Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
I was notified by one of our patients that they received a "Summary of Today's Visit" in the mail, however, it wasn't their own "Summary of Today's Visit", it was that of another patient.
Knowing that this is a HIPAA violation, am I required to notify the patient whom's information was sent to the wrong person?
The requirements are imposed on "the covered entity". You personally may not be required to do anything, apart from whatever your employer requires of you, but §164.404(a) says:
A covered entity shall, following the discovery of a breach of unsecured protected health information, notify each individual whose unsecured protected health information has been, or is reasonably believed by the covered entity to have been, accessed, acquired, used, or disclosed as a result of such breach.
What you describe is a breach. That section provides other information about timing and content of notification.
