Health System Included PHI in Press Release, OCR Says
Memorial Hermann Health System (MHHS) in Houston has agreed to pay $2.4 million to the U.S. Department of Health and Human Services (HHS) and adopt a comprehensive corrective action plan to settle potential HIPAA violations related to claims it included a patient’s protected health information (PHI) in a press release.
In September 2015, a patient at one of MHHS’s clinics presented an allegedly fraudulent identification card to office staff, OCR reports. The staff immediately alerted appropriate authorities of the incident, and the patient was arrested. This disclosure of PHI to law enforcement was permitted under the HIPAA rules, OCR notes, but MHHS subsequently published a press release concerning the incident that included the patient’s PHI.
MHHS senior management approved the impermissible disclosure of the patient’s PHI by adding the patient’s name in the title of the press release, OCR reports. In addition, MHHS failed to timely document the sanctioning of its workforce members for impermissibly disclosing the patient’s information, OCR Director Roger Severino said in a statement announcing the settlement.
“Senior management should have known that disclosing a patient’s name on the title of a press release was a clear HIPAA privacy violation that would induce a swift OCR response,” Severino said. “This case reminds us that organizations can readily cooperate with law enforcement without violating HIPAA, but that they must nevertheless continue to protect patient privacy when making statements to the public and elsewhere.”
In addition to a $2.4 million monetary settlement, a corrective action plan requires MHHS to update its policies and procedures on safeguarding PHI from impermissible uses and disclosures and to train its workforce members. The corrective action plan also requires all MHHS facilities to attest to their understanding of permissible uses and disclosures of PHI, including disclosures to the media.
Memorial Hermann Health System has agreed to pay $2.4 million to the U.S. Department of Health and Human Services and adopt a corrective action plan to settle potential HIPAA violations related to claims it included a patient’s protected health information in a press release.
Subscribe Now for Access
You have reached your article limit for the month. We hope you found our articles both enjoyable and insightful. For information on new subscriptions, product trials, alternative billing arrangements or group and site discounts please call 800-688-2421. We look forward to having you as a long-term member of the Relias Media community.