HIPAA PRIVACY AND SECURITY RULES

HIPAA privacy and security rules



HIPAA Privacy and Security Rules

In the first case, the governor of the state, Hayden Samual Barrett was admitted to the hospital for surgery. He asked the management of the hospital to keep his hospitalization private, and reassurance was given to him by the hospital that no one will know about his hospitalization. However, three channels ran a story about his hospitalization. After talking with the news channel, the hospital managed to convince the news channel not to report further stories on the governor's hospitalization. The channels did not reveal their source but told the hospital that the news was broadcast that someone from the hospital leaked the information (Aluvihare, 2000).

In the second case, the CD holding patient information of about 1000 hospital patients was being transferred to the hospital from the storage for better safe keeping. On the way, the driver was stopped due to speeding, and after he was back from speaking with the police officer, the CD was gone. The driver immediately reported this incident to the hospital and retraced his route to look for the CD, but the missing CD could not be found. The hospital has a backup of that patient information, but the problem is the privacy breach. The employee who was on duty the day the CD went missing was a temporary employee from an employment agency named Sebastian Tresch.

As per the HIPAA (1996) Privacy, Security, and HITECH (2009) breach notice requirements, the patients must be notified about this data theft immediately and no later than 60 days after the breach was discovered. In both the above mentioned cases, first and foremost the notice is to be sent to the patients. The notice sent to patients requires to be written in simple language (Phelps, 2002). ...