Let's discuss what the medic did in terms of the above 3 points. All the reference internet sites cited have no bearing on this particular thread at least for the original post. Which was the supposed violation of HIPAA in regards to the medic taking the hospital face sheet, taking the patients number from that face sheet and using it to call the patient supposedly on a follow up call but then he asks her out on a date.
How many of you medics out there request a face sheet from registration in the ED? I'll bet every single one of you do. Unless you get a good gathering of patient information along with insurance information, the face sheet is the best method to get all your billing information in one place.
Hipaa violation - I don't believe so. let's look at the three items HLPP pointed out a the end of her most recent post
Individually identifiable health information" is information, including demographic data, that relates to:
•the individual's past, present or future physical or mental health or condition,
•the provision of health care to the individual, or
•the past, present, or future payment for the provision of health care to the individual,
the phone number is included in demographic data - that's a undeniable fact but does it relate to the next three bullet points. NO I don't think it does.
Does a phone number relate to the patients past, present or future medical condition - NO
Is a phone number a required piece of information in the provision of health care to the individual - NO
does the phone number constitute part of payment for past, present or future payments for the provision of medical care? NOPE not a bit.
A phone number is a protected piece of patient data. As per my additional email question to the HIPAA lady I know, she didn't really wish to discuss it further since she had a meeting out of town she was going to but she did allow additional questions after she returned next week.
So this is possibly a HIPAA violation but she said that anyone can claim a violation at any time and it will be investigated first by the agency involved along with the OCR or it's investigated by the OCR if the report or complaint is filed directly with the OCR. (OCR = Office of Civil Rights). I would suspect that if there is a complaint made, there will be no fine but I'll bet that the agency involved that this guy works at doesn't have a HIPAA policy or it has a very weak policy.
Be that as it may, the threat of a HIPAA/OCR investigation is daunting and scary to the organization involved and it behooves you to find out what your agencies HIPAA policy is and to have them develop a policy regarding HIPAA Now sooner than later.
The medic should be punished by breaking patient privacy and maybe HIPAA violations.
Edited to clarify my friends position as well as a miswritten statement.