1. Privacy & Security
ABC Family Practice

2. HIPAA – Protecting Our Patients
It was recently brought to our attention that you where violating a HIPAA regulation.
A patient’s medical records were released to someone WITHOUT the patient’s authorization form.
Regardless of your relationship with the person picking up the records or by verbal agreement to bring the authorization by later. No records are to leave without having the patient’s signed authorization.

3. Privacy & Security Issues
Allowing the Electronic Health Records (EHR) to leave this office without the patient’s authorization
The patients information is accessible and can be used for illegal purposes.
Identity theft
Violation of the patient’s right to know who has access to their information.
HIPAA Security Rule requires us (the entity) to appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information.
HIPAA Privacy Rule establishes national standards to protect individuals’ medical records and other personal health information.

4. Risks & Legal Consequences
Civil and Criminal penalties.
Civil penalties for noncompliance can have OCR impose civil money penalties.
Loss of employment
Payment of fines ranging from $ per violation to $50, per violation. Not to exceed the annual maximum of $1.5 million.
LEGAL CONSEQUENCES
Criminal violations of HIPAA are handled by the Department of Justice. (DOJ)
Payment of fines up to $50, and imprisonment up to 1 year in jail for some violations
Payment of fines up to $100,000. and imprisonment up to 5 years in jail for some violations
Payment of fines up to $250, and imprisonment up to 10 years in jail for some violations.

5. How Can We Prevent This?
Check that the person your are releasing PHI & EHR to has the proper authorization from the patient.
View HIPAA Regulations, Privacy and Security Rules so there is a clear understanding.
If you are unsure of any situation ask myself your HIM or any supervisor.

6. Scenarios Proper way to handle ROI: Incorrect way to handle ROI:
Employee of law office requests Mr. Smith’s medical records and personal health information. You need to see if Mr. Smith has signed an authorization permitting his law office to access his information. Once you verify the authorization form and his signature, you can release his information.
Incorrect way to handle ROI:
Your neighbor who works for Jones and Jones Law Office comes in requesting the medical records and personal health information for our patient Mr. Smith. She says she has a authorization from Mr. Smith allowing the law office access to his medical information. She didn’t bring the form and is on a tight schedule, she is unable to run back to the office for it and promises to bring it tomorrow morning. There is also no authorization signed in our office approving this release of information. You know she is a good person, so you release Mr. Smith’s information to her, reminding her to bring the authorization tomorrow. You never received the authorization, violating Mr. Smith’s rights under HIPAA.