19 Most Common Examples of HIPAA Violations

Conversations between clinical co-workers about patient diagnosis, treatment, and medications should never occur in public spaces so they cannot be overheard.  It may not seem important discussing medicine around non-medical people in a public place like the hospital cafeteria. However, this kind of PHI breach can result in significant financial consequences for hospitals and healthcare organizations.

Healthcare organizations can also inadvertently disclose PHI in ways other than a data breach. For example, a healthcare organization may disclose PHI to a patient's employer, or a person may be filmed or photographed without the patient's consent.  PHI in the form of paper records can also accidentally be disclosed by taking it offsite and then accidentally getting lost or stolen.  Healthcare organizations should be especially sensitive in today's work from home environment (WFH)  Also, emailing PHI information to the wrong person or using personal email accounts that are not encrypted can result in HIPAA breach.

Some examples:

Incorrect disposal of PHI can make patients more vulnerable to public exposure of their information. PHI records should be shredded and hard drives destroyed based on industry accepted practices

Some examples:

Any documents or files with PHI need to be kept in a secure location. Paper files should always be locked in file cabinets and never left unattended. Electronic PHI needs to be secured with strong passwords and encryption. Also, two factor authentication (2FA) to access the servers and networks are also critical. Only just a username and a strong password are not secure enough to thwart today's sophisticated hackers.  Employees should also be trained to never share login credentials since their coworkers may not have the same access rights. If an employee handling PHI steps away from their desk, then they should lock their workstation.  Specialized screen covers should also be used so that information is only viewable to the person sitting in front of the workstation.

Antivirus and antimalware on devices with PHI should be kept secure by updating via automatic processes. Specialized hardware-based firewalls will add additional security. There is no substitute for strong passwords that are frequently changed and two-factor authentication (2FA) to thwart hackers.

HIPAA violations can occur if employees or contractors access PHI that they are not authorized to access. Policy training should emphasize that accessing PHI just for "curiosity" is still nevertheless a breach, and the intent does not matter as the fine will be the same. "I was just curious" is one of the most common reasons employees give when they violate HIPAA rules. People are curious about their families, friends, coworkers, and celebrities. When these violations are discovered, they may involve criminal charges. One health system in Los Angeles was fined $865,000 for failing to protect access to medical records. They found that an employee, Dr. Huping Zhou, had accessed unauthorized patient records 323 times, and for this violation he was sentenced to four months in federal prison.

Sometimes members of the media can try to use social hacking to get information about public figures and celebrities. For instance, they might pretend they are a family member. Also, this kind of violation can happen when PHI is released to family members who are not authorized. Only clinical care and billing professionals, parents and children, and those with power of attorney have access to a person's PHI.

When it comes to discussing PHI the principal of "need to know" should be used to decide who should be in the communication loop.  Healthcare organizations should implement access privileges with the Minimum Necessary Standards principle. Typically, those involved should be only the patient, the doctors, others care providers, and those handling medical billing.

It is an excellent compliance best practice to make sure disclosure authorization forms are signed and maintained in patient files. The authorization form should specify what type of information is authorized for release and the expiry date of the authorization. The authorization form could also include classes of individuals, the types of PHI, and the reasons for disclosure.  Every authorization should have an expiration date otherwise it is not considered a HIPAA compliant. Care should also be taken to make sure that new authorization forms are signed if needed after an expiration date. Health care workers must also verify the identity of any individual or entity to whom they are providing PHI.