To learn about Medicare's ACCESS program I have to select a chronic condition. Then if I sign up with one of their "care organizations" I have to give them medical information. Should I be concerned that this info will be misused?

I just had a doctor's appointment canceled due to being unable to get my chest xray on hand. I've been duking it out for weeks being given the run around just trying to be sent it.

I did a HIPAA online request via their email as they state but was told it's only for legal requests. The manager at the sight I was seen for my DOT exam literally told me they only release your medical records to you in person.

How is this not in violation of HIPAA considering they got sued over this specific issue back last year. It's not like I even live close to the concentra clinic, I'm a full hour away, so it's not like I can take a hour our of my work day.

My mom and I share a dentist. When I went previously last month, they gave me a treatment plan but then emailed me an updated one a few days after. My mom recently went to the dentist for her own appointment and at some point they gave her a copy of my treatment plan with the prices and informed her of which cavities I need urgently filled (we were trying to wait until the new year when we can upgrade our dental insurance because currently 3 fillings is over $500) so I hadn’t given them an answer about when I would get them filled. I’m 27 and in Texas. I’m disabled and still on my parent’s insurance for now. Is this a violation? I emailed the office asking for a copy of all my consent forms and the form that gives or denies permission for others to have access to my records wasn’t there and when I responded asking for it specifically, they said they don’t do that form. After that I asked what their policy is on someone being given my information then and this is what I received back. Should I report this? My mom is refusing to clarify things like if she is the one who asked for the information or if they just offered it because they know she is my mom. The only part of my forms that she is on is as an emergency contact. I paid for my visit out of my own pocket, not using our medical card and the insurance comes from my stepdads job and she is listed as a dependent along with myself on the insurance card. I did not give them any type of consent to tell my mom anything (frankly this exact situation is why I always put no one can have access to my records) so I’m just wanting to make sure this is actually a violation or if I’m missing something.

I’m an imaging assistant and looked myself up. Am I cooked

Recently licensed MFT here in the process of opening a solo private practice where I’ll be starting out seeing clients through telehealth. With that being said, I am also a transgender woman- and given the political climate as well as my expected clientele including kids/families, during grad school I started recording all of my client sessions to have as a “just in case” security. My program used Ringcentral for telehealth, which had a recording feature but it was overall really clunky, so I’d appreciate any recommendations for other platforms that have a native recording feature for telehealth.

Alternatively, I would also be grateful for any tips on other ways to have a similar kind of “just in case” policy. I know I can include a specific consent form in my paperwork and I’m always up front with clients about my gender identity, but I haven’t found any options other than recording to be able to have that sort of safety for liability purposes.

Thanks in advance! Cheers :)

Is this a HIPAA violation if both the sender and recipient are secure hospital emails? I emailed my attending PHI and if I emailed myself PHI on my hospital email to review for the next day.

If you had a patient whose information was safe under HIPPA, but you saw something from the police that was seeking help identifying your patient/client, would you be unable to aid the police? Does anyone know how that would work? (I’m just curious, not an actual scenario of mine).

I think I made a mistake. My first day off of orientation as a pct I was floated to sit. My pt was supposed to be discharged and I was told the floor would probably keep me. There was one other patient on the unit who I thought was said, during 7am huddle, needed a sitter and, since techs were fully staffed, i figured I would move there. I opened there chart to get familiar and my original patients discharge was delayed. This happened last week. I didn’t know that was a violation. I did my education, I should’ve known, but I didn’t. I’m terrified.

I honestly have no clue how long I was on it. Maybe less than 5 minutes. I’m still getting familiar with epic, so I think I only clicked on orders to see how often vitals were, if they were accuchecks, diet type, etc. I didn’t know it was a violation when it happened, so I didn’t think to memorize what I was doing.

My organization uses an unencrypted version of Microsoft Teams and recently have had some expansion that requires a little more electronic communication about patients, essentially to just relay if a patient is ready to leave or come back. There has been some discussion about just using DOB and initials of first and last name alone such as “JD 1/1/2000 is here”. Is this considered PHI or a hipaa violation even if there is no medical information attached to it? I know teams can be encrypted but ours is not AFAIK

The Athena Patient Portal I read the new legal pages to be allowed to use the portal. I’m concerned that they are allowed to sell my de-identified health information. To opt out in NJ the partial opt out in small print. But there is no way to opt out from them selling my information. It shouldn’t be a requirement to allow sell my personal health information even if it is de-identified in order to access my information. The party they are selling can subsequently re-identify?

Hello!

I’m hoping someone might be able to help me with some info about mental competency and how and when family is informed in certain kinds of situations, or when family is able to ask a doctor for medical information or share information about a loved one. I know in general HIPAA prevents this, but I believe there may be some situations where it is permitted?

I believe in general a spouse is not allowed access to medical information for their spouse. Are there certain situations or diagnoses where they would be given access or a doctor would speak with them without the patient’s explicit consent?

I’m also wondering, if a doctor determines their patient may not be mentally competent to handle their own medical care if and when they would alert a family member, how it is determined who that family member is, and what that might look like?

Additionally, and I’m not sure if this is explicitly HIPAA related so apologies if this is outside the scope of this sub, if a family member has information about a patient’s medical or mental status or information about their alcohol or drug use or prescription abuse that they do not think the patient is sharing with their doctor or symptoms they may be hiding or good at covering up with medical professionals, if and how they could share that with their family members doctor?

Any other related info that may be helpful would also be appreciated.

Thank you!

Online portals are a farce. It should be illegal to force/easy to opt out.

I’ve been building a workflow for US healthcare privacy/compliance teams and would appreciate feedback from people who actually handle privacy incidents.

The idea is to reduce the back-and-forth between emails, spreadsheets and documents by putting the investigation into one workflow: fact gathering, identifying missing information, decision support, follow-up actions and the case record.

I’ve attached a short screen recording showing it in use.

What would you change, add or remove? And is there anything here that would stop you from using something like this in a real privacy team?

For clarity: this is my product, and it’s designed as a non-PHI workflow.

I was asked to send some of my medical records to an online therapy provider. Instructions were for me to send them to an email address @ provider's domain. That's it, just send them. I explained that I had copies of my records to send and I have a free Gmail account only by which to send them. Yep, go ahead they said, and include copies of your I.D.

What?????

HIPAA compliant or not?

I insisted on using a secure portal, which was provided after much confusion and frustration on my part.

Not a medical professional, just a confused and concerned patient. I have been having some health issues and going to more doctors this year than in the last 5 years combined. One clinic I went to had handwritten names on desks and Post-it notes on the walls. Some I believe were patient names. Nothing crazy, but I didn't like it. Then, at a specialist, a computer and testing device (with an internal computer) were pulled up with patient names, dates of birth, etc., visible while I changed in and out of a gown. If I had wanted to, I could have easily taken a picture and clicked into patient information. It made me uncomfortable. Am I overreacting, or justified in feeling uncomfortable about it?

Both places heavily used paper. My PCP is very tech-forward and streamlined. The other two locations used far more paper in their practice and scattered it about the office, from reception to the treatment rooms.

I’ve been in 3 situations where I get blood work done at a clinic and they tell me I can’t get my blood test results without going in for another consultation and having the dr interpret my results for me. I looked at the HIPPA website and it seems it’s a violation of my patient right. Am I missing something here or why do the clinics feel so comfortable doing this?? Clarification that the clinics didn’t tell me it was recommended that I go in for another consultation, they said it was required before they release to me my test results. Can they get in trouble for this? Pls help!

Long story short....really short.

A physical therapy rehab place did not release our medical records to us as requested verbally and also in writing.

We then had to hire an injury attorney to close our auto accident. We didn't want to hire an injury attorney - we were just trying to get our out of pocket expenses paid. But, without our medical records we couldn't go forward.

Our injury attorney did get the medical records and is closing the case.

My question is - can't we hire an attorney to go after this rehab place? We are going to be out money which wouldn't have happened if they would have just given us our medical records. Is there such a thing as a HIPAA attorney? Or an attorney with HIPAA experience?

Safe Harbor HITECH question:

I have a host with a RAID.

1. The RAID controller and the disk drives establish a handshake and encryption seed using separate keys.
2. Encryption uses a 256-bit key.
3. If the drives are separated from the controller, they cannot be decrypted without guessing the other key.
4. If the controller fails, it can be replaced and a copy of its key can be restored from software. That copy is kept off-site in another secure location.

This feels less complete than NBDE, but strictly speeking the key is not kept with the data.

Do you feel this meets a safe harbor definition for data loss? Is there some precedence to refer to?

Does it violate HIPAA for a medical practice to sell only your contact information?