, and follow up with my NM if necessary. I would not have access to her chart because she was discharged.

Thank you everyone for all of your comments and advice. I appreciate it more than you could imagine. I have no intention of signing this write-up, and right now i am just trying to get myself together to go about refusing professionally and without jeopardizing my job.

[3rdcareerRN]

My gosh, another use of HIPAA as a blunt-force management tool...

From an authoritative source -- the Federal department who writes the HIPAA rules:

A HEALTH CARE PROVIDER'S GUIDE TO THE HIPAA PRIVACY RULE:

Communicating with a Patient's Family, Friends, or Others Involved in the Patient's Care

U.S. Department of Health and Human Services * Office for Civil Rights

http://www.hhs.gov/ocr/hipaa/provider_ffg.pdf

"Even though HIPAA requires health care providers to protect patient privacy, providers are permitted, in most circumstances, to communicate with the patient's family, friends, or others involved in their care or payment for care." (p.1, introduction)

and

"If the patient is present and has the capacity to make health care decisions, a health care provider may discuss the patient's health information with a family member, friend, or other person if the patient agrees or, when given the opportunity, does not object. A health care provider also may share information with these persons if, using professional judgment, he or she decides that the patient does not object." (p.1, item 1)

[HappyPediRN]

My gosh, another use of HIPAA as a blunt-force management tool...

From an authoritative source -- the Federal department who writes the HIPAA rules:

A HEALTH CARE PROVIDER'S GUIDE TO THE HIPAA PRIVACY RULE:

Communicating with a Patient's Family, Friends, or Others Involved in the Patient's Care

U.S. Department of Health and Human Services * Office for Civil Rights

http://www.hhs.gov/ocr/hipaa/provider_ffg.pdf

"Even though HIPAA requires health care providers to protect patient privacy, providers are permitted, in most circumstances, to communicate with the patient's family, friends, or others involved in their care or payment for care." (p.1, introduction)

and

"If the patient is present and has the capacity to make health care decisions, a health care provider may discuss the patient's health information with a family member, friend, or other person if the patient agrees or, when given the opportunity, does not object. A health care provider also may share information with these persons if, using professional judgment, he or she decides that the patient does not object." (p.1, item 1)

In light of this information, you should print it out and bring it with you. Refuse to sign the write-up and then demand your three days pay back. Make it clear in no uncertain terms that you will legally pursue this if she refuses. After you get what you want, find another job because your wasting your skills in that toxic environment.