Home Health & Hospice Week

If you knew Brad Pitt was getting medical treatment from your home care organization, would you peek at his files? How about your ex-husband's new wife? Or your estranged sister? No matter whose records you're reviewing, it's illegal to take that peek unless you have a medically necessary reason to do so.

That was a very expensive lesson that the University of California at Los Angeles Health System (UCLAHS) learned recently after agreeing to settle potential violations of the HIPAA rule for $865,500.

At issue: When two celebrity patients received care at the hospital, staff members at the facility "repeatedly and without permissible reason" looked at the patients' electronic PHI. After the celebrities complained, it was revealed that between 2005 and 2008, "unauthorized employees repeatedly looked at the electronic protected health information of numerous other UCLAHS patients," a Health and Human Services news release notes.

Not only will the hospital face the steep fine, but it must also implement a corrective action plan to fix gaps in its HIPAA compliance routine.

The lowdown: It is illegal to review a patient's PHI without having a justifiable and medically necessary reason, and company owners and managers can't simply turn a blind eye if their staff members are doing so.

"Covered entities are responsible for the actions of their employees," HHS Office for Civil Rights director Georgina Verdugo says in the statement. "Employees must clearly understand that casual review for personal interest of patients' protected health information is unacceptable and against the law."

Verdugo also stressed that the OCR is always alert to HIPAA violations. "Covered entities need to realize that HIPAA privacy protections are real and OCR vigorously enforces those protections," she noted. "Entities will be held accountable for employees who access protected health information to satisfy their own personal curiosity."