Home E-Weekly May 23, 2017

A Most Unusual HIPAA Infraction

Published: May 22, 2017

PRIVATE PROPERTY The health system reportedly issued a press release containing a patient's PHI — without her consent — to more than a dozen news outlets.

A Texas health system has agreed to pay $2.4 million to the U.S. government to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. The health system's infraction? Disclosing a patient's name in a 2015 press release about an illegal immigrant arrested for using a fraudulent identification card when she checked in for an appointment at a gynecologist's office.

The settlement is just one aspect of a resolution agreement between Houston-based Memorial Hermann Health System and the U.S. Department of Health and Human Services involving the impermissible disclosure of a patient's protected health information (PHI). The September 2015 incident drew national attention.

The patient, Blanca Borrego, 44, was at the Memorial Hermann Medical Group Northeast Women's Healthcare Clinic in Kingwood, Texas, for a gynecology appointment. When Ms. Borrego — a Mexican-born immigrant who had been living illegally in the United States for more than a decade — presented a fake Texas driver's license, staff reported the suspected forgery to the Harris County Sheriff's Office, and deputies arrived soon after to arrest Ms. Borrego.

Two things happened next: First, immigration-rights advocates began staging protests, suggesting Memorial Hermann had overstepped its authority by reporting Ms. Borrego to law enforcement; and second, the HHS Office for Civil Rights began to investigate the incident as a possible violation of Ms. Borrego's patient privacy rights. The agency ultimately determined that the disclosure to law enforcement was permissible under federal law, but there was another problem. The health system allegedly issued a press release to 15 news outlets and reporters that included Ms. Borrego's PHI — including her name in the title of the release — without her consent.

Even though local media outlets had already been reporting on the story, including using Ms. Borrego's name, attorneys specializing in medical privacy say healthcare providers may not do the same unless they first get the patient to sign a consent form.

"Senior management should have known that disclosing a patient's name on the title of a press release was a clear HIPAA privacy violation that would induce a swift [Office for Civil Rights] response," says Roger Severino, director of the HHS Office for Civil Rights, in a statement. "This case reminds us that organizations can readily cooperate with law enforcement without violating HIPAA, but that they must nevertheless continue to protect patient privacy when making statements to the public and elsewhere."

Memorial Hermann, which has admitted to no wrongdoing, has also agreed to adopt a corrective action plan requiring the health system to update its policies and procedures on safeguarding PHI. In addition, the corrective action plan requires all Memorial Hermann facilities — the not-for-profit health system has more than a dozen hospitals in the Houston area — to attest to its understanding of permissible uses and disclosures of PHI, including disclosures to the media.

A spokesperson for Memorial Hermann declined to provide further comment.

Bill Donahue

New to Outpatient Surgery Magazine?
Sign-up to continue reading this article.
Register Now
Have an account? Please log in:
Email Address:
  Remember my login on this computer

advertiser banner

Other Articles That May Interest You

Is Medical Direction of CRNAs a Reimbursement Scheme or Safer for Patients?

A point-counterpoint between a nurse anesthetist and an anesthesiologist.

Bill Promotes Pricing Transparency and Protects Physicians From EHR Penalties

The Senate is expected to vote on the 21st Century Cures Act early next week.

Administration Signals Likely End to Medicare Bundled Payments Initiative

Recently posted rule suggests that the twice-postponed rule will be rescinded.