Most healthcare professionals are conscious of HIPAA and, of course, conscientious about patients’ right to complete confidentiality. The healthcare industry has adopted the best practice of annual HIPAA training to cover new workforce members, with periodic refreshers for all employees.
So far so good. However, there are times when common sense and training test the boundaries of the obligations healthcare providers must shoulder. A recently reported court case shows how far-reaching these obligations have become. Medical-legal expert Nancy J. Brent, MS, JD, RN, described a rather bizarre situation that ended with a hospital ICU nurse being penalized.
Most often we associate a PHI breach with a nurse using a messaging app or other text system to transmit patient records in a way that is not encrypted or HIPAA secured. Or with a nurse sharing patient information with someone outside the medical practice, or accessing a patient’s electronic medical record for a personal reason when not providing care.
The nurse in this case worked in the hospital’s ICU, and she remotely accessed patient census lists 11 times when not at work. The lists contained private health information, including patient names, ages, diagnoses, medications and other identifiable health information.
When a supervisor discovered the nurse had accessed the lists, she was told her actions violated the hospital’s “information security policies,” although her reason for checking the lists was to determine ICU staffing and whether she would be required to work her assigned shifts.
The nurse was disciplined and suspended, and the supervisor filed a complaint with the state board. After a board investigation, the nurse received notice of a hearing and of the allegations against her, which involved breaching her duty to protect patients’ confidentiality and privacy rights in violation of the state’s nurse practice act and administrative rules.
What the State Nursing Board Decided
The state board found the nurse’s conduct to be unethical. It found that she:
- Accessed the patient lists for her own purpose, to determine if she would work the next day or be placed on call.
- Did not use information from the lists for any other purpose.
- Did not share the information with anyone else.
- Did not read any personal information on the lists.
The list above seems like ‘no harm, no foul,’ right? Wrong! Even though the nurse did not appear to violate any patient’s protected health information rights, the board found the conduct unethical because she:
- Was not authorized to access the lists from a remote location.
- Did not need the information to perform her duties as an ICU nurse.
Fortunately for the nurse, the board believed she did not understand that her conduct violated the patient confidentiality policy, and the hospital determined the behavior was not a HIPAA violation, so the board imposed the least severe sanction: a citation and a warning.
The nurse filed for judicial review of the board’s ruling. The district court dismissed her petition. She appealed and asked an appeals court to reverse the district court ruling.
The appellate court was very clear that the board had the authority to discipline the nurse under the nurse practice act and its rules on unethical conduct. It also emphasized that proof of actual injury to a patient need not be established.
The court held that her conduct violated hospital policies designed to protect medical information and patient confidentiality, and that she knew or should have known about those policies.
How to avoid a similar situation and outcome
The nurse in this case made an error in judgment in seeking out the ICU patient lists to determine her work schedule. Unfortunately, that error led to serious and costly ramifications.
She could simply have asked permission to access the lists or, even more simply, called the ICU charge nurse to find out whether she would be needed for her assigned shift.
Other guidelines for nurses
Upholding patient confidentiality is a fundamental obligation. Period. Use these guidelines:
- Know your workplace patient confidentiality policy and adhere to it.
- Know your HIPAA compliance obligations, especially under the HIPAA Privacy Rule, and always use a HIPAA-secure communication tool.
- Remember that a violation of your state’s nurse practice act or rules does not require patient injury.
- Know what your nurse practice act, patient confidentiality policy and other rules say about protecting patient privacy.
- Know and adhere to the ethical requirements on patient confidentiality and privacy in the American Nurses Association’s Code of Ethics for Nurses with Interpretive Statements.
- Even the least severe discipline is still a discipline, and it affects a nurse professionally.
Why Covered Entities Must Take Every Access Seriously
Even when no patient harm occurs, unauthorized access to medical records, whether the entire medical record or partial data, is taken seriously by regulators. Unauthorized access to health records can bring legal and professional consequences even if no harm is done. Staff working for covered entities must understand that internal policies, federal law, and ethical standards intersect to protect protected health information. Healthcare facilities must also confirm that every external vendor handling patient data has a valid business associate agreement in place, and that internal access to records is granted with proper patient authorization when required. Without clear protocols, even routine actions by nurses or administrative staff can create security risks and open the door to unintended HIPAA violations.
Why Most Healthcare Providers Still Fail HIPAA Compliance
Unfortunately, a majority of providers fail to fully comply with the HIPAA right of access and face the risk of severe penalties. Although in this case the facility and the employer were not implicated, there could be legal liability for supervisors and covered entities as well, especially if proper business associate agreements are not in place.
Despite the high degree of attention on HIPAA, it is unfortunate that a majority of providers still fail to fully comply with the HIPAA right of access. As this case shows, ignorance is no escape from the penalties for violation, and those are becoming more severe.
Final Thoughts: Protecting Patients’ Medical Records Requires More Than Good Intentions
This case shows how even well-meaning actions can lead to serious consequences under HIPAA rules. Nurses and other healthcare professionals must take proactive steps to protect patients’ medical records and avoid unintentional privacy violations, whether through strict access controls, stronger security measures, or clearer staff education. An unauthorized disclosure, even one without malicious intent, can still be interpreted as a HIPAA breach. To avoid these situations, organizations must enforce clear policies, provide ongoing training, and create a culture that prioritizes data ethics and compliance.