Privacy Officer's Roundtable

Appointment Reminder Mishap

  • 1.  Appointment Reminder Mishap

    Posted 10-10-2018 01:08 PM

    An employee of the hospital mistakenly called a patient's place of employment to remind her about an upcoming appointment. The patient herself did not receive the call, but instead a message was left with her co-worker.  The information left with the co-worker was:  (patient's) Name, Hospital Name, and the name of the Clinical Department.  For example:

    Hospital - Hello may I speak with Jane Doe?

    Co-Worker - Jane is in a meeting right now, may I take a message?

    Hospital - Yes, my name is James Brown calling from ABC Hospital, Ophthalmology.  Will you ask her call me?

    Co-Worker - OK. I will give her the message.  Thank you

    Is the information that was left verbally with the co-worker PHI?  Does the fact that a name of a clinical department was given matter?  For example, would you handle this any differently if the name of the department left with the co-worker was psychiatry instead of ophthalmology?   



    ------------------------------
    Shawna White, MBA, CHC,CHPC
    Philadelphia PA
    ------------------------------


  • 2.  RE: Appointment Reminder Mishap

    Posted 10-11-2018 08:25 AM
    Edited by Stacie McCutcheon 10-11-2018 08:27 AM
    In that case, I would definitely find that the information is PHI because it relates to the provision of services provided.  The question becomes whether it is a low probability of compromise.  I think the clinical department definitely makes a difference in that analysis ... an ophthalmology appointment is definitely different than if it was for instance an oncology, psychiatry, or HIV department/clinic.

    I would also question whether the patient had indicated that calls to her workplace were ok and whether messages could be left at that number.

    ------------------------------
    Stacie McCutcheon
    Privacy Officer
    University of Louisville
    Louisville,KY
    ------------------------------



  • 3.  RE: Appointment Reminder Mishap

    Posted 10-11-2018 08:30 AM
    Compare and Contrast....after reading the script....raises the following questions.

    Where is there a mention that Jane Doe is a patient?
    Where is there mention that the call had to with an appointment?
    Where is there mention that the relationship between Jane Doe and James Brown is that of patient/provider?
    Where is there mention of services past, present, or future related to Jane Doe?

    Certainly these are possibilities...but based on the script...not necessarily.  So I simply point this out as sometimes people may be quick to make assumptions that may not necessarily apply.

    ------------------------------
    ◘ October - Prep CSG for Nov 1 Launch ◘
    -----------Frank Ruelas------------
    ------------------------------



  • 4.  RE: Appointment Reminder Mishap

    Posted 10-11-2018 10:10 AM

    I agree with Frank...there is no specific information shared here...it would all be assumptions on the part of the call receiver.

     

    Best Regards,

    Scot Lovejoy  CFP_XSLogo_BlBk 

    Scot Lovejoy RPh. CFP CHC

    Chief Pharmacy Officer

    Compliance Officer

    Agadia_itself (625x184) (625x184) (100x29)

    9 Campus Drive, 2nd Floor East

    Parisippany, N.J. 07054

    (O) 973-540-8400  x227

    (C) 973-570-3803

    (F) 973-540-8440

     

    Confidentiality Notice:  This e-mail is intended only for the person(s) to whom it is addressed and may contain information that is confidential, proprietary, privileged or otherwise protected from disclosure.  If you are not an intended recipient, please (i) do not read, copy or use this communication, or disclose it to others, (ii) notify the sender immediately by replying to the message, and (iii) delete the e-mail from your system.  Thank you.

     






  • 5.  RE: Appointment Reminder Mishap

    Posted 10-12-2018 10:17 AM

    Ok, two more points and I'm moving on to other things.

     

    1. Unless the patient provided an "alternate communications" request allowing the clinic to call him at his work place, the call should not have been made, nor a message left.  The message should have been left at the individual's home or number provided by the individual.
    2. Using the "reasonable" standard which is applied throughout the privacy and security rule, it would be reasonable for anyone to believe the worker is being seen at the ophthalmology clinic or has a patient relationship with the clinic, if they are calling and leaving a message. 

     

    Serrano's Spin

     

    Hernan

     

    Hernan Serrano

    Director of Compliance

    HIPAAtrek

    www.hipaatrek.com

    314-272-2600 (office)

     

     

    Disclaimer:  HIPAAtrek, LLC employees and associates are not lawyers and do not provide legal advice.  In order to facilitate your effective use of the HIPAAtrek Software-as-a-Service, our employees and associates may provide their non-legal opinions and recommendations related to HIPAA and the administration of your HIPAA Privacy, Security, and Breach Notification program.  Nevertheless, you are strongly encouraged to engage your own competent legal counsel for your specific legal and compliance matters.

     






  • 6.  RE: Appointment Reminder Mishap

    Posted 10-11-2018 09:12 AM

    Shawna

     

    I consider the information left with the co-worker PHI.  As a result, I consider this to be an impermissible disclosure which in turn requires an breach risk assessment.

     

    Hernan

     

    Hernan Serrano

    Director of Compliance

    HIPAAtrek

    www.hipaatrek.com

    314-272-2600 (office)

     

     

    Disclaimer:  HIPAAtrek, LLC employees and associates are not lawyers and do not provide legal advice.  In order to facilitate your effective use of the HIPAAtrek Software-as-a-Service, our employees and associates may provide their non-legal opinions and recommendations related to HIPAA and the administration of your HIPAA Privacy, Security, and Breach Notification program.  Nevertheless, you are strongly encouraged to engage your own competent legal counsel for your specific legal and compliance matters.

     






  • 7.  RE: Appointment Reminder Mishap

    Posted 10-11-2018 11:44 AM
    ​Shawna:
    Reviewing the scenario as presented, I see the information left as PHI. Had the caller given only a name and phone number, there would be no PHI.

    To Frank's point, there is no mention of an appointment or test results, or request for payment. But typically when a person receives a call from a specific hospital department, it usually relates to either an appointment, a bill, or test results.

    The question I ask in cases like this is: Did James Brown take reasonable precautions to protect the health information of Jane Doe? The minimum necessary information in this case is name and phone number.

    I love the Compare and Contrast method because it allows for many different perspectives!

    ------------------------------
    Dr. Randy Lewis, LMFT, CHPC
    HIPAA Privacy Officer
    Orange County Government
    Orlando, FL
    ------------------------------



  • 8.  RE: Appointment Reminder Mishap

    Posted 10-15-2018 11:23 AM
    The patient did not provide the work phone number as the preferred number. Let's say it was purely a data entry mistake since corrected.  I am not sure if the Hospital indicated that they were calling about an appointment per se.

    Thank you all for the responses.  It's been an interesting and enlightening debate. Does it matter if the patient is now upset and angry about the mistake.  Does anyone think that OCR will view this as a breach if they were to investigate the patient's (expected) complaint?


    An additional thought or question about this: Has it been determined whether or not its an unauthorized disclosure when the hospital reception staff mistakenly discloses status information about a patient who asked to be private; i.e. the patient opted out of the hospital directory?

    ------------------------------
    Shawna White CHC,CHPC
    Compliance Officer
    Magee Rehabilitation Hospital
    Philadelphia,PA
    ------------------------------