Is it a hippa violation if an employee knows a baby's dad and contacts the girlfriend to have him call our office about his daughter's dental appointment. We do not have any of his phone numbers on file. THe employee knew he was dad and she was girlfried.

It's HIPAA, btw. How has the dental office contacted him in the past? If so, how? What about contacting the mom?

Mom wasn't able to be contacted, multiple phone calls were made and messages left. The employee knew the child's father's girlfriend.

Yes, that would be a HIPAA violation. Contact is only to be made with the responsible party in the child's records.

Ok, thank you. I'm very new with HIPPA. What can happen to the company and employee?

The person wrongly contacted would have to file a formal complaint with HIPAA.
A decision would be made in about 2 years, last time I heard.
They give higher priority to large cases involving entire companies, hospitals, schools, etc.
The offender (the dental practice) could be reprimanded, fined, or have their license to practice taken away, either for a time or permanently.
The employee just has to deal with the employer.
There are no monetary awards. If someone wants one, they have to sue in civil court, separately.

(BTW, unless this is debt collection rather than an appointment, why in the world is the attempt at contact so desperate?)

Here is the whole overview of the law, as well as the procedure to file a complaint. If there is a breach it has to be reviewed and a determination rendered by the proper authority

HIPAA Definition of Breach (http://www.hipaasurvivalguide.com/hipaa-regulations/164-402.php)

I don't think calling about an appointment is a breach, but nonetheless a complaint would have to be filed by an injured party, or authority to really know for sure.

It is a breach, from the sounds of this. Father of child lives with another woman than the mother of the child. She may not even know he's a father.
Decades before HIPAA and the internet, I worked for a famous insurance company who did background checks on certain applicants, and some investigator would inevitably knock on a door, talk to a new wife, and let drop info about a previous wife... yes, they got sued.

Like the article says there are different levels of breaches so they have to go through the process. For all I know this is a small town where everybody knows everybody's business. Doesn't make it right, but much depends on what information was shared.

Wonder if OP is the baby mama?

I think she's the office person.

To contact anyone other than the parent listed in the contacts of record, is, in fact, a HIPAA violation. Pediatrics is a little more strict in that there may be custody issues involved.

My daughter manages a pediatric dental office, so I ran this question by her. She said they are required to contact only the parent or guardian of record. Contacting anyone other is a violation.