Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

This post is co-authored by Kimberly M. Wong and Cory J. Fox.
HHS OCR announced <a href="http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/shasta-agreement-press-release.html">today</a> its second <a href="http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/shasta-agreement.pdf">resolution agreement</a> of 2013.&nbsp; Shasta Regional Medical Center (SRMC) has agreed to pay $275,000 and enter into a comprehensive corrective action plan (CAP) to settle an investigation opened by HHS following a Los Angeles Times <a href="http://articles.latimes.com/2012/jan/04/business/la-fi-hiltzik-20120104">column</a> identifying two SRMC leaders who met with media to discuss medical services provided to a patient.&nbsp; The CEO and CMO revealed the patient&rsquo;s full chart to the patient&rsquo;s hometown newspaper, Redding Record Searchlight, and revealed the patient&rsquo;s medical exam results to the Los Angeles Times.&nbsp; The two SRMC leaders disclosed the patient&rsquo;s information in response to a California Watch <a href="http://californiawatch.org/health-and-welfare/prime-hospital-bills-malnutrition-patient-says-she-wasn-t-treated-14055">article</a> regarding the federal and state investigations of Prime Healthcare, SRMC&rsquo;s owner, for fraudulent billing under Medicare and Medi-Cal.&nbsp; Senior management at &nbsp;SRMC also disclosed the patient&rsquo;s information to the entire SRMC workforce.&nbsp;
Specifically, OCR&rsquo;s investigation indicated that:
<ul>
<li>SRMC failed to safeguard the patient&rsquo;s PHI from impermissible disclosure by intentionally disclosing PHI to multiple media outlets on at least three separate occasions without a valid written authorization from the patient;</li>
<li>Senior management at SRMC impermissibly shared details about the patient&rsquo;s medical condition, diagnosis, and treatment in an e-mail to the entire workforce; and</li>
<li>SRMC failed to sanction its workforce members for impermissibly disclosing the patient&rsquo;s records pursuant to its internal sanctions policy.&nbsp;</li>
</ul>
In addition to the settlement amount, SRMC agreed to a corrective action plan (CAP) that includes a one year period of compliance obligations.&nbsp; Specifically, the CAP requires SRMC to revise its policies and procedures to attain the following:
<ul>
<li>Provide guidance and procedures on appropriate administrative, technical, and physical safeguards to protect PHI from intentional or unintentional use or disclosure for (i) media inquiries and (ii) that define PHI as it relates to individually identifiable health information;</li>
<li>Train SRMC workforce members who use and disclose PHI to ensure that they know how to comply with SRMC&rsquo;s revised policies and procedures;</li>
<li>Provide guidance and procedures that address permissible and impermissible uses and disclosures of PHI (i) for media inquiries, (ii) workforce members who are not involved in an individual&rsquo;s care, and (iii) that define PHI as it relates to individually identifiable health information; </li>
<li>Apply sanctions against SRMC workforce members who fail to comply with SRMC&rsquo;s revised policies and procedures; and</li>
<li>Provide guidance and procedures regarding (i) what is individually identifiable health information and PHI, including what is required for PHI to be unidentified; (ii) communicating with, and respond to, media, including in regarding to patient-related inquiries, and (iii) sharing of patient PHI within SRMC, including sharing of patient PHI with SRMC workforce members not involved in the provision of or payment of care. </li>
</ul>
In addition, 15 hospitals and medical centers in California, Nevada, Pennsylvania, and Texas under the same ownership and operational control as SRMC must submit affidavits attesting to their understanding of restrictions on uses and disclosures related to media inquiries.&nbsp;
SRMC&rsquo;s resolution agreement, OCR&rsquo;s fourteenth resolution agreement to date since 2008, brings OCR&rsquo;s civil monetary penalty total to $15.2M.&nbsp; The SRMC resolution agreement falls within the two types of action/inaction categorized by Director Rodriguez in <a href="https://www.dataprivacymonitor.com/hipaahitech/hhs-ocr-director-leon-rodriguezs-dialogue-on-hipaahitech-compliance/">May 2013</a> as ending up in an OCR monetary enforcement scenario:&nbsp; (1) an ongoing failure to comply with the HIPAA Privacy and Security Rules, and (2) an unforgivable disclosure.&nbsp;

Hospital Disclosure of PHI to Media and Workforce Results in $275,000 Fine