[janedoe42]

I work in a hospital. At work the other day a employee from another department walked up to a co-worker from my department and disclosed phi about a medical problem that I am having. He said I heard through the grapevine that Jane has cancer... My co-worker responded she is working today, maybe you should go ask her about that grapevine... I am totally sick about this and have reported it to the hippa officer at work, but what else can be done about this? Can I obtain a lawyer for violation of privacy and mental suffering?

[smoothy]

If you had discussed that with ANYONE else at work, or with anyone else outside of work that might by chance know someone you work with... good luck. People gossip... always have, always will. It will be easy to prove who accessed your medical records and when. If there was no such access... then good luck, you would need it. The HIPPA officer will investigate this. They will know who accessed anything and when.

As far as mental suffering? That will be a long-shot at best and to even have a chance would require fighting and winning the other two points first. Sorry, but someone else knowing it is not causing nearly the suffering you yourself have by actually having it. And I do wish you well and hope you beat it.

[ScottGem]

What makes you think this is a HIPAA violation? Are you being treated for your condition at that hospital? Do you know where the "grapevine" got the info? What privacy laws do you think might have been violated?

If you are not being treated for your condition at the hospital, then there is likely NO HIPAA violation. HIPAA (not hippa) protects a patient from having their medical diagnosis and treatment revealed by their care providers without permission. So if you aren't being treated at the hospital, the hospital is not the source of the information and no violation existed. But if you are being treated there, then yes a violation could exist.

Anyone can sue for anything. The question is can you win. HIPAA violations mean action taken against the violator, using in terms of disciplinary action or termination. If the problem was caused by lack of controls on the part of the organization, then they could be fined. To sue successfully you have to prove negligence. You have to prove that somehow your information became known due to negligence on the part of your care provider. That means you have to show the source of the info. If you shared the info with anyone outside your care providers it may be impossible to trace the info. As for "mental suffering", to sue successfully, you have to show how you damaged. Just being upset will not cut it.

You said you reported it to the HIPAA officer. What did they say? What are they going to do?

Are you really concerned about the info getting out or are you looking to financially gain? Because if you do sue, a lot more people are going to know.

One last point. The employee from another department who talked about this should be disciplined. Doesn't matter where she found out about it. Workplace gossip like this should not be allowed. That employee was indiscreet for telling anyone else about it.

[J_9]

I have to completely agree with Scott. Unless you are being treated at your hospital and your doctor or treating nurse slipped up, HIPAA was not violated, merely workplace gossip. Your co-worker should be commended for referring the nurse from the other department directly to you rather than continuing the rumors, no matter how true they are.

You can contact a lawyer, but you don't have any monetary damages. It's also likely these fellow nurses mean no harm and can actually become a support system for you.

I urge you to tread lightly on this issue. Don't push it and be a pot stirrer. Nurses tend to eat their young when they feel threatened. This could seriously backfire on you rather than work in your favor. I've seen it happen several times.