I am the Supervisor of a POL. One of the employees of the X-Ray department asked me for a copy of her Mother's lab results. I refused, citing HIPAA regulations. The employee became very disruptive but I still refused to comply with her request. Because our facility has no clear protocol for dealing with this issue I told her supervisor about the incident. I was afraid she would find another employee she would intimidate into giving her the records.This employee came to me screaming the next day saying that I had violated her mothers HIPAA rights by telling her supervisor that she had requested her mothers lab records and she did not want her supervisor to know that her mother had lab test done. Did I violate her mothers rights? What should I have done instead.
Thank-you
T Moore

Hmmm, this is a close call. From a purely legal standpoint you did by revealing to a third party that her mother had x-rays done.

But from a practical standpoint I think you don't have a problem. One of the misconceptions about HIPAA is that it provides a way for victims to be compensated for violations. That is not the case. The way HIPAA works, is someone reports a violation and the agency responsible for HIPAA enforcement will investigate the complaint. If the complaint is found valid, then the employer of the caregiver cited will be fined. That employer can then turn around and fire the employee for the violation. But the victim doesn't receive any compensation.

So in your case, if the employee files a complaint, then it will come out that she asked you to violate HIPAA by giving you the results. Which will get her in trouble. And it will look like you were just trying to protect your employer. Now what you SHOULD have done is not indicate who's records the employee was asking for, just that it was a relative.

So I would go to your boss and explain the whole story and tell your boss that you were trying to protect the company but did make a SMALL error. You did not reveal anything about the diagnosis or treatment of the mother, only that she had an X-ray done. And you did so only to protect the company if someone else violated HIPAA by providing the records.