Saint Joseph’s Medical Center, a non-profit academic medical center in New York, has settled with the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) over potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule. The settlement pertains to the alleged unauthorized disclosure of COVID-19 patients’ protected health information to a national media outlet.
“Patients should not have to worry that providers may disclose their health information to the media without their authorization,” said OCR Director Melanie Fontes Rainer. “Providers must be vigilant about patient privacy and take necessary steps to protect it and follow the law. The Office for Civil Rights will continue to take enforcement actions that put patient privacy first.”
The investigation into Saint Joseph’s Medical Center was triggered after the Associated Press published an article about the medical center’s response to the COVID-19 public health emergency, which included photographs and information about the facility’s patients. The images, distributed nationally, exposed protected health information including patients’ COVID-19 diagnoses, medical statuses and prognoses, vital signs, and treatment plans.
OCR found that Saint Joseph’s Medical Center disclosed three patients’ protected health information to the Associated Press without obtaining written authorization from the patients first. This potentially violated the HIPAA Privacy Rule, which stipulates that a covered entity may not use or disclose protected health information unless permitted or required by the HIPAA Privacy Rule, or authorized in writing by the individual who is the subject of the information.
As a result, Saint Joseph’s Medical Center paid $80,000 to OCR and agreed to implement a corrective action plan. This requires the facility to develop written policies and procedures in compliance with the HIPAA Privacy Rule and to train its workforce on these revised policies and procedures. Under this agreement, OCR will monitor Saint Joseph’s Medical Center for two years to ensure compliance under the plan and with the law.
For the latest news on everything happening in Chester County and the surrounding area, be sure to follow MyChesCo on Google News and MSN.