Anesthesia Coding Alert

Avoid the fate of these healthcare entities with solid training and compliance strategies.

HIPAA violations have been ramping up in recent months. Check out these three examples of recent violations of the HIPAA rules so your practice can avoid making the same mistakes and incurring the ensuing penalties.

1. View This $950K Settlement for Security Rule Violation

On July 1, 2024, Heritage Valley Health System agreed to pay $950,000 as part of a settlement with the U.S. Department of Health and Human Services (HHS) Office of Civil Rights (OCR). Heritage Valley, which provides care in three states, was the victim of a ransomware attack in 2017, which affected its electronic medical records and left protected health information (PHI) vulnerable to outsider access.

When the OCR began investigating the breach, it found that Heritage Valley had not implemented critical HIPAA requirements, including an emergency plan and security risk analysis. The organization had also failed to enact procedures and policies that would have allowed only authorized users to access electronic PHI.

In addition to the $950,000 settlement, Heritage Valley is also required to create a corrective action plan that OCR will monitor over a three-year period. The organization must also conduct a risk analysis, create a risk management plan, develop written policies to comply with the HIPAA rules, and train staffers on HIPAA policies.

How your practice can avoid this fate: The best way to ensure you don’t face HIPAA Security Rule violations is by being proactive in protecting your practice. Perform a risk analysis periodically and ensure audit controls are in place to examine all information system activity. If you ever find that you’re vulnerable to a breach, take action immediately — and call an IT security expert in if you’re in any doubt over your ability to appropriately protect your data and your patients’ information.

Resource: Read more about the Heritage Valley settlement.

2. Note What Happens When Medical Records Are Reviewed Without Reason

Although it may seem like medical professionals have carte blanche to review medical records whenever they see fit, that’s not the case. In actuality, they need a legitimate medical reason to access a patient’s record. And on June 28, 2024, one physician pled guilty to reviewing a patient’s medical records without their knowledge.

According to a news release from the Department of Justice, Dr. Gabriel Roman admitted that while he was a resident at an Iowa hospital, he looked up the electronic medical records of a particular patient using computer systems that were located at two different hospitals. He was not treating the patient in question, and did not have their consent to review their medical files. Not only that, but he took photographs of private information in the patient’s medical record and sent one of them through the social media app Snapchat.

The doctor faces a potential sentence of five years in prison, three years of supervised release afterward, and a $250,000 fine.

How your practice can avoid this fate: Everyone at your practice — including providers — should be thoroughly trained on the importance of only accessing medical records when they have legitimate reasons to do so. In addition to frequently reminding staff of the law around this area, you should put access parameters in place so no one can review medical records they aren’t supposed to see.

Resource: To read more about the settlement and the details of the case, visit the Justice Department’s news alert about the case.

3. Beware of Sharing Medical Records With Law Enforcement

Just as healthcare professionals don’t have unrestricted access to medical records, neither do law enforcement entities. There are a wide range of laws governing who can access PHI, whether they require a warrant, and what information you need from patients before you can share their records with law enforcement officers.

On June 19, 2024, Adventist Health Hanford settled with the government as part of an effort to resolve HIPAA violations after its staff members gave medical information regarding two patients to law enforcement officers without authorization.