HIPAA Violations: Nurses Allegedly Post X-Ray Photos To Facebook
Okay, here's a perfect real incident to use for a case study to argue discuss whether or not this is a HIPAA violation!
"Nurses Fired Over Cell Phone Photos Of Patient: Case Referred To FBI For Possible HIPAA Violations"
So, was this a HIPAA violation?
Here are the reported facts:
- Someone from the medical center made an anonymous call to...?...to report a nurse took photos of a patient with her cell phone and posted the photos to her Facebook page. The report does not say to whom this was reported, but it is implied it was to the Walworth County sheriff's office.
- The accused nurse admitted she took a photo, but that she never posted the photo to her Facebook page. However, she did admit to discussing the incident on her Facebook page.
- Two nurses actually each took a photo of an x-ray of a patient that was admitted to the emergency room with "an object lodged in his rectum."
- The investigators can find no one who actually saw photos of the x-ray posted on Facebook.
- The nurse removed her Facebook page last week.
- The two nurses who took photos were fired; so the hospital appears to be enforcing policies and sanctions, as HIPAA requires.
So, is this a HIPAA violation?
The hospital is a covered entity (CE) responsible for ensuring only those with a job responsibility need has access to patient information.
The x-ray certainly is a type of protected health information (PHI).
The answer will depend upon:
- Did the hospital have policies against taking photos of patient information, and did they provide training for this policy? Better yet, did they have policies against using cell phones, including photo capabilities, within the patient care areas?
- Have the nurses shown or given the photo to anyone else? Or made it available where someone else may see it?
- Did the nurse include PHI within the description she wrote on Facebook?
- Did the hospital apply sanctions against the nurses for violating patient privacy? Yes, they were both fired.
- And, if the HITECH Act were in effect right now, did the hospital report this to the patient? (I know this is not yet required, but it is good to start asking the questions now as CEs get their policies and procedures changed in preparation to be in compliance)
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine
Comments
If the patient could not be ID'd from the photo of the radiology film (no name, SSN, address, etc, could be discerned by looking at the photo of the film, even though the patient's medical condition was obvious), then that part of the incident would not be a HIPAA violation, and even under the new HITECH Act, there would be no requirement to notify the patient (because the patient could not be ID'd). If the nurses had no legitimate need to have access to the film, then that violates the Rule regarding Minimum Necessary. The hospital was right to fire them. If the hospital didn't have appropriate policies in place regarding taking cell-phone or other photos of patients and/or anything regarding a patient except for legitimate purposes, then I'll bet it does now.
Posted by: Lane Hatcher | February 27, 2009 11:13 AM
Lane, thanks for your thoughts!
An x-ray is considered as PHI under HIPAA; see the regulatory text at http://www.hhs.gov/ocr/privacy/hipaa/administrative/privacyrule/adminsimpregtext.pdf, as well as multiple government agencies for HIPAA compliance guidance, such as http://aspe.hhs.gov/admnsimp/final/pvcguide1.htm, along with NIST guidance at
http://csrc.nist.gov/publications/drafts/800-122/Draft-SP800-122.pdf.
So, the patient definitely could, under the law, be identified by a photo of the patient's x-ray. An x-ray is widely considered to be similar to a fingerprint in how it can e used yo uniquely identify an inividual. It is typically considered a biometric identifier. So, under the HITECH Act, which uses the HIPAA definition of PHI, notification would be necessary.
Yes, it is a good point to highlight regarding minimum necessary.
And I agree; any lacking policies are probably (hopefully!) now in place! :)
Rebecca
Posted by: Rebecca | February 27, 2009 2:36 PM
This is really wrong I just found out about this because I'm studying Med Sec. and I came by this reaching the Hipaa Law Violations. I'm very not happy about this I'm worried about my personal information. I can't see someone out here is that nasty to do something like this. For what reason. I just don't understand and I would like to know what people get out of this kind stuff.
Posted by: Jade | December 3, 2009 11:46 AM