Question

Shirley is a deficiency analyst for ABC Hospital working from home. She is using her own personal computer and it has been linked (by hospital IT) to a secure hospital system. She has signed all the appropriate HIPAA privacy documents.

Periodically, if she sees something interesting or reviews a chart from someone she knows – she will retype this information into her personal computer and save it. To date, she has done nothing with the information other than having it in her personal possession.

Apply HIPAA to demonstrate the risk this could pose to the hospital and/or to Shirley and her boss. Is this a violation of either HIPAA privacy law or the HIPAA security rule? If so, why is it a risk? Answer these questions and develop a written response to the privacy officer regarding this situation under HIPPA including actions that could mitigate this type of risk.

Answer 1

Shirley's action of saving patient information on her personal computer is a violation of HIPAA privacy and security rules. This behavior risks the confidentiality of PHI and could lead to significant consequences for both her and the hospital. To prevent such risks, strict data security protocols and employee training must be enforced.

Retyping and saving patient information to a personal computer can constitute a significant violation of HIPAA privacy and security rules. The HIPAA regulations require covered entities and their business associates to protect the privacy and security of protected health information (PHI). By extracting and storing patients' health records on her personal device, Shirley not only risks the confidentiality of this sensitive information but also poses a potential threat to the hospital's compliance with HIPAA.

If this behavior is discovered, both Shirley and her employer could face significant legal and financial ramifications. The act of saving PHI on an unsecured computer could lead to unauthorized access, data breaches, and could compromise patient confidentiality. In addition, it undermines trust in the healthcare provider's ability to safeguard PHI, a critical component of healthcare operations.

To mitigate this risk, the hospital should enforce strict data security protocols, including regular audits and employee training on privacy policies. Technical measures such as restricting access to sensitive data, using encrypted connections, and securing work devices should be implemented. Prompt action, including the removal of any stored PHI from Shirley's personal computer and a reassessment of remote work policies, is necessary to protect against further privacy infringements.