HIPAA violation???

We have an ee who was recently diagnosis with the big C. He told 3 co-workers, his sup & me. I gave him the necessary FMLA paperwork. Then another ee sends out an e-mail to all users what the ee was diagnosed with along with a request for donations. This was done without my knowledge and that of the ee.

Upon receiving the e-mail I spoke to the diagnosed ee to verify if it is ok if everyone in the company knows about his condition. He said it was ok. After speaking with him I spoke to the person who sent out the e-mail. I told him I understood the reason for the e-mail but that I didn't feel he should divulge the reason/diagnosis to everyone and that the ee may not want everyone to know his condition.

What else do I need to do? We do not have any HIPAA forms for ees because we normally do not deal with any Health issues other than enrollment.
Are we in compliance on this?

Comments

  • 2 Comments sorted by Votes Date Added
  • Probably not.

    Even though this was done without your knowledge, the company's technology was used to disseminate the information.

    You did get approval, albeit after the fact. You should document this conversation and try to get the EE to sign off, acknowledging his approval of the dissemination.

    As to the EE who put it out there, document your verbal warning. Then you might consider putting out some general information about confidentiality of this sort of information.
  • Thanks marc
    I have done all of the above with exception the ee has not signed it off yet.

    Have a great weekend!

    Lisa
Sign In or Register to comment.