HIPAA Violation: Case Study Analysis, Healthcare Ethics and Law

This assignment analyzes a case study involving a HIPAA violation where an obstetrics nurse disclosed a patient's private health information. It delves into the investigation process following the breach, assessing whether the incident constitutes a violation of the Health Insurance Portability and Accountability Act (HIPAA). The essay examines the hospital's stance on the breach in relation to HIPAA regulations and explores the actions that should be taken by the privacy officer, including risk assessment, patient notification, and communication with the Department of Health and Human Services (HHS). The assignment highlights the importance of patient autonomy, confidentiality, and the legal and ethical responsibilities of healthcare professionals in protecting patient information, while also considering the consequences of unintentional violations and the potential for disciplinary actions.

Running head: HIPAA VIOLATION
HEALTHCARE ETHICS AND MEDICAL LAW
Name of the Student
Name of the University
Author note

1HIPAA VIOLATION
Introduction
The Standards for Privacy of Individually Identifiable Health Information was established
that helped to create a set of national standards for the protection of certain health informations.
The United States Department of Health and Human Services (HHS) distributed the privacy
rules and implemented the privacy policy to fulfill the requirement of the Health Insurance
Portability and Accountability Act 1996 (HIPAA) (HHS, 2018). According to this rule, the use
and disclosure of individual’s health information is prohibitory as it is termed as ‘covered
entities’ moreover, it provides the patient with the opportunity of enforcement, breach
notification and security rights (Rodrigues et al., 2013). In the case study, breaching of such
privacy is mentioned, where the obstetrics nurse disclosed a 15-year-old girl’s identity, who
admitted to hospital after severe labor. The nurse further contacted the higher authority to resign
from her duties and stated all her mistakes. She was aware of the fact that by disclosing the
identity of the young pregnant patient, she has breached the privacy policy by HIPAA. This
assignment will be discussing specific requirements to perform the investigation of the study.
Further, this assignment will identify the incident as actually breaching of privacy or not. The
stance of the hospital about the breaching complies with the HIPAA rules or not will be
discussed in details. Finally, my take on the situation, as the privacy officer in the organization
will be discussed.
Thesis Statement
This assignment will focus to align the case study provided with the HIPAA law to
understand the situations of healthcare privacy breaching and necessary actions that needs to be
taken.

2HIPAA VIOLATION
Investigation process of breaching
According to the HIPAA rules for privacy protection of patients, there is a flow of
process, which need to be followed in case of breaching of HIPAA norms. Breaching should be
investigated as breaking the privacy rules or disclosing the identity of the patient can lead to
higher risk in the society. The covered entity or the patient, whose identity has been disclosed,
can provide the organization with required notification about breaching. Further, undergoing risk
assessment to confirm the health information breaching would not be necessary in such situation
(Wang & Huang, 2013). However, if the risk assessment procedure is followed, few factors need
to be assessed such as the type of information disclosed or importance of that identification to re-
identify the person. The second issue that need to be assessed is to identify the person the
identification was disclosed, as it determines the severity of breaching. The third issue that
should be kept in mind is the information disclosed to a third person, was acquired or viewed by
the accused or was correct. This issue is also critical as acquired perception about the patient can
harm his/her social image. The final topic that need to be mentioned in the risk assessment is
about the severity of the protected information, breaching of which can affect the life of patient
(Rodrigues et al., 2013).
In the mentioned case study, the 15-year-old girl, whose identity has been disclosed, did
not know about the breaching of the privacy rules. The patient hid her pregnancy from her
family, despite of the fact that her mother and aunt both are nurses in the hospital. Therefore, it
was mandatory for the hospital authority to maintain her privacy. However, as per the statement
of the Obstetrics (OB) nurse, she disclosed the identity of the patient to he daughter, who
identified the girl. Therefore, in such case, a notification should be given to the OB nurse,
seeking the reason and situation of the breaching (Wang & Huang, 2013). The patient should be

3HIPAA VIOLATION
noticed about the breaching of her personal information using a simple notice in which, small
description of the breach, including the date, time and situation, the type of information
disclosed, small description of the four step action taken against the accused and the contact
information of the privacy officer will be mentioned. A further notice will be sent to the family
members of the patient about her pregnancy, despite the fact that she did not wanted her family
members to know about her pregnancy. the final step will be notify The United States
Department of Health and Human Services (HHS) about all the breaches within the hospital
including the case mentioned here, as it is important for the healthcare facilities in USA to
inform the HHS about such breaching. These steps will be taken to investigate the breaching
(HHS, 2018).
Authenticity of the breaching according to HIPAA
According to the Health Insurance Portability and Accountability Act of 1996 (HIPAA),
breaching of the patients protected health information involves medical or lab reports and the
hospital bill as these document contains the mane of the patient, disclosing of which is against
the rule of HIPAA. Further, the rule demonstrates that unintentional breaching of HIPAA rule
that could or could not harm the patient is also not accepted under the provision of this law.
While carrying the risk assessment of the HIPAA disclosure, the hospital authority have to
conduct the investigation to understand the level of breaching (American Society of Health-
System Pharmacists, 2012). Further, the organization can term the unintentional action as
disclosure or breaching the information as use. Evaluation of the breaching and risk assessment
process involves four main processes; these are nature of breaching and its extent, unauthorized
person, acquisition and extent of risk that has been mitigated. Further, the hospital authorities
with the help of HHS officers try to figure out the effect of such breaching by an impact analysis,

4HIPAA VIOLATION
in which social, mental and physical effect of breaching on the patient is assessed (Trinckes,
2012).
The case demonstrates the situation, in which the OB nurse unintentionally breached the
core rule of the nursing ethics and disclosed the name of the young pregnant girls name to her
daughter. This action was unintentional, but the patient information was leaked to an
unauthorized person and the nurse shared the information to her family members. Furthermore,
the information was spread to the entire society, despite the fact that the patient wanted to hide
her identity from her family members, the action of the nurse revealed her identity to everyone in
the society. Upon risk analysis, it was observed that the nature of the breaching was
unintentional but the extent of breaching was enough to disclose the identity of the patient. The
breaching of HIPAA law involved an unauthorized person, the daughter of the OB nurse, who
knew about the patient and disclosure of the identity helped her to recognize the patient. All
these fact indicated to the fact that despite being an unintentional breaching, the nurse violated
the law of HIPAA by revealing the identity of the patient. Therefore, this incidence is an actual
breaching of HIPAA law related to protected health information (Trinckes, 2012).
The differences and similarities between the hospital’s stance and HIPAA
Maintaining the privacy and confidentiality of the nature of patient records is an
important section of the patient care and it is the responsibility of the hospital authority to
comply with the HIPAA laws of the HHS department of USA. However, there are five
agreement and relationships present that can be established between the healthcare entities to
lessen the burden of HIPAA laws on the healthcare facilities. These are affiliated covered entity,
data use agreement, trading partner agreement, chain of trust agreement, and business associated

5HIPAA VIOLATION
agreement (El Emam, 2013). The HIPAA’s prime goal is to obtain confidentiality, data integrity
and availability to protected health information within the organization and outside the
organization as well. However, the chain of trust rue is determined by the organization, in which
it provides the data to the healthcare information technology department to store the patient data
in the database for further implication. Therefore, the HIPAA cannot interfere with such policies
of the organization, in which sharing of data is for the beneficiary of the patient (American
Society of Health-System Pharmacists, 2012).
As the privacy protection department head, I am aware of the organizational policy about
patient data protection and compliance of it with that of the HIPAA norms. Therefore, after the
nurse accepted her fault, investigation for risk assessment and impact assessment of the
breaching was done. Risk assessment included several factors such as intentional, unintentional,
acquisition, the person, to whom, the details were disclosed the impact of the disclosure of the
identification and so on. All these processes were similar to that of the HIPAA norms and its
notification and investigation policy. However, the hospital authority had one more factor in
their privacy protection policy, which is the experience and impact of the accused employee
within the organization (Malin, Emam & O’keefe, 2013). The hospital believes that if any
veteran employee breach any of the hospital or HIPAA policy and the effect of it is minimal on
the patient’s life, then the employee should be provided with another chance to stay in the
organization. On the other hand, according to HIPAA, breaching of any kind of privacy policy,
intentionally and unintentionally are considered, as breaching and the government possess the
right to decide the future of the employee with the organization. Therefore, these are differences
and similarities between the hospital’s stance and the HIPAA norms about the breaching
incidence and the suspension of the OB nurse from the organization (El Emam, 2013).

6HIPAA VIOLATION
Immediate action or not
According to the HIPAA law, the department of health and human services in USA
decides the time and duration of action taken against the violator of the HIPAA law. According
to the HIPAA law, if the employee unknowingly violates the HIPAA law for the first time, there
are provision of penalty and if the violator accepts that she/he violated the law with willful
action, then they are penalized with $50,000. Here a law infraction should be mentioned, which
states that, if the person willfully and deliberately discloses the patient’s identity, then there are
provision for one year imprisonment with the penalty of $50,000 and if the action is committed
through deception, then the penalty increases to $1,00,000 and the imprisonment increases to 5
years. Further, if the violator sells the identity of the patient to someone else, the fine can high as
$2,50,000 and the imprisonment increases up to 10 years (HIPAA, 2018).
In the mentioned case, the OB nurse, while disclosing the identity of the 15-year-old
pregnant girl, to her daughter, was not aware of the HIPAA of the norms and unintentionally
violated the norm. However, the impact of her action was very harmful and despite of the fact,
that patient wanted to hide her identity even from her family, the entire community get to know
her condition. Therefore, the nurse’s unintentional action hampers the patient’s autonomy and
violated the HIPAA law. On the other hand, this was the first instance of HIPAA violation from
the nurse and she herself accepted her fault. Hence, being the privacy officer of the hospital, I
will notice the patient about the HIPAA violation and will wait for her reply (HHS, 2018).
Further, I will conduct risk assessment about the violation and until then, the nurse will be sent
for administrative leave and will wait for the risk assessment results. Furthermore, final action
against her will be taken based on the impact of violation and the hospital will comply with the
HIPAA rules. Firing the nurse is not an option as she is an honest employee of the organization

7HIPAA VIOLATION
and therefore, this complicated patient was assigned to her observation. Therefore, she will not
be fired immediately from her work and the authority will wait for the risk assessment results for
taking further action against her.
Conclusion
Protection of patient’s autonomy and privacy is the first and the most important priority
of any healthcare facility worldwide. In USA, the department of health and human services has
created a law namely the health information portability and accountability act 1996. The act has
been revised several times and currently the 2009 act is applied in all the healthcare facilities
throughout the USA. In this assignment, being a privacy officer, I had to decide and determine
an act of HIPAA violation. A nurse unintentionally violated the HIPAA law, by disclosing the
patient’s identity to her daughter, which affected the patient as the entire society get to know her
identity. I determined the act as violation of HIPAA and complied it with the hospital’s rules and
regulation. Further, the similarity and differences of the hospitals stance, with respect to HIPAA
was described. Finally, my decision of sending her on administrative leave instead of
immediately firing her from her job was described with proper argument backed with HIPAA
violation rules and regulations.

8HIPAA VIOLATION
References
American Society of Health-System Pharmacists. (2012). ASHP statement on use of social
media by pharmacy professionals: developed through the ASHP pharmacy student forum
and the ASHP section of pharmacy informatics and technology and approved by the
ASHP Board of Directors on April 13, 2012, and by the ASHP House of Delegates on
June 10, 2012. American Journal of Health-System Pharmacy, 69(23), 2095-2097.
http://www.ajhp.org/content/69/23/2095.short?sso-checked=true
El Emam, K. (Ed.). (2013). Risky Business: Sharing Health Data while Protecting Privacy, 1st
Edn, pp. 124-234, Trafford Publishing. https://books.google.co.in/books?
hl=en&lr=&id=D91RR3dDlr0C&oi=fnd&pg=PR5&dq=HIPAA+rules+&ots=PqpeEnsW
dj&sig=LZsTp_XVHtiE2TRlda0IM_id684
HHS. (2018). Summary of the HIPAA Privacy Rule. HHS.gov. Retrieved from
https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html
HIPAA (2018). Reality of HIPAA Violations and Enforcement - HIPAA.com. HIPAA.com.
Retrieved from https://www.hipaa.com/the-reality-of-hipaa-violations-and-enforcement/
Malin, B. A., Emam, K. E., & O'keefe, C. M. (2013). Biomedical data privacy: problems,
perspectives, and recent advances, volume 20, Issue 1, 1 January 2013, Pages 2–6,
https://academic.oup.com/jamia/article/20/1/2/2909264
Rodrigues, J. J., De La Torre, I., Fernández, G., & López-Coronado, M. (2013). Analysis of the
security and privacy requirements of cloud-based electronic health records

9HIPAA VIOLATION
systems. Journal of medical Internet research, 15(8).
https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3757992/
Trinckes Jr, J. J. (2012). The definitive guide to complying with the HIPAA/HITECH privacy and
security rules, 1st Edn, pp. 35-57, CRC Press. https://books.google.co.in/books?
hl=en&lr=&id=QIDkVW7SN80C&oi=fnd&pg=PP1&dq=HIPAA+rules+violation+&ots
=BVYAHxUHD3&sig=nHampcNoeKqjKvQIiMtexDp2ahY#v=onepage&q=HIPAA
%20rules%20violation&f=false
Wang, C. J., & Huang, D. J. (2013). The HIPAA conundrum in the era of mobile health and
communications. Jama, 310(11), 1121-1122. https://jamanetwork.com/journals/jama/article-
abstract/1732507?redirect=true