health

St. Joseph's Medical Center had unlawfully permitted a reporter to observe the treatment administered to three COVID patients, allowing him to access to both the patients and their clinical data.

In April 2020, the United States Department of Health and Human Services, Office for Civil Rights ("OCR") – which is entrusted with the task of enforcing the Federal standards that govern the privacy of individually identifiable health information – started an investigation over a potential breach of the Privacy, Security, and Breach Notification Rules (the "HIPAA Rules") by St. Joseph's Medical Center (SJMC). The latter had unlawfully permitted a reporter from the Associated Press (AP) to observe the treatment administered to three COVID patients, allowing him to access to both the patients and their clinical data. According to the HHS, the disclosures were not made pursuant to a permissible purpose under or as required by the Privacy Rule and were made without first obtaining valid authorizations from the affected individuals.

On 20 November 2023, the HHS’ Office for Civil Rights announced that it had reached a settlement with St. Joseph's Medical Center over the above allegations. To resolve the claim, the medical center agreed to pay $80,000 and to comply with a Corrective Action Plan under which it undertook to:

  1. “review and, to the extent necessary, develop, maintain, and revise its written privacy policies and procedures ("Policies and Procedures") to comply with the Federal standards that govern the privacy of individually identifiable health information”;
  2. submit “such Policies and Procedures, consistent with section V.A. above, to HHS for review and approval”;
  3. “implement and distribute the Policies and Procedures to all appropriate workforce members”;
  4. promptly investigate in case it learns that a workforce member failed to comply with its Policies and Procedures; and
  5. train all its workforce on policies and procedures to comply with the Privacy and Security Rules.

Under the agreement, OCR will oversee St. Joseph’s Medical Center for a period of two years to verify adherence to the outlined plan and compliance with relevant laws.

News available at hhs.gov en