HIPAA, the Health Insurance Portability and Accountability Act of 1996, was passed to protect an employee’s health insurance coverage when they lose or change jobs. It also has provisions to ensure the privacy and confidentiality of identifiable health information.
Everyone’s medical situation is different; however, this article strives to help define HIPAA by providing you with an overview of some common HIPAA violations experienced by health care providers and patients. Links to HIPAA experts are provided at the end of this article for your specific questions.
10 Common HIPAA Violations
- Failure to adhere to the authorization expiration date – Patients can set a date when their authorization expires. A violation would be releasing confidential records after that date.
- Failure to promptly release information to patients – According to HIPAA, a patient has the right to receive electronic copies of medical records on demand.
- Improper disposal of patient records – Shredding is necessary before disposing of patient’s record.
- Insider snooping – This refers to family members or co-workers looking into a person’s medical records without authorization. This can be avoided with password protection, tracking systems and clearance levels.
- Missing patient signature – Any HIPAA forms without the patient’s signature is invalid, so releasing information would be a violation.
- Releasing information to an undesignated party – Only the exact person listed on the authorization form may receive patient information.
- Releasing unauthorized health information – This refers to releasing the wrong document that has not been approved for release. A patient has the right to release only parts of their medical record.
- Releasing wrong patient’s information – Through a careless mistake, someone releases information to the wrong patient. This sometimes happens when two patients have the same or similar name.
- Right to revoke clause – Any forms a patient signs need to have a Right to Revoke clause or the form is invalid. Therefore, any information released to a third party would be in violation of HIPAA regulations.
- Unprotected storage of private health information – A good example of this is a laptop that is stolen. Private information stored electronically needs to be stored on a secure device. This applies to a laptop, thumbnail drive, or any other mobile device.
Scenarios that Violate HIPAA
- Telling friends or relatives about patients in the hospital
- Discussing private health information in public areas of the hospital, including the lobby of a hospital, an elevator or the cafeteria
- Discussing private health information over the phone in a public area
- Not logging off your computer or a computer system that contains private health information
- HIPAA regulations for “need to know” include: The security guard in a healthcare institution needs to know the name and room number of patients to guide visitors. This is allowed; but, any other information, such as diagnosis or treatment, is not to be disclosed.
- HIPAA regulations for “need to know” include: A nurse needs access to private health information for the patients in his/her unit but not for any patients that are not in that unit.
- HIPAA regulations for “minimum necessary” include: A health insurance company will need information about the number of visits the customer had; but, isn’t allowed to view the entire patient history.
- Allowing members of the media to interview a patient in a substance abuse facility
- Including private health information in an email sent over the Internet
- Releasing information about minors without the consent of a parent or guardian
HIPAA regulates the use, transfer, and disclosure of identifiable health information. With these examples of common HIPAA violations, you can probably better understand HIPAA and the types of behaviors it prohibits.
If you are looking for specific information about HIPAA or about a specific medical situation, these resources provide more detailed information about the law and what it does/does not cover:
- National Institutes of Health – Education materials including .pdf files with the actual HIPAA wording, Office for Civil Rights HIPAA Guidance, HIPAA Privacy Rule, decision tools for Medicare and Medicaid services and the final HIPAA Enforcement Rule
- HHS Frequently Asked Questions
- HHS HIPAA Complaints – Detailed information on how to file a complaint with the HHS Office for Civil Rights about a HIPAA violation.
If you have questions about how HIPAA might or might not apply in your specific medical situation, you can maintain your privacy by asking your medical care provider or by searching the HHS Frequently Asked Questions.
