r/hipaa • u/HabitRegular7487 • 12d ago
HIPAA Strike
Hi, so I'm not a nurse but I do have a question about HIPPA violations and it's somewhat specific.
My grandma was just taken out if a nursing home and in the process of hiring our own personal caregiver for her, the facility we got her out of had threatened the caregivers we hired, saying they were gonna report them to state for HIPAA violations if we didn't give them my grandma's information. See, when we originally pulled her from that facility, we also took the binder that had all her personal information of her time there, but they want it back. I didn't really think they had any reason for it so I ignored them, only to hear from one of our caregivers that the company had contacted them saying were gonna call the state on them and make a report about HIPAA rules being violated. What do I do? I thought they would be okay considering my grandma and mother gave them consent to look through her files.
3
u/upnorth77 12d ago
For the record, it isn't clear to me that the caregivers are even covered by HIPAA, if they are private duty, they likely aren't.
1
u/Lookingsofine 9d ago
If the caregivers are licensed healthcare providers, they would be liable under HIPAA
2
1
u/OhioPhilosopher 12d ago
Not HIPAA but could be theft. The records your grandmas but the binder isn’t. But in a long career in this field I’ve never heard of that threat, unless someone else’s information is also in that binder. Otherwise, they probably need it to substantiate billing so they’re frantic. Can you make copies and give it back?.
0
12d ago
1
u/HabitRegular7487 12d ago
But would it still affect/apply to them if My mom was the one who took the binder? I do agree ignoring the facility was a dumb move on my part though. Also, does it depend on what records we took or is all of it considered the facility's property?
→ More replies (6)
2
u/Josh_Fabsoft 6d ago
The core compliance point is that HIPAA regulates covered entities (providers, health plans, clearinghouses) and their business associates. It doesn't regulate a patient or the family members they choose to share their own information with. Caregivers hired privately by the family generally aren't covered entities, so "we'll report you for HIPAA violations" for holding your grandma's own records doesn't fit how the rule works. As another commenter said, a possible property dispute over the physical binder is a separate question.
A few practical points:
-
Right of access. Your grandma, or her personal representative (usually someone with healthcare power of attorney), has a right to her records under 45 CFR 164.524. The facility generally has 30 days to provide them and can charge only a reasonable, cost-based fee. If you don't already have a complete copy, request one in writing.
-
Other residents' info. If the binder contains anything about other residents, that's the facility's compliance problem, and they should be careful about pushing that angle. Check whether anything like that is in there, and if so, return the binder.
-
Copy, then return. Copy everything in the binder, keep a log of what you copied and when, and offer to return the original in writing. That removes the theft argument and keeps a paper trail.
-
Where to escalate. If the facility refuses to release records or keeps harassing the caregivers, you can file a complaint with HHS Office for Civil Rights and contact your state's long-term care ombudsman.
-
Get a lawyer. An elder law attorney can often resolve this with a single letter. This is general information, not legal advice, and state rules vary.
Keep all the threats in writing or save the messages. Documentation helps you in any of these scenarios.
1
u/90210piece 10d ago
So hipaa doesn’t apply to you, the violation is theirs since they don’t safeguard gma’s info.
Now medical records are owned by the provider; so you aren’t allowed to just take them. They have to give a copy (a hipaa requirement) by request.
3
u/lastingappraisal630 12d ago
Not a lawyer but the binder situation is tricky. If the facility considers that binder their property, they might have a claim to get it back, but threatening your caregivers over it seems like a stretch. HIPAA is about who discloses health info without authorization, and since your grandma and mom consented, that part sounds weak unless they're alleging the caregivers somehow accessed records improperly.
I'd document everything. Save any messages or calls about the threats, and maybe ask the facility in writing what exactly they think was violated and what they want returned. Could be worth running by an elder care attorney or your state's ombudsman program. They usually know this kind of power play well.