http://www.geekymarketer.com/5-simple-hipaa-violations/ https://www.mc.vanderbilt.edu/root/vumc.php?site=hipaa&doc=11532 http://hipaa.ucsf.edu/frequently-asked-questions Fact of the matter is, none of this is settled caselaw even though it's been 13 years since HIPAA was approved. So some wag reporter can say "Yelp reviews might violate HIPAA" but the fact of the matter is, Yelp anonymizes your information in the same way most of the HIPAA lawyers are recommending. 'cuz let's be honest: if someone violates your HIPAA privacy on Yelp, you're going to sue that person AND Yelp, and they have deeper pockets. We used to deal with this with the Americans with Disabilities Act. The rules are deliberately vague so that lawsuits would establish caselaw. That caselaw has not been established with HIPAA, but dollars to donuts if Yelp was worried they'd be doing something else.Don’t say the patient’s last name when calling them back into the examination room. Calling a patient by first name and last initial or a numbering system is a smarter – and safer – form of identification.
Whenever possible, the patients first name and last initial should be used instead of the full name.
The use of whiteboards is allowed as long as reasonable safeguards are implemented, as appropriate. Listing only last name and first initial in the department is adequate, whereas full first and last name are permitted for safety reasons in the operating room.
Yes, that's a good point. I think the lack of case law is really the key here. Interesting that this hasn't all been sorted out in case law. It seems people aren't as sue-happy as one might be made to believe.Fact of the matter is, none of this is settled caselaw even though it's been 13 years since HIPAA was approved.
So here's the thing: In order to sue, you need a reason. If suing is super-duper easy and cheap, people will sue over everything. If suing is expensive, people will sue over things that will be profitable. An attorney will take a case on spec but only if they suspect they'll make enough, as their fee, to cover their investment of time. You can absolutely file a HIPAA complaint. However, you will get no money out of it. If HHS decides your rights were violated, HHS will fine the violator. You will see nothing. So if you want personal redress, you have to be able to demonstrate that you, personally, suffered injury. If you are a private figure, your anonymity has a value of zero. If you are a public figure, you likely don't do yelp reviews using your first name and last initial (Amy W.: "They tried to make me go to this rehab but I said, no, no no!"). If you are a private figure who becomes famous because of your yelp review you become a limited-purpose public figure and your anonymity has a value of less than zero. In order for caselaw to advance on this one, a private individual would have to demonstrate that they experienced material harm from a pseudonymous HIPAA disclosure. I'm pretty imaginative, but off the top of my head I'm drawing a blank.
HHS doesn't have to sue. They are judge, jury and executioner. HHS determines your violations outside a court of law. HHS assigns penalties outside a court of law. It's like the FAA or the DOT or the SEC or any other USA TLA: if they decide you owe money, you owe money. It's not a judgement, it's a fine. What you, as a non-governmental entity, can do, is argue the fairness or validity of the law under which you were fined... but the law itself is entirely under their purvey. http://www.washingtonpost.com/wp-dyn/content/article/2011/02/22/AR2011022207094.html That's what this looks like - not a litigious reshaping of the law but a top-down bureaucracy determining how badly you're fucked. Again, in the land of civil fun the law can be shaped... but now we're back in that corner case I lack the imagination to create.