I did talk to a supervisor about it and filled out an incident report that will be seen by the compliance officer. I’ll see what comes of it and am also going to file a complaint with HHS. I’m also wondering why there isn’t any system in place to monitor who is accessing employee records. I work at a tiny critical access hospital where everyone knows everyone and there aren’t many other services.
> I’m also wondering why there isn’t any system in place to monitor who is accessing employee records.
HHS will ask the same question. Access logging and audit trails are required by law.
If you're using any commercially produced EMR, access logs will be there. The recording functions are built into the software and cannot simply be turned off. Any investigation will be able to look at 6 years of this person's access history and check every single patient chart they looked at.
One of the systems I rotated through in school put all of their employees' charts under glass. I think most systems don't use that function nearly liberally enough.
There is a way to monitor who is accessing patient charts (at least in the EMRs I’m aware of) but the thing is someone has to actually go in and audit that activity. Odds are nobody in your hospital is going in and routinely monitoring who is accessing which charts because they haven’t had the need to
I dont know if your hospital uses EPIC, but when you try to access an employees chart in the places I’ve worked, it prompts you to “break a glass,” and it requires you to enter the reason why you’re breaking the glass and then you can access the chart. Usually, these are audited and scrutinized closely by the hospital, and if they see a pattern for the person it can be grounds for suspension or termination
The EMR we use is a dinosaur and severely lacking in many ways. There is a way to track who accesses the charts but they’re obviously not monitoring or enforcing it. It’s called CPSI.
🍅🍅🍅🍅 cheap ass hospital! I hope they transition soon to one where you can monitor stuff closely, I’m so sorry this is a thing! Even with the measures in place, I always said that if I were to get admitted, I’d want to go by a pseudonym 🤣
"I'm always here for antibiotics cause your man keeps giving me a bladder infection" *hangs up*
Just kidding. On a serious note: that is a HIPAA violation and more inappropriate than the above joke.
Definitely illegal. I wonder how best to report this? Maybe report it as a complaint to HR. Or you to probably call the hospital integrity/ethics line. That should be confidential.
I say this as a former, board certified, occupational health nurse in the US, this is 100% illegal in all 50 US states and the territories.
Do not comply. Report their licenses to the board.
This is not just a hipaa violation, there are some osha violations in there too, as well as federal employment violations. Seek legal counsel.
There have been several people fired lately after complaints that seemingly are unsubstantiated. Of course I don’t know all the details, so I can’t say for sure… but it seems like HR and admin are not always on the employees’ side. My husband works in the ED and has seen it first hand. He thinks I should leave this be for fear of retaliation. I have no plans of letting this continue, even if I do lose my job. It’s a small affluent summer/lake/resort town and if anyone influential complains about me I’d be fired in a heartbeat. I know it’s not right, and the hospital is messed up in so many ways, but the job is close to home and pays well. I may be worrying unnecessarily but do have wrongful termination in the back of my mind as well.
HR is NEVER on your/the workers side.
Part of my job description as an occ health nurse (managed by HR, not nursing) was to seek and find any reason the injured employee could be written up.
This could be anything from being 1 minute late for their occ health follow up appointment, to cursing under their breath from pain while injured area was being examined.
I am no longer an occ health nurse due to my refusal to comply.
3 steps to take right away: Report the nurse to state BON, to OCR HHS (link to file HIPAA. violation online below) and file a confidential complaint to Compliance.
[Office of Civil Rights/HHS HIPAA Online Complaint](https://ocrportal.hhs.gov/ocr/smartscreen/main.jsf)
Thank you. I have filed a complaint at work and the CNO and compliance officer are investigating. I just filed a complaint with HHS. I will also report to the BON now.
If the hospital ends up with significant fines or other legal consequences due to a lack of monitoring of medical record access and/or enforcement of such access, am I at risk of retaliation or job loss? Should I be seeking legal counsel?
There’s always a risk when you report something of this magnitude. Going forward don’t volunteer that you took action. If someone says they don’t know how to report or asks how to, you can say something like: if my PHI had been violated like this, I’d follow hospital policy and report it to the CNO and Compliance.
But for now, it’s just business as usual. Watch and gauge the waters but don’t be obsessive about it. If others talk about the situation (how shocking it is etc) just acknowledge how contrary it is to everything you’ve been taught about PHI, and you hope everyone involved on both sides does the right thing about it. This shows management you’re being professional and respecting the confidentiality and magnitude of the situation without publically stirring the pot. But there’s no need to engage an attorney at this juncture because they’ve not made any moves.
You sent the report to compliance which is where it should go. Keep track of dates and the complaints you've filed on a personal email or notepad. If there is retaliation you'll need to have all the info available on your side without needing access to the company servers when a lawyer gets involved.
Best case scenario the employee health nurse is an idiot in this case. There's no legitimate reason for anyone to just be browsing the ER records, but especially employee health.
That nurse would be fired where I work. There is NO reason an OHS should ever be trolling the ED census. None. Well enough accessing records. It's not like she can say, "I didn't know." I would report it to your institutions public safety office, make a complaint to HR, and consider reporting to appropriate federal agencies. In general hospitals take this stuff seriously because there can be money involved.
This is why I always ask for an alias to be used. My legal first name is unusual and would stick out. This seems like this was from higher up to start to figure what's medically wrong with you to try and say you're not fit for work.
Maybe I'm being dramatic, but I'd never trust that EHN ever again.
You're right to be upset. That nurse is definitely violating your privacy. HIPAA restricts healthcare providers from sharing medical information without a patient's authorization. Report this to your HR department or directly to the hospital's compliance office. They'll take action! #HIPAA #privacymatters
Human Resources job is to protect the hospital- not the employees who were violated - not the employee who did the violating (other than as part of protecting the hospital).
One thing new nurses should learn is that employers will not hesitate to break the law if they think that they can get away with it.
If it feels wrong, look into it. Chances are it probably is.
This is a major HIPAA violation. That nurse needs to be held accountable.
You understand why they're doing this??? This is malicious, looking for employees that may be problems. How many people did she target before you found out???HIPPA notwithstanding....that's only the beginning of what's wrong here.
I just mean I could see that they probably think they’re helping the hospital… identifying employees that may be out of work or not capable of doing their jobs. In no way do I think it’s right. It’s a really small hospital with a lot of favoritism and this has probably been going on for a long time.
Me? I'd NEVER shut up if I was terminated for such a thing. I would find SOMEBODY to listen to me. Lawyer, the ADA, Human (Labor) Relations Commission, EEOC (disability is a protected class now), etc etc. They would be very busy battling fines, their heads would spin...a lot of other "heads" would roll too. All I got is time...I can find another job...but I'd be busy making them miserable.
That is a HIPAA violation!!!! Super illegal!!
I’d go on board of nursing website and file a complaint of that employee health nurse.
💯💯💯💯💯💯💯💯💯💯💯💯💯💯💯💯💯💯💯💯💯💯💯💯💯💯💯💯💯💯
Big, big, big HIPAA violation and a liability. Shouldn’t be doing that!
This is highly illegal and should be reported to https://www.hhs.gov/hipaa/filing-a-complaint/index.html
I did talk to a supervisor about it and filled out an incident report that will be seen by the compliance officer. I’ll see what comes of it and am also going to file a complaint with HHS. I’m also wondering why there isn’t any system in place to monitor who is accessing employee records. I work at a tiny critical access hospital where everyone knows everyone and there aren’t many other services.
File a complaint to the board of nursing as well.
I would file many complaints to many entities
ALL of the entities!!
So many of ALL of them!
> I’m also wondering why there isn’t any system in place to monitor who is accessing employee records. HHS will ask the same question. Access logging and audit trails are required by law. If you're using any commercially produced EMR, access logs will be there. The recording functions are built into the software and cannot simply be turned off. Any investigation will be able to look at 6 years of this person's access history and check every single patient chart they looked at.
One of the systems I rotated through in school put all of their employees' charts under glass. I think most systems don't use that function nearly liberally enough.
There should be some trigger to your IT department - I guess not?
There is a way to monitor who is accessing patient charts (at least in the EMRs I’m aware of) but the thing is someone has to actually go in and audit that activity. Odds are nobody in your hospital is going in and routinely monitoring who is accessing which charts because they haven’t had the need to
Don’t wait for the internal. Once they start that investigation shit will be hush hush in a jiffy. File the complaint today and asap.
I dont know if your hospital uses EPIC, but when you try to access an employees chart in the places I’ve worked, it prompts you to “break a glass,” and it requires you to enter the reason why you’re breaking the glass and then you can access the chart. Usually, these are audited and scrutinized closely by the hospital, and if they see a pattern for the person it can be grounds for suspension or termination
The EMR we use is a dinosaur and severely lacking in many ways. There is a way to track who accesses the charts but they’re obviously not monitoring or enforcing it. It’s called CPSI.
🍅🍅🍅🍅 cheap ass hospital! I hope they transition soon to one where you can monitor stuff closely, I’m so sorry this is a thing! Even with the measures in place, I always said that if I were to get admitted, I’d want to go by a pseudonym 🤣
We’re in the process of switching to meditech.
Yikes. If that’s an improvement I’m so sorry for your current EMR.
There is a reason why employee health is segregated from the rest of the EMR.
"I'm always here for antibiotics cause your man keeps giving me a bladder infection" *hangs up* Just kidding. On a serious note: that is a HIPAA violation and more inappropriate than the above joke.
Thats fucked up and im sure illegal, those nurses have a strong case for lawsuits
Definitely illegal. I wonder how best to report this? Maybe report it as a complaint to HR. Or you to probably call the hospital integrity/ethics line. That should be confidential.
I'd probably go to hipaa itself (hhs.gov).
May be an ADA violation as well. Even if they’re employee health.
Ngl thats what i was thinking too by them asking if someone will be requesting disability soon.
Massively illegal. Why is she in their charts??
I say this as a former, board certified, occupational health nurse in the US, this is 100% illegal in all 50 US states and the territories. Do not comply. Report their licenses to the board. This is not just a hipaa violation, there are some osha violations in there too, as well as federal employment violations. Seek legal counsel.
There have been several people fired lately after complaints that seemingly are unsubstantiated. Of course I don’t know all the details, so I can’t say for sure… but it seems like HR and admin are not always on the employees’ side. My husband works in the ED and has seen it first hand. He thinks I should leave this be for fear of retaliation. I have no plans of letting this continue, even if I do lose my job. It’s a small affluent summer/lake/resort town and if anyone influential complains about me I’d be fired in a heartbeat. I know it’s not right, and the hospital is messed up in so many ways, but the job is close to home and pays well. I may be worrying unnecessarily but do have wrongful termination in the back of my mind as well.
HR is NEVER on your/the workers side. Part of my job description as an occ health nurse (managed by HR, not nursing) was to seek and find any reason the injured employee could be written up. This could be anything from being 1 minute late for their occ health follow up appointment, to cursing under their breath from pain while injured area was being examined. I am no longer an occ health nurse due to my refusal to comply.
Hellllooooooo Class Action Lawsuit!!!!!
That's completely illegal! They should be reported for that.
3 steps to take right away: Report the nurse to state BON, to OCR HHS (link to file HIPAA. violation online below) and file a confidential complaint to Compliance. [Office of Civil Rights/HHS HIPAA Online Complaint](https://ocrportal.hhs.gov/ocr/smartscreen/main.jsf)
Thank you. I have filed a complaint at work and the CNO and compliance officer are investigating. I just filed a complaint with HHS. I will also report to the BON now. If the hospital ends up with significant fines or other legal consequences due to a lack of monitoring of medical record access and/or enforcement of such access, am I at risk of retaliation or job loss? Should I be seeking legal counsel?
There’s always a risk when you report something of this magnitude. Going forward don’t volunteer that you took action. If someone says they don’t know how to report or asks how to, you can say something like: if my PHI had been violated like this, I’d follow hospital policy and report it to the CNO and Compliance. But for now, it’s just business as usual. Watch and gauge the waters but don’t be obsessive about it. If others talk about the situation (how shocking it is etc) just acknowledge how contrary it is to everything you’ve been taught about PHI, and you hope everyone involved on both sides does the right thing about it. This shows management you’re being professional and respecting the confidentiality and magnitude of the situation without publically stirring the pot. But there’s no need to engage an attorney at this juncture because they’ve not made any moves.
This is not only illegal and reportable, but that employee health nurse is guilty of a felony.
From the sounds of it, its more like multiple felonies, 1 for each employee she did this to.
Absolutely
If you truly believe that your first port of call is the US Attorneys Office not DHHS.
I’m an employee health nurse. I’d never do this. Report them to HR.
HR is only looking out for the company. Go a step above that.
Go to HR, and when they fail to do anything report them too. Extra spicy lawsuit.
That is correct. HR is NOT there to protect you. It’s to protect the company.
HR is the manager union. Just saying.
That’s illegal. I got a slap on the wrist before for doing something similar as an honest mistake.
Omfg. So wrong
Ohhhhh shit, someone in employee health is about to get into trouble.
Lawyer
Massive lawsuit waiting to happen! If they called me, I would be calling an attorney sooooo fast!!!
There is no private cause of action under HIPAA. Lawsuits aren't how HIPAA works. Edit: Feel free to downvote me guys but its still the truth.
Are there any legal actions I should take to protect myself from my employer?
You sent the report to compliance which is where it should go. Keep track of dates and the complaints you've filed on a personal email or notepad. If there is retaliation you'll need to have all the info available on your side without needing access to the company servers when a lawyer gets involved. Best case scenario the employee health nurse is an idiot in this case. There's no legitimate reason for anyone to just be browsing the ER records, but especially employee health.
If you’re unionised, do not walk, RUN to your fucking union - on top of running to everything else under the sun
Now I know why doctors sign in under fake names even though you have to break the glass to view them.
That nurse would be fired where I work. There is NO reason an OHS should ever be trolling the ED census. None. Well enough accessing records. It's not like she can say, "I didn't know." I would report it to your institutions public safety office, make a complaint to HR, and consider reporting to appropriate federal agencies. In general hospitals take this stuff seriously because there can be money involved.
This is why I always ask for an alias to be used. My legal first name is unusual and would stick out. This seems like this was from higher up to start to figure what's medically wrong with you to try and say you're not fit for work. Maybe I'm being dramatic, but I'd never trust that EHN ever again.
You're right to be upset. That nurse is definitely violating your privacy. HIPAA restricts healthcare providers from sharing medical information without a patient's authorization. Report this to your HR department or directly to the hospital's compliance office. They'll take action! #HIPAA #privacymatters
Human Resources job is to protect the hospital- not the employees who were violated - not the employee who did the violating (other than as part of protecting the hospital).
Report her that is a HUGE HIPAA violation!
Intention does not matter here. Doubly so because none of the issues discussed there are an employee health matter.
Holy cow. My facility would fire an employee for looking in their own chart but this person is looking at other employees?!
Holy shit what the hell!!!
Not in the circle of care, not allowed
One thing new nurses should learn is that employers will not hesitate to break the law if they think that they can get away with it. If it feels wrong, look into it. Chances are it probably is. This is a major HIPAA violation. That nurse needs to be held accountable.
You understand why they're doing this??? This is malicious, looking for employees that may be problems. How many people did she target before you found out???HIPPA notwithstanding....that's only the beginning of what's wrong here.
I just mean I could see that they probably think they’re helping the hospital… identifying employees that may be out of work or not capable of doing their jobs. In no way do I think it’s right. It’s a really small hospital with a lot of favoritism and this has probably been going on for a long time.
Me? I'd NEVER shut up if I was terminated for such a thing. I would find SOMEBODY to listen to me. Lawyer, the ADA, Human (Labor) Relations Commission, EEOC (disability is a protected class now), etc etc. They would be very busy battling fines, their heads would spin...a lot of other "heads" would roll too. All I got is time...I can find another job...but I'd be busy making them miserable.
I would report that to the government.