How HIPAA Violations Can Surprise You

EDITOR’S NOTE: This is a fictional story that could become much too real.

In the bustling corridors of General Hospital USA, the heart of the administrative operations pulsed with urgency. The hospital’s CFO, Jennifer Morgan, was wrapping up a conference call when a soft knock on her door interrupted her train of thought.

“Come in,” Jennifer called out, her voice steady and authoritative.

The door opened to reveal the hospital’s Compliance Officer, Mark Davis. His usually calm demeanor was clouded with concern, a sight that made Jennifer’s own sense of unease grow.

“Mark, good to see you. What’s on your mind?” she asked, gesturing for him to take a seat.

“Jennifer, we have a serious issue that needs immediate attention,” Mark began, his tone grave. “It’s about our accounting system. I’ve discovered some invoices attached to it that contain patient information. This is a clear HIPAA violation.”

Jennifer’s face paled slightly as she absorbed the news. “How did this happen?” she asked, leaning forward, her eyes locked onto Mark’s.

Mark sighed, running a hand through his graying hair. “It seems that some of the invoices were uploaded by mistake. These invoices include patient names, treatment details, and other protected health information. Our accounting system isn’t HIPAA compliant, which means we’re in breach of the regulations.”

Jennifer took a deep breath, trying to process the implications. “How many invoices are we talking about?”

“From what I’ve seen so far, it’s about a hundred,” Mark replied. “But we need to conduct a thorough audit to identify the full scope of the issue.”

Jennifer nodded, her mind racing. “We need to act fast. The first step is to remove those invoices from the system immediately. Can you coordinate with IT to get that done?”

“Already on it,” Mark said, a hint of relief in his voice. “But we also need to inform the affected patients and report this breach to the Department of Health and Human Services. It’s crucial that we handle this by the book to mitigate any potential penalties.”

“Agreed,” Jennifer said, her tone resolute. “Let’s also ensure we have a team to review our current procedures and prevent this from happening again. We’ll need to provide additional training to our staff on handling patient information.”

Mark nodded. “I’ll get started on the breach notification and coordinate with our legal team to draft the communications for the affected patients. We need to be transparent about this mistake and reassure them that we’re taking all necessary steps to protect their information.”

While this is just a work of fiction, I want to demonstrate how easily hospitals and other healthcare providers can get caught in HIPAA violations when you assume that all of the systems in the organizations are HIPAA compliant.  Now is always a good time to talk to your compliance officer about which hospital systems are HIPAA compliant.  Even if certain software is compliant, you also need to make sure your organization has a “Business Associates” agreement with the vendor.