IT HAD BEEN several months since Penny, the office manager at The Eye Care Center of Pasadena, hired Amy to work at the front desk. While Amy didn’t have any prior experience working in the healthcare industry, she did have a lot of experience working in an office and interacting with the public.
ABOUT REAL DEAL
Real Deal scenarios are inspired by true stories but are changed to sharpen the dilemmas involved and should not be confused with real people or places. Responses are peer-sourced opinions and are not a substitute for professional legal advice. Please contact your attorney if you have any questions about an employee or customer situation in your own business.
ABOUT THE AUTHOR
Carissa Dunphy has been working in private practice optometry since 2008 and is the founder of Optician Now (opticiannow.com). Follow Carissa on Instagram and Facebook at @opticiannow.
Amy quickly picked up optometry terms and the office had become more efficient with her at the helm of the front desk.
One afternoon grew to be quite busy and Penny found herself answering the phone, which had become somewhat atypical.
“Um, hi. I’m not sure who to talk to there about this,” the patient said.
“My name is Penny, I’m the office manager, I would love to help you in whatever way I can,” she replied.
“OK. My name is Mary Cooper. I recently came in for one last visit before I move out of the state.” The patient continued, “Amy was so helpful and explained the importance of getting my records to my new eye doctor. I don’t know when or who that will be so we decided it would be best for me to hold on to my own records, and give them to the new doctor, whenever and whoever that may be.”
“That sounds like a good plan.” Penny added, “How might I be able to help?”
Advertisement
“This morning I was happy to see she emailed me, before I left for good.” Ms. Cooper continued, “You know, one more thing checked off the never-ending list. Well anyways, I opened the attachment to skim through the pages and nothing made sense.”
Penny replied, “How so?”
Ms. Cooper answered, “What I was reading didn’t sound at all familiar from my last visit. I started really reading thoroughly and noticed that the top of each page said Stuart Bloom with a birthdate that isn’t mine.”
“Well that is interesting,” Penny commented. “And the email is from The Eye Care Center of Pasadena?”
“Yes, I knew it was, because Amy wrote me a nice email and summarized what we talked about. But the wrong records were attached,” Ms. Cooper replied.
“I apologize for that mistake.” Penny added, “I know you are trying to leave town and I would really like for you to not have another thing on your plate. I will personally email you your records as soon as we hang up.”
“Well how do I know they weren’t emailed to someone else?” Ms. Cooper asked.
“I will look into that.” Penny continued, “Let me get your records to you first, so you can have peace of mind that you have them. Afterwards I will look into the email system and contact you a bit later with some answers about the handling.”
“OK, I appreciate your help. Thank you,” Ms. Cooper concluded.
Penny had a wave of confusion, questions, concerns, and “oh craps” blast through her mind.
The Big Questions
- How could Amy have missed that one? All PHI is to be sent through their encrypted email service; and secondly, how could she have attached the wrong person’s records?
- What is the protocol to legally resolve PHI being sent to the wrong recipient?
- What policies does your office have in place for keeping PHI secure and staff up to date with the protocol?
Advertisement
Marc U.
Pine Beach, NJ
It would be rare for this situation to come up although I do get medical records from local surgeons co-managing with somebody else sent to my office by accident on occasion. It is an uncomfortable situation because HIPAA mistakes can be costly. In this situation, I think all you can do is apologize and reassure the patient that no one else had requested records and that her records were not sent anywhere else. You could easily confirm that this patient’s chart was not sent that day to anyone else. I would ask her to delete the chart that she received so she sees that you care about protecting the records and knows it was just an accident.
Jason K.
Phoenix, AZ
That’s quite the blunder and should have been caught by the staff member prior to being sent out. In our practice we release records in one of two ways to patients — pick up in office or uploaded directly to their secure patient portal. In this instance it is all done from within the same patient chart and you cannot upload the incorrect patient’s file. If a HIPAA violation does occur, our responsibility is to both notify the patient whose PHI was exposed as well as self-report the incident to the department of health and human services. We share PHI in a limited number of ways to reduce risk of accidental disclosure using systems designed for exactly this. HIPAA does need to be updated to take into account modern life. When written, the Palm Pilot and Nintendo 64 were just released. Technology has evolved tremendously and we need clearer direction on permissible uses as well as evolution of the law itself to take these technologies into account.
What’s the Brain Squad?
If you’re the owner or top manager of a U.S. eyecare business serving the public, you’re invited to join the INVISION Brain Squad. By taking one five-minute quiz a month, you can get a free t-shirt, be featured prominently in this magazine, and make your voice heard on key issues affecting eyecare professionals. Good deal, right? Sign up here.
