HHS Reports $125,000 Settlement with Allergy Practice for Impermissible Disclosure
The Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) announced a settlement with an allergy practice totaling $125,000. In addition to the monetary settlement, the practice has also agreed to adopt a corrective action plan to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule.
According to HHS, a patient of this allergy practice contacted a local television station to speak about a dispute that had occurred between the patient and one of the practice's doctors. The television station reporter subsequently contacted the doctor for comment and the doctor impermissibly disclosed the patient's protected health information (PHI) to them.
OCR's investigation found that the doctor's discussion with the reporter demonstrated a reckless disregard for the patient's privacy rights and that the disclosure occurred after the doctor was instructed by the practice's Privacy Officer to either not respond to the media or respond with "no comment." Additionally, OCR's investigation revealed that the practice failed to take any disciplinary action against the doctor or take any corrective action following the impermissible disclosure to the media.
Take this example as an important reminder to be sure you are compliant with the HIPAA Privacy Rule and only share authorized patient health information. Always check authorizations before disclosing any information. Especially, as in this case when disclosing information to a reporter, where the risk of compromise to the affected individual may be far-reaching.