Case Study:
The following case study (Rinehart-Thompson) at hypothetical St. John Hospital illustrates numerous issues that the HIPAA privacy rule presents and which HIPAA-covered entities must address on a daily basis. As you conclude Chapter 9 and the HIPAA privacy rule requirements, use this case study to identify the issue(s) presented on each date, determining how each situation should be handled in order to comply with the HIPAA privacy rule.
From May 26-30, Mary Jones was hospitalized in St. John Hospital, located in Johnson County, with depression and a drug overdose (documented by the physician as possible suicide attempt). She also had Type I diabetes and a previous above-knee amputation of the right leg, with prosthesis. During her hospital stay, she had several sessions with her psychiatrist, Dr. Bridges.
On July 18, Ms. Jones contacted the HIM Department at St. John Hospital to request a copy of her medical records from her May hospital admission. The chart was copied for her by ReadyChart, the record-copying service utilized by St. John Hospital.
On August 7, Ms. Jones returned to the HIM Department at St. John Hospital, extremely upset that her May records indicated a possible suicide attempt. She wanted Dr. Bridges to change the incorrect records to reflect that the overdose was accidental. Dr. Bridges refused, stating that Ms. Jones didn’t know what she was talking about.
On September 14, Ms. Jones was readmitted to St. John Hospital with an infection of the prosthetic site. She was treated with an antibiotic regimen.
On October 5, St. John Hospital received a call from Mercy Hospital. Ms. Jones was in the emergency department there, with a severe infection of her prosthetic site. The nurse in the Mercy Hospital emergency department asked for faxed copies of medical records from Ms. Jones’ September admission at St. John, as she was being prepared for immediate surgery.
On October 15, Ms. Jones decided to go to another psychiatrist. She called St. John Hospital HIM Department and asked that her medical records from her May hospital admission be mailed to Dr. Lyon, as she has an appointment scheduled with him this coming January. Ms. Jones stated that she had also changed jobs in September, and her new health insurer was Liberty Life and Health.
On October 30, Ms. Jones requested a copy of her medical records from her September admission. The new HIM manager in charge of correspondence, Don Day, stated that he was aware of a state statute that prohibited the release of medical records to patients without prior written approval of their attending physician. This has not been the practice at St. John Hospital. Mr. Day was concerned about the hospital’s longstanding violation of state law. He suggested that correspondence requests (in which records would be released directly to patients) be suspended until the state law could be researched further.
On November 10, Ms. Jones received a brochure and samples from Comfort Healthcare, a pharmaceutical company that manufactures ointment for patients with prostheses. Ms. Jones called the St. John Hospital registration desk to complain. Jessica Carter, a candy striper, took Ms. Jones’ call.
On November 12, Liberty Life and Health submitted a request to Dr. Lyon’s office for copies of Ms. Jones’ medical records from her May St. John Hospital admission and from Dr. Lyon’s office.
On November 17, A case worker from the Johnson County Children’s Services called the HIM Department at St. John and requested Ms. Jones’ medical records from her May hospitalization. Children’s Services had received a complaint that Ms. Jones had an “episode” on May 26 and there was concern that her children were being subjected to ongoing abuse. As a result, it was initiating an investigation.
On November 20, the physical therapy department at St. John Hospital is performing a correlational study to determine the effects of two different types of treatment that the physical therapy department has used with its above-knee amputation patients during the past two years. Ms. Jones received treatment from the St. John physical therapy department during her September admission.
On November 21, Dr. King, an orthopedic surgeon, presented a seminar to the state association of orthopedic surgeons on above-knee amputation techniques. He had performed Ms. Jones’ procedure one year ago, and he showed slides that compared her condition before the procedure, immediately after, six months later, and one year later.
Based on the HIPAA privacy rule issues discussed in Chapter 9, identify the issue or issues presented on each date in the above case study.
Sample of what your assignment should look like. I went ahead and provided the first two dates for you. Your assignment is to provide the needed documentation for the remaining dates:
Date | Event | Identified Privacy Rule Principle(s) |
May 26–30 | Patient hospitalized at St. John Hospital, Johnson County. Treated by psychiatrist Dr. Bridges. | During hospitalization: facility directory |
July 18 | Patient requested copies of medical records from May 26-30 admission at St. John Hospital. Records copied by record copying service, ReadyChart. | Individual right of access (and psychotherapy notes exception). ReadyChart is a BA; its employees may be considered workforce members |
August 7 | Patient wants “possible suicide attempt” removed from records by Dr. Bridges | Individual right to request amendment |
Provide the remaining answers in a table, as you see here. Include the dates: September 14 – November 21. | ||
Provide the remaining answers in a table, as you see here. Include the dates: September 14 – November 21.
Once your table is done, provide a summary for each of the dates identified in the documentation. I have provided an example for you below to get you started.
May 26-30: The scenario doesn’t state whether Mary was admitted to a special behavioral health or substance abuse unit. If there are special units, St. John Hospital may establish a policy where there is no facility directory for those units (to ensure patient confidentiality). In that case, patients should be instructed that no information will be given about them and they will need to contact individuals directly. If facility policy allows Mary to be included in the facility directory, it must be clear to her what information can be disseminated—fact of her admission; location; condition in general terms to those who ask for her by name; religion (to clergy of her religious affiliation if this has been indicated on her record).
July 18: If Dr. Bridge’s documentation constitutes psychotherapy notes, Mary does not have a right of access to this information (an exception to the individual right of access under the HIPAA privacy rule). If the record is an EHR, an electronic copy must be made available to Mary. ReadyChart is a business associate (the organization is not a member of St. John’s workforce and its functions include the use and disclosure of individually identifiable health information on behalf of the covered entity, St. John Hospital). There must be a signed business associate agreement (BAA) between St. John Hospital and ReadyChart, although ReadyChart is still a BA even if a BAA does not exist. The business associate agreement must reflect the required changes per HITECH (which increase the risk of being a business associate). Special note: ReadyChart employees, who likely routinely work on-site at St. John Hospital, may be considered workforce members for purposes of training and so forth.
August 7: Mary is exercising her individual right to request an amendment to her health records. The right to request does not mean that the covered entity must comply with the request. If her request is granted, St. John must identify the records in the DRS that are affected by the amendment and append the information. Mary must then be notified that the amendment was accepted, have her identify the persons with whom the amendment needs to be shared, and obtain her agreement to notify those persons. Reasonable efforts must be made to provide the amendment within a reasonable amount of time to anyone who has received Mary’s PHI.
Research
Visit the website of the Office of Civil Rights for the Department of Health and Human Services and access the posting of breach incidents affecting 500 or more individuals at . Identify information such as the 10 largest breaches that occurred in the past 2 years, the locations of the breaches, and whether the covered entities are healthcare providers or other types of covered entities.
Expert Solution Preview
Date Event Identified Privacy Rule Principle(s)
September 14 Ms. Jones readmitted to St. John Hospital with an infection of the prosthetic site. Minimum necessary and security rule
October 5 Mercy Hospital calls St. John Hospital requesting faxed copies of medical records from Ms. Jones’ September admission. Disclosure to other covered entities
October 15 Ms. Jones requesting medical records from her May hospital admission to be mailed to Dr. Lyon. Individual right of access
October 30 Don Day suggests correspondence requests be suspended until state law can be researched further. State preemption
November 10 Ms. Jones received brochure and samples from Comfort Healthcare. Complaint mechanism
November 12 Liberty Life and Health requests copies of medical records from St. John Hospital and Dr. Lyon’s office. Disclosure to health plans
November 17 Johnson County Children’s Services requests medical records from Ms. Jones’ May hospitalization for investigation. Disclosure to public health authorities
November 20 Physical therapy department performing a correlational study that includes Ms. Jones as a patient from her September admission. Limited data set
November 21 Dr. King presents a seminar on above-knee amputation techniques and uses slides comparing Ms. Jones’ condition before and after the procedure. Minimum necessary
Summary:
– September 14: St. John Hospital must ensure that only minimum necessary PHI is disclosed to treat Ms. Jones’ infection of the prosthetic site. Security rule requirements must also be met.
– October 5: St. John Hospital may disclose PHI to other covered entities for treatment purposes without obtaining written authorization from Ms. Jones.
– October 15: St. John Hospital must provide access to Ms. Jones’ medical records from her May hospital admission and provide them to Dr. Lyon as requested.
– October 30: St. John Hospital must research state law to determine compliance requirements before resuming fulfilling correspondence requests without physician approval.
– November 10: St. John Hospital must have a complaint mechanism in place for patients who receive unsolicited marketing materials.
– November 12: St. John Hospital may disclose PHI to a health plan for payment purposes without obtaining written authorization from Ms. Jones.
– November 17: St. John Hospital may disclose PHI to public health authorities for investigation purposes without obtaining written authorization from Ms. Jones.
– November 20: St. John Hospital may use Ms. Jones’ data in a limited data set for the correlational study performed by the physical therapy department.
– November 21: Dr. King must only use and disclose minimum necessary PHI during his seminar presentation.
