HIPAA violation repercussions?

[lockian]

.
Now that I've gotten my answer, I'm deleting the post.

---

Members don't see this ad.

 

[nlax30]

Eh, I think you did exactly what you needed to do. Immediately spoke with your PD and the compliance officer and certainly sounds like N honest mistake.

I would just write down the timeline and who you spoke with just so you have it documented just in case someone does raise an issue. I guess in hindsight the only thing you could’ve done differently was to get something in writing or officially documented by that first compliance officer you spoke with, though maybe you did.

Regardless, not much to do about it now and not doing yourself any forgoes obsessing over it. Wait till next week and relax.

 

[Raryn]

Earlier this week, on Tuesday, I was looking for a patient's chart in an effort to put a chart closure note since they have not returned my calls and a letter I sent them for missing appointments bounced, and thought I remembered the name accurately, but I didn't. When I typed in what I though was their name, but it turned out to be totally the wrong person. Now, it took me a couple clicks and a total of about a minute to realize this -- initially I was confused, why does none of this info look familiar? is the EMR broken? have things changed *this much* since I last saw them? and why the heck was this name on my mind for the last hour if it's not my patient? I closed the chart as fast as I could, but like I said, I was in there for a minute and clicked a couple tabs. But I couldn't even recall what I concretely saw as far as medical or personal information goes.

Well, then it hit me. The name I thought was the patient was someone who works at my clinic's front desk, from whom I routinely get emails and administrative mychart messages. I don't think I ever met them. Their *first* name is the same as the patient I was looking for, but the last name was way off. Like I said, I have no idea why I made such a boneheaded move except I was tired and stressed and not firing at all cylinders.

I told my PD right away, then told our HIPAA compliance office who took down my name and the patient's. They said "sounds like an honest mistake, happens all the time." Next day, I got a generic email thanking me for my report and saying they've made a note of it in case future questions come up about it.

But on Friday my PD emailed me to ask who I talked to in the compliance office and not explaining why he needs this information. This makes me think some kind of investigation may be afoot. I emailed him to ask what's going on, but obviously it's the weekend by now so he has not replied.

At baseline, I am a pretty good resident, PG3 in an above average psychiatry residency. I have my strengths and weaknesses like anyone else, but my evals are solid, people like me, never been in trouble for anything.

I'm so worried about losing my job it's rendering me almost nonfunctional. I've done nothing all weekend except look up HIPAA violation issues and my institution's policies (which are all frustratingly vague, from "verbal warning" to "termination"), and found nothing but horror stories that say yes, you can get fired for a simple mistake.

Reasonably, though... will I get fired? will this haunt me through my career?

I mean, was I grossly negligent? I don't know how they would determine that. I KNOW I should not have used a shortcut and relied on my memory, that much is clear. I should've just scanned my clinic patient list which I have saved in the EMR or referred to the letter to the patient that bounced as I was looking up the chart. I learned my lesson and I don't want to lose my career over this.

As long as the chart you looked at isn't an employee of the hospital or a celebrity

1) No one would have ever found out

2) It's highly unlikely anyone at this point cares

You're not going to be fired.

 

[lockian]

As long as the chart you looked at isn't an employee of the hospital or a celebrity

1) No one would have ever found out

2) It's highly unlikely anyone at this point cares

You're not going to be fired.

Well they are an employee, but I'd forgotten that they were an employee when I was looking up the name. Hence the question of "why is this name on my mind when they don't seem to be my patient?" Not anybody especially important or anyone I work with closely, but I get emails from them occasionally so that must've been how their name sidled its way into my mind.

But since they *are* an employee, that's a bit part of my worry in all this.

 

[deleted859535]

I closed the chart as fast as I could, but like I said, I was in there for a minute and clicked a couple tabs. But I couldn't even recall what I concretely saw as far as medical or personal information goes. ... I told my PD right away, then told our HIPAA compliance office who took down my name and the patient's. ... At baseline, I am a pretty good resident, PG3 in an above average psychiatry residency. I have my strengths and weaknesses like anyone else, but my evals are solid, people like me, never been in trouble for anything.

I doubt you'll have any serious fallout from this. The snippets above are why, especially those bold parts.

 

[Raryn]

Well they are an employee, but I'd forgotten that they were an employee when I was looking up the name. Hence the question of "why is this name on my mind when they don't seem to be my patient?" Not anybody especially important or anyone I work with closely, but I get emails from them occasionally so that must've been how their name sidled its way into my mind.

But since they *are* an employee, that's a bit part of my worry in all this.

I'll addend my statement

1) It's likely no one would have found out, but since it's an employee you might have triggered an alert somewhere...
2) ... so it's a good thing you fessed up. Given you did, it's fairly unlikely you'll run into any trouble at this point.

Regardless, there's literally nothing you can do to change it at this point. Sit down, have a beer, and watch some netflix. You'll be fine.

 

[lockian]

I'll addend my statement

1) It's likely no one would have found out, but since it's an employee you might have triggered an alert somewhere...
2) ... so it's a good thing you fessed up. Given you did, it's fairly unlikely you'll run into any trouble at this point.

Regardless, there's literally nothing you can do to change it at this point. Sit down, have a beer, and watch some netflix. You'll be fine.

And what about all the people who get fired because they access a celebrity's record (or someone uses their credentials to do so on an unattended computer)... There was a resident at my institution who got fired for snooping on a fellow resident who was hospitalized, though I am not aware of the details. Perhaps a salient question is what functionally differentiates snooping from accidental access? Maybe time spent in chart and how much of the chart you looked at, but when both are limited, as they are in my case, it's ultimately my word and the fact that I reported on myself, is that what you're saying?

 

[Raryn]

And what about all the people who get fired because they access a celebrity's record (or someone uses their credentials to do so on an unattended computer)... There was a resident at my institution who got fired for snooping on a fellow resident who was hospitalized, though I am not aware of the details. Perhaps a salient question is what functionally differentiates snooping from accidental access? Maybe time spent in chart and how much of the chart you looked at, but when both are limited, as they are in my case, it's ultimately my word and the fact that I reported on myself, is that what you're saying?

Yes.

You weren't caught. You noted a mistake and volunteered the information. That's the big difference.

 

[Crayola227]

Yeah, it basically depends on the details as well as how much fuss is kicked up, and how much the hospital feels at risk. Like anything from jaywalking tickets to speeding to murder, everything depends on enforcement and what wiggle room there is in applying laws/policy, and where people can/want to stick it to you vs let things slide. Good luck.

 

[hello1234!]

I’ve done this before, accidentally looking up fellow pcps name in same hospital system instead of pt name... ... but it was so brief I didn’t even think about reporting it ... now if it were a celebrity chart that I accidentally clicked on I would report that immediately

 

[RangerBob]

This happened to me in residency. The details are a bit fuzzy, but I got some page mistakenly sent to me while on call (or it was just worded badly-can’t remember. Maybe there was no call back number and just a name?). I looked up the name. I was wondering why an SCI patient had so few notes in the system and am reading through notes to try and figure why I was paged about this patient. I eventually see an employee health note (not worded that way since it was the VA though) and realized at that time it was another resident.

I called the compliance officer right away and they took down my name and info, who’s chart I accsessed, etc. nothing further came from it.

Honest mistakes happen. Sounds like you did the right thing.