My former employer, who is also the owner of the facility( a substance abuse hospital) called one evening asking about treatment for a patient that was admitted earlier that day. This particular patient happened to be a family a family member of his. After checking the patient's chart, it was discovered that he was not listed on the confidentiality agreement giving us permission to discuss treatment. After I explained this to him, his reply was "You DO know who I am, don't you?". I feel like this was a direct violation of HIPAA policy. Anyone else have any thoughts on this and how/where would I report this?

Your former employer is the owner of the facility where this request was made? Have I got that right?

I don't see a violation - he didn't get the info. I also don't know who you would report his conduct to if he owns the place.

Did he attempt to "pull rank?" Certainly. Is it a violation? I don't think so.

EDIT: Here is comprehensive information - http://www.ama-assn.org/ama/pub/phys...questions.page. I can't find this scenario listed here.

Is the person who asked for the info a Physician?

So the owner asked for info on a patient who was also a relative. The owner was not listed as someone who you could discuss treatment with?

My response to the owner would have been, Yes I know who you are. I also know that since you are who you are, that you should know that all patient records are subject to HIPAA regulations and since you are not listed as someone who we can discuss this patient's records with, then I am unable to do so under the law.

You can report it to HIPAA if you wish. I'm not sure if just asking is a violation. But it would be a violation for him to access records he wasn't entitled to see, so just asking could be considered a violation.