On a fall night in west Texas, a nurse named Ellen agreed to take the night shift for her friend Sandy, who wanted to watch her son, Ryan, the star running back, play football at the local high school. During the game, Ryan was tackled and taken to the hospital, and then Ellen’s cell phone started blowing up. When she heard the news, Ellen peeked in Ryan’s electronic medical records—without any clinical or business reason—and saw he had a concussion. She texted Sandy, asking if there was anything she could do for her son.
What follows is the story of a hospital’s response to a (fictional) HIPAA breach and how it helped reshape its culture and led to more collaboration between compliance and human resources (HR). “In organizations where collaborations don’t exist, it can go from bad to worse,” said Amanda Bates, former vice president of human resources at Indiana University Health, at an HCCA webinar March 27.
Ellen’s unauthorized access was discovered by Maggie, the compliance director, and she notified Rosie, the HR representative, as required by hospital policy. Rosie started a file on the breach but told Maggie that compliance would do the investigation. Maggie looped in Sue, the clinical manager, “who didn’t want to get Ellen in trouble because she’s a great nurse,” Bates said. “Sue told Maggie, ‘I don’t think this is a big deal and I don’t think you need to investigate. Sandy and Ellen are good friends and I’m sure she wouldn’t mind Ellen looking at the medical records.” Maggie called Rosie back and Rosie agreed, but Maggie was uneasy. Letting this slide could put the organization at risk and send a message it doesn’t take privacy seriously.
Her next move was to call the chief compliance officer, who said she had already been tipped off. The chief compliance officer, chief nursing officer and head of HR met to discuss next steps. The trio got input from Sandy, who confirmed her friendship with Ellen but felt she overstepped. Sandy wanted to keep her son’s medical records private because they include information about his mental health issues. “The three executives concluded [Ellen’s unauthorized access] was a big deal and suggested termination was in order,” Bates said. When Ellen heard this, she was confused and angry. “Sandy wouldn’t have her back, and as the story leaked, people in the community took sides.”
