This is a cautionary tale.
And it could save you a lot of embarrassment – even legal issues.
The way a healthcare provider collects, uses and discloses personal health information (PHI) is critical to an efficient healthcare practice.
It’s also required by legislation and professional college regulations and standards.
Policies and procedures must be in writing, available to employees, and monitored to ensure that they are followed. Otherwise, you face all sorts of risks, including privacy breaches and other legal problems.
Don't let this happen to you!
Everyone in a healthcare practice — including front office staff, wellness practitioners and physicians and other custodians — must be aware of and follow these policies and procedures.
These policies and procedures also become the foundation of your privacy impact assessment (PIA).
That’s why, in this Privacy Breach Nugget, we’ll review a privacy breach investigation report from Alberta's Office of the Information and Privacy Commissioner (OIPC). Whether you have a new practice, or an existing practice, we have a number of services and resources designed to help you manage your practice in a way that not only meets legal requirements, but is streamlined and efficient, and keep your information secure.
What Happened
This report started with an employee suspected of accessing health information for an unauthorized purpose.
It started with at the clinic with a conflict between the employees and the employer.
An employee (Employee A) was on leave from her position at the clinic. Her access to the electronic medical record (EMR) was suspended during her leave.
Employee A wanted to access patient information to support her dispute with management. Over two months, Employee A used Employee B’s credentials to access patient records.
This action is in contravention of the Health Information Act (HIA) sections 27 and 28.
This is where this case becomes even more convoluted and, in fact, a better case study of what not to do.
Understanding the Health Information Act
The Health Information Act (HIA) requires the custodian (the physician, in this case) to take reasonable steps to maintain administrative, technical, and physical safeguards to protect patient privacy as required by sections 60 and 63 of the HIA, and section 8 of the Health Information Regulation.
In November 2013, the clinic submitted a privacy impact assessment (PIA) to the OIPC prior to its implementation of an electronic medical record (EMR).
The PIA included written policies and procedures.
The letter to the OIPC accompanying the PIA was signed by two physicians, as well as Employee A who was the privacy officer at that time.
The physician named in the investigative report is not the current custodian at the clinic. The physician was hired in 2015 and therefore not a member of the clinic in 2013 and not involved in the initial PIA submission.
During the investigation, both employees indicated that the policies and procedures to protect patient privacy were in a binder in the clinic, but it was never used or shared with the staff.
Oaths of confidentiality may have been previously signed by the employees, but the documents could not be produced during the investigation.
Section 8 (6) of the Regulation states the ‘custodian must ensure its affiliates are aware of and adhere to all of the custodians administrative, technical, and physical safeguards in respect of health information.’
It’s common practice for clinics to require employees to sign confidentiality agreements and ensure that they receive patient privacy awareness training with regular updates.
But in this investigation, the employees said they never received privacy awareness training.
Access To Patient Information
The employees also stated it was common practice at this clinic for individuals to not log off of their EMR account on the computers at the reception desks. It was common practice for other employees to access an open session to quickly perform a task in the EMR.
The investigator concluded that the physician was in contravention of the HIA section 63(1) which requires custodians to establish or adopt policies and procedures that would facilitate the implementation of the Act and regulations.
These specific findings were made:
- The custodian failed to ensure the clinic employees were made aware of and adhered to the safeguards put in place to protect health information in contradiction contravention of section 8(6) of the regulation.
- The custodian was in contravention of section 8(6) of the regulation which requires custodians to ensure that their affiliates are aware of and adhere to all of the custodian’s administrative, technical, and physical safeguards with respect to health information. It’s important to note any collection use or disclosure of health information by an affiliate of a custodian is considered to be the collection, use, and disclosure by the custodian.
- The custodian failed to ensure the employee and the other clinic staff adhered to technical safeguards as required by section 60 of the HIA and section 8(6) of the regulations.
Privacy Breach Nuggets You Need to Know
Privacy breaches are in the news every day. The more you know how breaches can affect you allows you to be more proactive to prevent privacy breach pain.
Get Your Privacy Documents In Order
To protect yourself and your practice from patient privacy breaches (and massive fines, see the conclusion to this article), follow these steps.
- Find your policies and procedures and review them with all staff and custodians. Make sure you document that this has been done.
- Review and update your privacy awareness training and ensure all staff, including custodians, have completed this recently. Make sure you have this documented, including certificates of attendance if available.
- Oath of confidentiality documents should be signed by all of all clinic staff and custodians and maintained in a secure location.
- Review your privacy impact assessment and ensure all of your current custodians have read this and understand it. Visit this post for more information to help you determine if you need a PIA amendment.
This incident occurred in 2016. The OIPC office did not recommend any additional sanctions against the clinic, physicians, or employees.
To get templates of policies and procedures for your healthcare practice, be sure to sign up for the Practice Management Success Membership
New Amendments To The HIA
This case might have turned out differently today.
New amendments, as of 2018, provide a provision for fines under the HIA ranging from $2,000 to $200,000.
The public — and our patients — expect and trust us to make sure that their personal health information is kept secure and confidential.
It’s our responsibility to make sure we have these administrative, technical, and physical safeguards in place and are maintained in a consistent fashion.
When you've done the hard work to implement your patient privacy policies and procedures and your privacy impact assessment, make sure you continue your journey and keep these documents up-to-date and current. To help you, sign up for the Practice Management Success Membership.
There are many patient privacy breaches in the news each day, and you never know when it could happen to you.
The more you know about the breaches and how they can affect you allows you to be more proactive to prevent privacy breach pain. If you need to prepare your privacy breach management plan, start your on-line training 4-Step Response Plan right away!
If you need templates of policies and procedures for your healthcare practice, be sure to sign up for the Practice Management Success Membership. These tips, tools, templates, and training will help you save time and money to develop and maintain policies and procedures in your healthcare practice.
When we know better, we can do better…
I’ve helped hundreds of healthcare practices prevent privacy breach pain like this. If you would like to discuss how I can help your practice, just send me an email. I am here to help you protect your practice.
PRIVACY BREACH NUGGETS are provided to help you add a ‘nugget' to your privacy education program. Share these with your staff and patients as a newsletter, poster, or staff meeting.
Jean L. Eaton, Your Practical Privacy Coach
Did you enjoy this article? If you’d like to look at similar posts, visit these links:
Do You Know Where Your Policies And Procedures Are?
Why Do You Need Health Information Policies and Procedures?
Healthcare Policies And Procedures: Essential in EVERY Practice
Safeguards: The What, Why, and How
When Do You Need a PIA Amendment?
When is a Privacy Breach a Privacy Breach?
References and Resources
Alberta Office of the Information and Privacy Commissioner. Investigation Report H2019-IR-01 Investigation into alleged unauthorized accesses and disclosures of health information at Consort and District Medical Society Clinic. May 21, 2019. https://www.oipc.ab.ca/media/996888/H2019-IR-01.pdf
Plan. Establish clear policies and procedures about when you will – and when you won’t – use email with patients in your practice. The provider is responsible for disclosure of information and to ensure reasonable safeguards. On a case by case basis, one needs to determine what is reasonable. You need to balance the risk with the benefit of disclosing the health information. If you aren't prepared to put in the energy (and it takes effort!) to put in a comprehensive risk mitigation program, then you should not be using email to send health information or other sensitive information.
