I was notified by one of our patients that they received a "Summary of Today's Visit" in the mail, however, it wasn't their own "Summary of Today's Visit", it was that of another patient.

Knowing that this is a HIPAA violation, am I required to notify the patient whom's information was sent to the wrong person?

  • This is a question to ask your firm's lawyers, not the Internet. – Nate Eldredge May 21 '20 at 19:59
  • 1
    @NateEldredge why not? Seems worthwhile to have that information publicly available – Franck Dernoncourt May 21 '20 at 20:18

The requirements are imposed on "the covered entity". You personally may not be required to do anything, apart from whatever your employer requires of you, but §164.404(a) says:

A covered entity shall, following the discovery of a breach of unsecured protected health information, notify each individual whose unsecured protected health information has been, or is reasonably believed by the covered entity to have been, accessed, acquired, used, or disclosed as a result of such breach.

What you describe is a breach. That section provides other information about timing and content of notification.

  • I venture to suggest that not informing your employer that you know they are in breach of the law would be a breach of your employment contract notwithstanding that your employer may not have explicitly required this. – Dale M May 21 '20 at 21:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.