Public Hospital Corrects Impermissible Disclosure of PHI in Response to a Subpoena
Public Hospital Corrects Impermissible Disclosure of PHI in Response to a Subpoena
Covered Entity: General Hospital
Issue: Impermissible Uses and Disclosures
A public hospital, in response to a subpoena (not accompanied by a
court order), impermissibly disclosed the protected health information
(PHI) of one of its patients. Contrary to the Privacy Rule protections
for information sought for administrative or judicial proceedings, the
hospital failed to determine that reasonable efforts had been made to
insure that the individual whose PHI was being sought received notice of
the request and/or failed to receive satisfactory assurance that the
party seeking the information made reasonable efforts to secure a
qualified protective order. Among other corrective actions to remedy
this situation, OCR required that the hospital revise its subpoena
processing procedures. Under the revised process, if a subpoena is
received that does not meet the requirements of the Privacy Rule, the
information is not disclosed; instead, the hospital contacts the party
seeking the subpoena and the requirements of the Privacy Rule are
explained. The hospital also trained relevant staff members on the new
procedures.
| Outpatient Surgical Facility Corrects Privacy Procedure in Research Recruitment Covered Entity: Outpatient Facility Issue: Impermissible Uses and Disclosures An outpatient surgical facility disclosed a patient's protected health information (PHI) to a research entity for recruitment purposes without the patient's authorization or an Institutional Review Board (IRB) or privacy-board-approved waiver of authorization. The outpatient facility reportedly believed that such disclosures were permitted by the Privacy Rule. OCR provided technical assistance to the covered entity regarding the requirement that covered entities seeking to disclose PHI for research recruitment purposes must obtain either a valid patient authorization or an Institutional Review Board ...read more |
| Private Practice Revises Access Procedure to Provide Access Despite an Outstanding Balance Covered Entity: Private Practice Issue: Access A complainant alleged that a private practice physician denied her access to her medical records, because the complainant had an outstanding balance for services the physician had provided. During OCR’s investigation, the physician confirmed that the complainant was not given access to her medical record because of the outstanding balance. OCR provided technical assistance to the physician, explaining that, in general, the Privacy Rule requires that a covered entity provide an individual access to their medical record within 30 days of ...read more |
|
August 2025
| Su | Mo | Tu | We | Th | Fr | Sa |
| | | | | 1 | 2 |
| 3 | 4 | 5 | 6 | 7 | 8 | 9 |
| 10 | 11 | 12 | 13 | 14 | 15 | 16 |
| 17 | 18 | 19 | 20 | 21 | 22 | 23 |
| 24 | 25 | 26 | 27 | 28 | 29 | 30 |
| 31 |
Blog Home
Newest Blog Entries
1/21/25 Understanding Business Associate Agreements
11/12/22 Modernizing Medicine Agrees to Pay $45 Million to Resolve Allegations of Accepting and Paying Illegal Kickbacks and Causing False Claims
11/12/22 Indian National Charged in $8 Million COVID-19 Relief Fraud Scheme
11/12/22 Former Hospital Employee Pleads Guilty To Criminal HIPPA Charges
11/12/22 Covered entities and those persons rendered accountable by general principles of corporate criminal liability may be prosecuted directly under 42 U.S.C. § 1320d-6
11/12/22 The Delaware Division of Developmental Disabilities Services Data Breach
11/12/22 OCR Settles Three Cases with Dental Practices for Patient Right of Access under HIPAA
11/12/22 HHS Issues Guidance on HIPAA and Audio-Only Telehealth
11/12/22 Five Former Methodist Hospital Employees Charged with HIPAA Violations
11/12/22 May a covered entity use or disclose protected health information for litigation?
11/12/22 When does the Privacy Rule allow covered entities to disclose protected health information to law enforcement officials?
Blog Archives
November 2022 (54)
January 2025 (1)
Blog Labels
HIPAA Enforcement (3)
Data Breach (1)
PPP Fraud (1)
BAA (4)
ePHI (2)
EHR Fraud (1)
Telehealth (1)
Covered Entity (40)
HIPAA (2)
|
