There
is a new, compelling reason for hospitals and physicians
to pay attention to HIPAA. An appellate court in North
Carolina ruled that HIPAA could be used by a
plaintiff to establish the "standard of care" in a negligence
lawsuit. Acosta v. Byrum, 638 S.E.2d 246 (N.C.
Ct. App. 2006). Plaintiffs' attorneys everywhere will
likely point to this case to argue that hospitals and
physicians can be liable under state tort law for an "invasion
of privacy" or for "negligently inflicting emotional
distress" if they fail to comply with HIPAA. Conducting
internal investigations of potential privacy violations
is one of the key ways to ensure compliance with HIPAA.
Responding appropriately when a concern is raised can
reduce the chance of a formal complaint – or a
lawsuit – being filed. If a complaint is filed,
the health care provider must be able to point to a thorough
investigation in order to deal with government regulators.
Also, a good investigation can result in "lessons learned" that
may prevent similar complaints in the future. How do
you conduct an effective HIPAA investigation? . Among other topics, Phil and Rachel
discuss:
Reasons
for conducting a thorough investigation
Proactive
steps to avoid privacy violations in the first place
The
use of random and focused audits
Documents
to review during an investigation
Interviewing
witnesses and subjects of complaints
Documentation
Incorporating
investigation results into the quality improvement process
Steps
to take if a privacy violation is confirmed: how do you
protect the patient as well as your good reputation?
Mitigating
the harmful effects of improper disclosures of health
information
State
laws requiring notification to the patient of certain
improper disclosures
Relationship
between Patient Grievance policies and HIPAA investigations
Responding
to government inquiries
What
do you do if government agents knock on your door?
