Beware of staff probing on their own
Violations of the Health Insurance Portability and Accountability Act (HIPAA) are a growing focus for whistleblowers, says Tammy Marzigliano, JD, partner with the law firm of Outten & Golden in New York City.
Marzigliano recently spoke with a potential client who was concerned that her healthcare employer was not adequately protecting a database with PHI. The employee reported her concerns internally, but the healthcare provider did nothing, Marzigliano says.
"So she started working with IT, gathering documents and investigating herself, which is the wrong way to go about it," the attorney says. "HIPAA does provide protection for those trying to report problems, but it requires that you include the minimum amount of patient information possible. She was going way beyond that leeway."
In a situation such as that one, the employer might have a legitimate reason to terminate the employee, Marzigliano says. The employee overstepped her bounds and violated HIPAA in a way that is not protected no matter how good her intentions, so dismissal could be justified, she says. "But the employee is going to argue that you dismissed her because she complained and you retaliated," she says. "In this case, you might be able to prove otherwise. But you still have a messy situation, some expensive litigation, and you still haven't addressed the root problem. You would have been better off listening when she first came to you with her concerns."
HIPAA does allow individual healthcare employees to copy records and provide them to their attorneys if they think some violation has occurred, says Kevin Troutman, JD, partner with Fisher & Phillips, Houston, TX. "It's not entirely clear how far that they can go with that, but there is an exception," Troutman says.
Education is key in this area, Marzigliano says. Having an employee hotline is not enough, she says. In addition to encouraging people to come forward, risk managers also must educate employees about where their obligations stop. Many employees will be under the impression that they cannot report potential fraud, for instance, without having the evidence to back up their claims. In trying to gather and provide that evidence, they might violate HIPAA and other regulations, which creates additional trouble for the employer and could rob the whistleblower of protections that otherwise might be available.
"They need to know that it's their job to speak up but not their job to investigate," she says. "It can be really unfortunate when you have someone who has the best intentions, and whistleblowers tend to be really righteous people, but they go overboard because they thought it was necessary. I'm horrified when they come to me with these documents."
Violations of the Health Insurance Portability and Accountability Act (HIPAA) are a growing focus for whistleblowers, says Tammy Marzigliano, JD, partner with the law firm of Outten & Golden in New York City.You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content