DOCTOR WILSON: Thanks, ladies, for coming and speaking with me today, I appreciate that.
We do have a couple of things that we do need to discuss.
Um.
I received a call from a patient stating that they overheard you talking about another patient’s
health information.
MARY: I am so sorry.
I didn’t think we could be heard.
Sorry.
DOCTOR WILSON: And that’s understandable.
Through the course of our day, we’re trying to get things done, and we’re trying to
relay information.
We just need to make sure that we follow our policies and procedures, and that we have
those conversations in a private place so that other patients cannot hear us.
Another thing that I wanted to mention is, Mary, I received an SMS text from you regarding
the patient that you were going to reach out to, and her diagnosis, and it was great to
receive that to be notified that you were reaching out to that patient.
But it should have been through our secure texting app because it still is considered
patient privacy.
MARY: Yeah, I mistakenly sent it SMS because I was in a rush, so I didn’t use the secure
app.
DOCTOR WILSON: And hopefully there wasn’t any harm done this time at all.
But it is something that I’m going to have to speak to our privacy officer about.
I know some days it’s just going to be very hard to take out a moment to walk into another
room where patients can’t hear you.
But we need to make sure that we start practicing those steps to make sure that we’re keeping
our patients’ information safe.
PRIVACY OFFICER JENNY: Hi Doctor Wilson!
DOCTOR WILSON: Hey Jenny!
PRIVACY OFFICER JENNY: Have a seat!
DOCTOR WILSON: Thank you!
I wanted to talk to you, because we’ve had a couple of incidents and I wanted to make
sure that our policies and procedures were in place and we’ve had our updated HIPAA
training.
PRIVACY OFFICER JENNY: Oh, of course.
Let me look for the book of evidence, which has our policies and procedures, to make sure
that we are HIPAA compliant.
DOCTOR WILSON: Thank you, I appreciate that.
Can you let me know as soon as you find that out?
PRIVACY OFFICER JENNY: I sure can!
DOCTOR WILSON: Thank you.
ROB: In this scene, the office manager and nurse violated HIPAA compliance laws by speaking
about another patient’s health diagnosis in front of other patients.
They also sent an unsecured text to the doctor.
Now let’s talk about what PHI is, and how to handle it properly.
Any information that is individual to your patient, past, present or future, about the
care provided, the physical health and mental health of an individual is PHI.
This includes documentation of doctor's visits, charts, and notes made by physicians or other
provider staff.
It also includes health care payments, claim status and coordination of health care benefits.
HIPAA covers all forms of PHI including electronic, paper or oral formats.
Some people forget that PHI is covered under spoken word.
Be mindful when disclosing healthcare information with patients and business associates.
Think of PHI as classified information.
You have the clearance to see it, and your responsibility is to keep it from falling
into the wrong hands at all times.
Can PHI be Disclosed for Public Health Activities?
Yes.
But it’s limited to the CDC, public health authorities at a state or federal level and
OSHA.
OSHA can request information without authorization or the need of a Business Associate Agreement.
Covered entities must reasonably limit PHI to the minimum amount necessary.
Only give what you need to provide and nothing more.
Remember less is more when it comes to personal health information.
Here are some examples of when the government or OSHA can request PHI.
In the event of a natural disaster or state of emergency the Federal Government or OSHA
can request PHI to determine demographics of the affected area.
Why is this?
The reason why is so they can mobilize the national guard, first responders, or military
personnel to assist in the affected area.
If you are contacted by someone from the government, ensure they are legitimate employees.
Request a phone number and email address and ask them for a written request.