The U.S. Department of Health and Human Services Office for Civil Rights has resolved a case with Saint Joseph’s Medical Center stemming from the alleged unauthorized disclosure of protected health information of early COVID-19 patients. The medical center, located in Yonkers, has agreed to pay $80,000 in fines and implement corrective measures.
The investigation was initiated after the Associated Press published an article on April 28, 2020. In this article, they detailed the hospital’s response to the COVID-19 public health emergency. The report included photographs and information about three patients. This exposed their COVID-19 diagnoses, medical statuses, prognoses, vital signs, and treatment plans.
The Office for Civil Rights (OCR) is responsible for enforcing the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule. They found that the data included in the news report violated national patient-privacy-protection laws. OCR Director Melanie Fontes Rainer emphasized the importance of patients feeling secure about their health information. In a statement reported by Healthcare IT News, Fontes Rainer stated, “When receiving medical care in hospitals and emergency rooms, patients should not have to worry that providers may disclose their health information to the media without their authorization.”
Under the resolution agreement, Saint Joseph’s Medical Center must pay a $80,000 fine to the OCR. Additionally, the medical center must develop written policies and procedures in compliance with the HIPAA Privacy Rule. Furthermore, it must train its workforce accordingly. The OCR will closely monitor the medical center for two years to ensure ongoing compliance.
The case serves as a reminder to healthcare providers nationwide about the significance of safeguarding patient information, particularly during public health emergencies. And this settlement underscores the trend of the OCR taking action against healthcare providers for breaches of protected health information. Fontes Rainer affirmed OCR’s commitment to prioritizing patient privacy, stating, “The Office for Civil Rights will continue to take enforcement actions that put patient privacy first.”