EXCLUSIVES
FacebookTwitterLinkedInGoogle+RSS Feed
Fire EMSEMS TodayEMS Insider

Don't Let "Bad Apples" Spoil the Basket!

Preventing Criminal Violations of HIPAA That Can Really Hurt

Since the HIPAA Privacy and Security regulations were enacted several years ago, there have been few enforcement actions against "covered entities" like ambulance services. That is not unusual in the first few years of a regulation, when government enforcement agencies allow for an "educational curve" and give violators the benefit of the doubt. But government officials have signaled that this is about to change.

And on other fronts, the government has been very active in pursuing numerous individual health care providers, invoking the very tough criminal penalties section of HIPAA against them. Criminal penalties for individuals who violate the law are very tough and include up to 10 years in prison, restitution and up to $250,000 in fines. A criminal violation occurs when the individual knowingly discloses protected health information (PHI) for a purpose not permitted under HIPAA and with the intent to use the PHI for personal gain. These often egregious cases of abuse of patient information can have devastating effects not just on the individual who may end up in the "Cross Bars Hotel" but on the EMS agency where the individual serves. Here are just a few recent examples:

  • In the first HIPAA prosecution, a Seattle area phlebotomist stole a dying cancer patient's credit card and rang up $9,000 in purchases. The offender was sentenced to jail for 16 months in this case for violating patient privacy and identity theft.
  • A woman who worked in a physician's office that provided physical examinations to government employees (like FBI agents) was sentenced to six months in jail, four months of home confinement and two years of supervised released after she pleaded guilty to selling an FBI agent's medical records to a person she believed worked for a drug dealer. The man she sold the records to was really a government informant.
  • A former scheduler at a Florida medical clinic owned by the Cleveland Clinic was recently indicted for stealing PHI and other confidential information on 1,100 patients. She also allegedly gave Medicare beneficiary numbers to others who used them to file fraudulent Medicare claims. The scheme led to the alleged submission of $2.8 million in false Medicare claims.

The bottom line is that no individual or organization can afford the consequences of a criminal prosecution for breaching patient privacy. Can this happen in EMS? Absolutely. The temptation to steal patient information and to misuse it becomes much easier when patient records are stored electronically and can easily be downloaded onto a thumb drive or e-mailed to an offsite location. The use of field data collection devices, digital photography and video in the field pose risk where there are no procedures in place to control their use. PHI can be in virtually any form, including not only text and numbers on paper or electronic files, but also photos, videos and even verbal transfer of patient information. For example, selling a digital photo of an accident or crime scene victim you treated while on duty to the news media could be a potential criminal violation of HIPAA.

So what can be done to avoid this potential problem? Here are some suggestions:

  1. Accept only good people (not "bad apples") into the organization! It is getting tougher to find good people these days, but the key to avoiding liability is to stay focused on this goal. You must have a group of EMS personnel who are ethical in all patient interactions and who respect the dignity and privacy of the individual. You should only allow good, honest and ethical personnel deal with patient information. Otherwise, the improper behavior of the "bad apples" can lead to liability and extend to others in the organization when nothing is done to stop it.



    Recruit carefully and put new personnel through background checks, criminal history checks and challenging and in-depth application interviews. During an interview, why not ask applicants to describe how they would handle a particular ethical dilemma? Or perhaps, ask them what they would do if they observed unethical behavior of a colleague. The answers to these questions can often provide insight into how an individual will deal with the tough ethical issues when no one is around to observe the behavior. Inadvertently hiring a "bad apple" without detecting it means it will only be a matter of time before the damage occurs.
  2. Establish clear policies on protecting patient information. This includes the development of solid security measures to avoid inadvertent or improper disclosures of PHI. The policies should encourage everyone in the organization to be vigilant about patient privacy and security, so that everyone is "on the watch" for behavior that could compromise the law and ethical principles. Everyone should be alert to coworkers who talk about unethical practices they've engaged in outside of work such as cheating on income tax returns, theft of goods and services, taking home company supplies, etc. These behaviors could be "red flags" that would indicate that the person may be predisposed to engage in unethical or dishonest behavior in the EMS workplace.
  3. Have a solid compliance plan in place and train on it! People need to know the ground rules and what the organization expects of them. Every covered EMS agency must have in place policies that deal with the use and disclosure of PHI, as well as the security and integrity of PHI. The policies should be widely distributed and made a key part of staff orientation and ongoing training. The policies should be updated annually to ensure compliance with changes in the law and to address problem areas that have come up. For example, many EMS agencies are now updating their policies on the use of personal cell phones and digital imaging devices in light of the recent increase in the personal use of these devices.
  4. Encourage internal "whistleblowing." It is far better to have people in the organization be "on the alert" for potential violations and to report them to the compliance officer or other responsible manager than to take their concerns "outside" to the government enforcement agencies. Everyone benefits when there is a "culture of compliance" that spots problems early and deals with them before they evolve into criminal conduct.

The consequences of criminal sanctions for violating a patient's privacy are great. It could ruin an individual's EMS career and seriously damage the reputation of the organization.

RELATED ARTICLES

Rethink the Way EMS Does Patient Care Reports

EMS must let go of the idea prehospital care documentation is strictly about billing and creating a legally defensible record of events.

Hands On May 2015

Read about the latest products in EMS.

Study Examines EMS' Administration of Aspirin

Less than half of eligible patients receive the drug.

Early Clinical Trials Suggests Hydroxocobalamin Beneficial for Hemorrhagic Shock

Medically facilitated hemorrhage control study yields good results, more questions.

Crew Resource Management Can Improve Crew Efficiency

Crews performing in unison offer better learning opportunities.

Serving the Psychological Needs of Your Employees

How does your agency help employees cope with the traumas and stressors of EMS?

Features by Topic

Featured Careers

 

JEMS TV

FEATURED VIDEO TOPICS

Learn about new products and innovations featured at EMS Today 2015

 

JEMS Connect

CURRENT DISCUSSIONS

 
 

EMS BLOGS

Blogger Browser

Today's Featured Posts