RE: HIPAA

Cotterwood · March 2003

I believe my General Manager just violated the privacy rights of one of our employees, and of course the damage is already done.

Just want some feed back.

We have an employee who has a W/C claim going with her past employer (since 1995). They are now trying to say (as is she) that the working conditions here have exasparted the condition. (you know - the more pockets to dig in the less painful for the primary insurance carrier theory) The employee has never processed a W/C claim with us. However, as soon as I saw the paperwork from the previous employer's W/C attorney, I sent our employee a W/C to complete and return - which she has not yet done.

I just found out this Tuesday, that all her personal medical information regarding this claim (with past employer) was included in the Board Book to all the Board of Directors (5); plus copies to the General Manager, District Clerk, Assistant GM, and Treasurer. She never signed a authorization to release that info - and yet it was copied into a Board Book for people having no need to know to review.

At this point I feel the only people that have a right to review the information is our W/C carrier, since the other carrier is trying to get us to take some responsibility for their client's 'problem.'

Yes, we have an attorney - but I can't believe mgmt got an OK to do this.
I just love it when Mgmt doesn't bother to ask before stepping.
So anybody have any words of wisdom?

Parabeagle · March 2003

Aside from telling whoever put the documents in the Board Book that they have just committed the gravest sin imagineable and that they must be dumber than a box of rocks, I would suggest going to your supervisor and quietly explaining that your company is in BIG trouble unless all copies of the documents can be retrieved and secured. Even at that, if word gets out to the employee that her medical information has been compromised, her attorney will have a field day!

sonny · March 2003

Ditto the above. I can not imagine what posessed someone to distribute like that? If I was the employee and found out, I would be livid! Good luck, I am afraid you are going to need it.

Don D · March 2003

Sonny: If you get livid, don't let 'em know. It'll be spread upon the minutes of the board.

HS · March 2003

I'm assuming that in those documents there was PHI? Meaning, did it list her name (or other personal info) as well as her condition? If so, then yes, you do need to get all copies of that back immediately. Unfortunately it won't end there though. All those people who now know about her name and condition can't tell anyone else who isn't on a need to know basis. I'd have an attorney draft up some sort of confidentiality agreement for them to sign. I'm not extrememly well versed in HIPAA, but I can navigate around it and this definitly will have heavy implications, fines and or jail time for all those involved.

My advice? Seek help immediately!

Don D · March 2003

On this same note, our Safety Manager publishes a monthly narrative including injuries and incidents. The distribution list is limited but does include a few junior managers. When I got here, I had him split the report: One including the names and one omitting personal identifying information. The one with the names goes only to me and the two owners of the company. Even before the requirement about medical confidentiality, I was really antsy about this personal detail, even though business related, going out in memo form, unrestricted. I caught some flack for this, being told I was making a mountain out of a molehill. Now, with the new HIPAA requirements, I am able to defend my molehill.

Meg · March 2003

I may be mistaken, but if the infomraiton is all related to a workers comp claim then you may be okay. Workers comp does not fall under HIPAA. It would be another stroy if the infomration was out there prior to anyone having mentioned workers comp...right?

System · March 2003

It sounds like you have a real dilly on your hands. Technically the HIPAA compliance does not legally take effect until April 14, 2003, but all companies have had some sort of privacy procedures in place for a long time - or at least they should. How did you happen to come by the W/C information to begin with? Most EE's do not initally provide that information. IF her former W/C carrier or previous employer sent it to your company seeking relief with her excerbation claim, then your company may not be the only one at fault. It is my understanding that any information released to another entity has to have a release from that individual to do so. Forms are usually signed for release when the injury occurs, ER releases are also required as well as other health provider services when the patient is referred. Just a few more things to think about. Good luck.

blw · March 2003

Laws authorizing you to have medical information, such as FMLA and W/C, are exempt from HIPAA. However, it would still be a good idea to have procedures in place to limit the distribution of personal medical information. Good Luck. Barbara

JeannieS · March 2003

Help! I was reading some questions/answers regarding a checklist for the HIPAA privacy act that is effective 4/4/2003. I had to log off and now I can'f find it. Can I get one faxed to me? My fax number is 978-656-5810.

RE: HIPAA

Comments