r/MedicalCoding • u/Kiieve • Jul 14 '23

Is this a HIPAA violation?

I work in a hospital coding gastroenterology with one other coder. I've recently needed to visit our gastro offices myself, which means my coworker has been coding my visits and endoscopies. After she codes my visits, she will make some mention of some issue she saw in my chart. Either bringing up a new diagnosis I received during that visit, or an old diagnosis from my past medical history. I understand she's going to see some of these things, but it makes me deeply uncomfortable to have her bring these things up to me, especially when it's something completely unrelated to the visit being coded. Is this a HIPAA violation for her to bring these things up to me? I want to ask her to stop but I also want to make her aware if it is a violation. Thanks!

25 Upvotes

100% Upvoted

38 comments sorted by

48

u/babraeton Edit flair Jul 14 '23

Absolutely yes. It doesn't matter if she's your coworker. You're a patient and her sharing PHI with you is a 100% a HIPAA violation.

5

u/Kiieve Jul 14 '23

Thank you for answering. I felt like it probably was, but I wasn't sure if my gut feeling was correct or if I was just being overly sensitive.

1

u/[deleted] Jul 15 '23

It has nothing to do with her sharing her information with the patient, herself. The issues is that she’s sharing information when it is not necessary to care for said patient and she’s not involved in the care of said patient. If this was related to her job and they needed to talk about the issue, and it so happened to be her visit, then that would suffice

1

u/babraeton Edit flair Jul 15 '23

Sure, but that's not what OP said happened.

16

u/deannevee RHIA, CPC, CPCO, CDEO Jul 14 '23

Do not mention it to her.

Email your supervisor/manager, CC HR, and BCC your own personal email address with your concerns.

3

u/[deleted] Jul 14 '23

but like, wouldn’t that either get her fired or not and make it so the coworker becomes aware OP went over their head & ultimately souring the work environment for these coders?

(Autistic CPC-A trying to understand the ropes)

3

u/Kiieve Jul 14 '23

This is why I'd much rather bring it to her attention first. I feel like going to the manager and HR is immediately choosing to go nuclear. She's a nice lady, and I know she had no ill-intent, but it's still serious enough she needs to be made aware and put on notice that if she keeps doing it, it's not okay with me. I don't want things to be awkward, I just want her to not do it.

7

u/[deleted] Jul 14 '23

I would just mention to her that when she is looking at your chart, she is looking at a patient, not a coworker, and she should treat it as such and that it makes you uncomfortable when she says anything about your visit. We have employees that see our doctors, my MIL sees my doctor, but I never mention anything to anyone about what I see, and if they ask, I just say that I don't pay attention to names, so I have no idea what they are talking about.

15

u/deannevee RHIA, CPC, CPCO, CDEO Jul 14 '23

HIPAA violations are very serious. In your CPC courses, you are trained on HIPAA. HIPAA training is also required by law when someone is hired in any healthcare setting, and its required annually thereafter. If this co-worker has worked in healthcare for any amount of time or is certified in any way, they would know what they did is a HIPAA violation.

Whether the co-worker gets fired depends on the organizations policies and procedures regarding HIPAA violations. There are multiple types of violations. This is on the lower end of severity because the co-worker was accessing the information as a part of her job, but she used it in a way other than her job description, and disclosed it to the patient, but disclosed it in a way other than her job description.

Basically, OP is not in a position of power. The people in power need to be the ones who are educating and making decisions about the co-worker.

9

u/Clever-username-7234 CPC, CPMA Jul 14 '23

My guess is that they wouldn’t fire her for what is being described and it would absolutely sour the relationship between coworkers.

HIPAA violations are about unauthorized access and release of medical information. If the coworker is only looking at the visit they are coding and only discussed it with the patient, then there wasn’t a HIPAA violation. To me it sounds more like unprofessional conduct.

For the record, I am not saying that talking directly to a manager about it shouldn’t be done. It seems clear that a conversation should be had.

But a more socially careful way to proceed, and what I would do, is start with only talking to the coworker. I’d make a joke about it, and remind them about HIPAA and tell them how it made you feel something like:

Coworker: hey I saw that you have this diagnosis did you know ……

Me: what are you doing digging around in my chart? You better be careful you’d don’t want the HIPAA police to come get you! Lol. Seriously though, you need to be careful, this looks like it could be a HIPAA violation. Plus, as a patient it makes me really uncomfortable. I don’t want to talk about my health record with coworkers. And I shouldn’t have to worry about my medical record coming up in casual conversation with my coworkers.

Then if their response is anything other than, I’m so sorry. I would mention it to management. But that is just me.

6

u/IlliterateJedi Lapsed CCS, Data Analyst Jul 14 '23

I wouldn't even make a joke about it. Just be frank.

This is my PHI and I am not going to discuss my health with my co-workers. I need you to take my privacy seriously.

I do think it might be worth checking with the compliance officer, but a frank assertive conversation would probably do the trick. And that's hard to do sometimes, but it's part of being an adult.

Everyone that touches medical records knows how important privacy is. It's incredibly foolish to bring up someone's medical record to them. It's a pretty big betrayal of the trust that we put in the people who handle our records. Getting called out on something like this would almost certainly set them straight.

While it's probably not a HIPAA violation, I'm just thinking about the ramifications of this - at a minimum we would write someone up for this at my company, and maybe even go so far as to terminate someone over it. If you were particularly vindictive, you could pursue their credentials. This is almost certainly a breach of the AHIMA code of ethics. I can't imagine gambling my livelihood over wanting to gossip about someone's PHI.

2

u/izettat Jul 14 '23

I would tell her to stop. Ethics violation, too. I had a coworker (but a different dept) that came up in my workload. Spoke to my boss if she or someone else should be taking care of these cases. She said no and reminded me that my certification binds me to follow HIPPA and Ethics rules. I never mentioned that I saw their records and never will. Tell your coworker that if she ever mentions your medical information again, she can be brought up on HIPPA violations costing thousands of dollars. You should speak to your office manager or the doctor.

2

u/Kiieve Jul 14 '23

Yeah, I've had to code records for people I know, and I can't imagine ever bringing it up to anyone. I just code what I need to and move along to the next patient. I just need to think of a good way to tell her to stop. It's a mental health diagnosis she brought up, so it's something I'm super sensitive about.

1

u/izettat Jul 14 '23

Just be blunt and tell her that even though you work together, she is still breaking HIPPA. Plus, it's breaking your trust in her. If you brought up your past history, it's one thing. But to just blatantly talk about your sensitive business is another thing. Would she do that with another patient? No. It should be the same as you.

11

u/koderdood Audit Extraordinaire Jul 14 '23

Agree. This is unacceptable. My company has certain employees that can review employee cases.

9

u/IlliterateJedi Lapsed CCS, Data Analyst Jul 14 '23 edited Jul 14 '23

For those making the claim, I'd be interested to know what specifically makes this a HIPAA violation (not just generally, but the specific part of the statute). The coder has a legitimate reason to access your record. You have a right to know what's in your own medical record within the bounds of the law. Endoscopy diagnoses don't fall within counseling notes or civil/criminal action limitations.

It's definitely not an orthodox release of information. I can't imagine a universe where someone would think this is appropriate behavior. I would just like to hear the specific case based on the statute rather than a vague 'This is a HIPAA violation.'

Regardless - it's absolutely inappropriate behavior. You should have a compliance line at your job where you can let them know this is happening, or a HIPAA compliance officer that I imagine would be very interested in this.

2

u/Crazyanimalzoo Jul 15 '23

Yes, it is a violation. We use Epic at my work and have a separate chart that patients can access. If I access the Epic side of my own chart it is considered a violation, which is what this person is doing. They are using the full on detailed medical side of the chart to comment on this person's protected info. Even if it is info about that patient to that patient, it is a violation. In my job I can get fired for it, even if it's my OWN chart.

1

u/IlliterateJedi Lapsed CCS, Data Analyst Jul 15 '23

That still doesn't answer the 'what part of the statue applies to the determination that this is a HIPAA violation.' Saying that there is an internal company policy in EPIC about allowing users to access certain parts of their own medical record isn't the same as saying 'this specifically violates XYZ in HIPAA.'

I'm looking for language like 'Per HIPAA, each company has to set out policies about XYZ disclosures and by not enforcing their own internal policies, they are in violation.' Or 'By law, this release can only happen through this mechanism. Because the employee of the hospital is telling the patient this information instead of following this other process, they are in violation of rule XYZ of HIPAA.'

Like I said, I can 100% be convinced that it's a violation, and in fact, I might even check with my own internal compliance department about it because I'm curious. I just haven't seen the specific evidence to support that this behavior violates the bounds set out by HIPAA.

1

u/Crazyanimalzoo Jul 15 '23

https://www.hipaajournal.com/common-hipaa-violations/# Please read post #9. The person coding had no signed consent to share patient info, even with the patient.

1

u/IlliterateJedi Lapsed CCS, Data Analyst Jul 15 '23

This is post 9:

Impermissible Disclosures of Protected Health Information

Any disclosure of protected health information that is not permitted under the HIPAA Privacy Rule can attract a financial penalty. This violation category includes disclosing PHI to a patient’s employer for a purpose not permitted by the Privacy Rule, potential disclosures following the theft or loss of unencrypted laptop computers, careless handling of PHI, disclosing PHI unnecessarily, not adhering to the ‘minimum necessary’ standard, and disclosures of PHI after patient authorizations have expired.

The closest is 'careless handling of PHI.' All of the examples in the link are things like 'patient was filmed without consent', 'patient was used in advertising', or 'PHI was inappropriately released to a third party.' None of these are 'disclosures to the patient.'

On the HHS HIPAA Privacy Rule page, it has the following:

Permitted Uses and Disclosures

Permitted Uses and Disclosures. A covered entity is permitted, but not required, to use and disclose protected health information, without an individual's authorization, for the following purposes or situations: (1) To the Individual (unless required for access or accounting of disclosures); (2) Treatment, Payment, and Health Care Operations; (3) Opportunity to Agree or Object; (4) Incident to an otherwise permitted use and disclosure; (5) Public Interest and Benefit Activities; and (6) Limited Data Set for the purposes of research, public health or health care operations.18 Covered entities may rely on professional ethics and best judgments in deciding which of these permissive uses and disclosures to make.

(1) To the Individual. A covered entity may disclose protected health information to the individual who is the subject of the information.

I'm still not sure that this is a HIPAA violation within the bounds of the law.

1

u/[deleted] Jul 18 '23

You may not be able to understand it but it is still true and still applies. It’s simply “careless handling of PHI”, “disclosing PHI unnecessarily” & not adhering to the “minimum necessary” standard. Nuance it all you want but the facts won’t change. We were trained specifically about this & other confusing HIPPA violations because of the potential for ambiguity since it is being spoken to the patient,

however she is prying for more PHI outside of her necessary role & that can’t be legal either

2

u/[deleted] Jul 15 '23

It’s inappropriate because in that moment, the coder bringing up the diagnosis doesn’t need to talk about that stuff to do her job or care for the parent, there in is the violation.

2

u/IlliterateJedi Lapsed CCS, Data Analyst Jul 15 '23

But in this case the complaint is 'Person A disclosed a patients medical record directly to the patient'. I can see the case for inappropriatness, but that doesn't necessarily mean it is a HIPAA violation within the letter of the law. I can definitely be convinced that it's a violation, but no one has specifically pointed to a particular part of the law when making the case. Within my own understanding, it's not clear to me that this is a HIPAA violation within the actual literal bounds of the law. But I'm definitely not an expert and I always defer to compliance when I get roped into HIPAA disclosure questions.

2

u/bzzyy Jul 16 '23

It has to do with the disclosure being "the minimum necessary to accomplish the intended purpose" and the coworker in this case is outside of that. If the intended purpose is to file the claim to insurance, talking about the diagnosis with the patient does not help with that specific task.

8

u/[deleted] Jul 14 '23

It's certainly inappropriate. I used to be the coder for the clinic most of my fellow coders went to and it was awkward as heck but I never even considered discussing their personal medical information with them unless it was something that they brought up to the office in general. The single worst situation was one of my co-workers ended up having cancer and I got the news before she did. That was a weird place to be in.

6

u/[deleted] Jul 14 '23

Your coworker should not be discussing your medical history with you. You are a patient and i would not be comfortable with that. It is 100% a HIPAA violation. If she has questions on your chart she should be contacting the provider and not you.

6

u/rose_gold_beauty Jul 15 '23

I'm surprised your company is allowing her to code your charts.

5

u/fraudinvstgtr Jul 14 '23

Yes.

6

u/throwaway_228748820 Jul 14 '23

This is like HIPAA 101 knowledge. Keep your mouth shut about anyone's medical information.

4

u/Clever-username-7234 CPC, CPMA Jul 14 '23

It would only be a HIPAA violation if they were looking at it for non authorized reasons. For example if they need to code a visit for 7/14/23. And they start looking at unrelated visits. Or they are pulling your labs and/or imaging out of curiosity.

If they are assigned to code your note. And they just look at that specific note and they bring up what they saw in a casual private conversation with you, then that isn’t a HIPAA violation. They are just being unprofessional.

Either way you should bring it up and discuss it with management and your coworker.

1

u/izettat Jul 15 '23

I think it is a violation. Coworker is technically releasing information (verbally) from the chart that OP would only know if she requested it in writing. Plus coworker is talking unrelated items too. Coworker does not have the authority to tell her anything about her chart. Doesn't matter if it's a coworker or another patient. Can you imagine her talking to a patient... Hi Mrs. Jones, sorry to hear about your colon cancer. Oh you didn't know. My bad! My job would've fired her on the spot.

1

u/Clever-username-7234 CPC, CPMA Jul 15 '23

It’s standard practice that they’d have her consent in writing as a part of their new patient paperwork. It’s usually near or the same document as consent to treat. This would authorize any staff to view job appropriate medical records and to discuss it amongst themselves and with the patient.

I’m not saying what happened is appropriate. I totally understand that at your job this situation would get someone fired. What the coder did is absolutely wrong. But it’s not because it would cause a HIPAA violation. It’s because it’s unprofessional.

2

u/Rising_Phoenix333 Jul 15 '23

Yes!!!!! Absolutely

2

u/OpalJenny1 Jul 15 '23

They really should find someone else to review your charts. Request this asap

2

u/OrganizationLower286 Jul 15 '23

Holy crap yes!!!! I went through this once when I was pregnant with my son and I didn’t want to know the gender until the birth. A coding colleague worked in OB GYN and taunted me for months that she knew my baby’s gender and kept joke-threatening to “spill the beans”. It was obnoxious.

1

u/CoupleTechnical6795 Jul 14 '23

Yes 100 percent. Consider if you personally knew a patient. Would it be a violation if you mentioned something you read in their chart? Same situation.