I work as a physician with a federal health care facility. The administration sends out an E-mail with patient names and last 4 of their SS# to all providers in the department. This is a list of patients regarding unfinished notes. It is sent to providers that are not involved in the care of the patient. My contention is that providers not involved in the care of the patient should not be given mames and SS#. Is this a privacy violation?

I am amazed that a Physician doesn't realize it's HIPAA, not HIPPA.

Assuming that your question is legitimate, I don't see any violation. The information is NOT going to parties outside the hospital nor is it being provided unnecessarily. Understanding Health Information Privacy (http://www.hhs.gov/ocr/privacy/hipaa/understanding/index.html)

I also don't see that SS numbers are being provided. I see that the last 4 numbers are being provided, of course, but not the entire number.

Of course, you can always report the violation and see what HIPAA says.

If the entire social insurance number of each individual were sent out along with their names, I can see that being a serious violation of privacy and confidentiality and a HIPAA violation; but you say they only provided the last four numbers of the SS?

I may be wrong, but I am in healtchare as well, with confidentiality being tantamount to what I do and this is only my opinion. I see this as, not a HIPAA violation but there should be serious admonishment to whoever in administration sent the e mail.

Tick

I agree this is a borderline situation. If this was a follow-up to get the notes completed, it looks like laziness on the part of whomever sent the e-mail out. Instead of sending individual e-mails they just sent the list to all providers. Whoever sent that e-mail out should be admonished and sent for training.

But I'm not sure it reaches the level of HIPAA violation if no diagnosis or treatment info was included.