I work in a medical office that is part of a local hospital. A few years ago after being hospitalized on an urgent basis I was diagnosed with a chronic medical condition. I was off work for 1 week. During this week I happened to run into a co-worker. When I started to talk with her about my medical condition she informed me she knew all about it as she had pulled up my medical record on the office computer and read all of my hospital notes, doctor reports, test reports, etc. She also shared this information with all my co-workers. I discussed this with my supervisor at the time and am not sure what, if anything, occurred with my co-worker. My question is: Is there anything else I can do about this HIPAA violation? It has destroyed my ability to share all necessary information with my physicians as I do not feel my co-workers need to read everything about me (I have nothing to hide but just don't feel like my medical information is my co-workers' business). I also resent the fact that my right to decide if I wanted to share this information with my employer and co-workers was taken from me. The other issue is this co-worker was promoted after doing this to me (and eventually another employee) and is my current supervisor. I am not able to trust her and am having lots of difficulty finding any respect for her as a boss. Any suggestions would be appreciated.

Did she have a reason to pull up your records? Or was it done purely out of curiosity?

No matter what her capacity in the company, she should not have shared the info with anyone.

You need to go to HR And find out what action was taken againt this co-worker. For her to use her access to the office computer to look up ANYONE'S medical treatment records was a blatant HIPAA violation. To tell other people what she found out compounds the violation.

Its possible the time lapse has made it too late, but with such a blatant violation I would pursue it. Explain to the HR person that you can't understand why a person who put the medical office at such risk for fines and sanctions by such blatant violation has not only kept her job but been promoted.

Tell HR that you don't want to report this to HIPAA but may be forced to if the office doesn't care of it.

j9--
She had absolutely NO reason to be in my medical record other than pure nosiness... When a doc in our office was hospitalized she pulled up his test results and shared with the office which she had no reason to do.

Scottgem--Thanks for the response... My guess is that if I ask HR what action was taken they will tell me that info is confidential... haha, is there such a thing in healthcare? I will try it but fear retaliation.

So don't ask specifically what action was taken. Ask how such a person could be promoted after such a blatant violation. And yes, retaliation is a possibility that you have to be prepared for if you want to pursue this. But you need to take the angle that you are doing this to protect the company from an HIPAA audit.

You could be walking a slippery slope here, since she is your supervisor. You need to be very cautious in how you handle this.

While I agree that it is indeed a HIPAA violation, you need to CYA in who you talk to and how you deal with it, since she is your superior.

Can you document anything? Do you have peers who will back you up without stabbing you in the back?

My healthcare corporation has a number you can call and discuss situations like this anonymously. Does yours?

If you decide to do anything, be prepared to possibly lose your job, so you must document properly. Who told you she looked this info up? Did she? Can it be considered heresay? Heresay is not admissible.