HIPAA Compliance Regulations and Private Health Information

Simple tweet costs an administrative assistant


An administrative assistant has lost her job because of a simple tweet as the tweet has sparked HIPAA compliance and public relations mess at Mississippi’s University Medical Center.


The root of this can be traced to a tweet posted by Mississippi governor Haley Barbour on his Twitter page.


This began when Barbour posted the tweet reading: “Glad the Legislature recognizes our grim fiscal situation. Look forward to hearing their ideas on how to cut down expenses.”


Giving her suggestions, Jennifer Carter, UMC administrative assistant tweeted, “Schedule regular medical exams like everyone else instead of paying UMC employees over time to do it when clinics are usually closed.” Carter had come to know that the governor had come into UMC for a physical one Saturday three years ago, and that the little clinic had to be staffed up with 15-20 workers just for his visit.


A couple of days later, Carter found herself in UMC’s compliance office for violating HIPAAs privacy provisions. The Governor’s office had tracked her down and asked the Compliance Department to deal with her.


As a result, she was suspended without pay for three days and encouraged to resign, which she did. She wasn’t really jabbing at the governor, but that’s what people do on Twitter. The matter was being investigated by UMC, but now it’s a closed chapter as Carter has resigned.


Handling PHI while working from remote locations :


It’s not an easy job at hand when it comes to giving permission to your employees to handle patient’s private health information (PHI) while working from offsite locations.


You need to convey your privacy expectations to your employees. Whether you prohibit them from working on their personal laptops when dealing with PHI or give them remote work when it’s done for emergency reasons, you certainly need to communicate your expectations.


For more insight on this, you can go through a sample document contributed by Glenn Allen, information security director with Fairview Health Services in Minneapolis, Minn.


When you work remotely, you are exposed to increased risk of privacy and security incidents and breaches. You should take great care in protecting the privacy and security of your paper and electronic medical record systems in order to safeguard the patient data. Even remote workers need to take the same care.