Thursday Troubleshooter: Email and HIPAA, when is the line crossed?
QUESTION: My wife received notice last Friday that our son's teacher called my wife's work, a dental office, and complained that my wife had gotten her PERSONAL email from work records and emailed her concerning our son’s grades. Yes, the teacher’s kids go to my wife's dental office for treatment.
My wife professes her innocence. She believes she got the teacher’s email from first-day orientation when the teacher had it on the classroom chalkboard. Does this teacher have legitimate claim on a HIPAA violation?
My wife emailed to the teacher’s email about a month ago with a question, and the teacher responded with same email account. At this time, the teacher didn't bring up any issues with using her personal email. My wife didn't think twice because she didn't know she was doing anything wrong and she thought this was the email to contact her. It wasn't until one month later, when my wife emailed her again concerning our son, that the teacher told my wife she "didn't understand how she got her personal email." The teacher immediately called my wife's dental office to complain.
Does the teacher have a claim?
ANSWER FROM MARY GOVONI, Mary Govoni and Associates:
This is a tricky one. If the wife did obtain the teacher’s personal email from the dental office records, that is a HIPAA violation, since the use of this information is not for the treatment, payment, and operation of the dental practice.
The responsibility will be on your wife to prove that she obtained the email address from a source other than the teacher’s record in the dental office. If she can’t, the teacher/patient has a legitimate complaint about access to her information.
Also, the dental practice needs to make sure that this patient’s complaint is documented. There should be documentation in the employee’s file about a possible “incident.” The practice should also have documentation from each employee that they agree to follow the appropriate privacy protocols, and also protect the security of the electronic data on the patients.
ANSWER FROM LINDA CANNON, regulatory compliance specialist, directorate of safety, MSDS:
First let me address anyone who has a complaint. If someone has a complaint, any complaint, it must be placed through HHS and they will be notified by a phone call to the dental office. They will send the complaint to the dental office, and they will see who complained. They will want to see your policy on this subject. If there is no policy, then they will ask that you get one immediately. So get your policy together now. For the doctor’s liability, does he/she have a confidentiality agreement that is signed by all staff? Does the office have a roster for the Omnibus Rule Training?
The questions in part states, my wife believes she got the teacher’s email from orientation when the teacher had it on the classroom chalkboard. Ask the dentist to pull the audit trail for the day of the email to the teacher. This should show that your wife did not pull it from the office's records.
A citation will not be issued, as demonstrated by case studies in the past, but I cannot guarantee this. The office needs to be businesslike and use facts, not emotions, and it must get its ducks in a row. If they need help, they should call a HIPAA expert and get started.
ANSWER FROM OLIVIA WANN, owner of Modern Practice Solutions:
If the email address was provided at orientation for the parents’ use to contact teachers, then it is not a HIPAA violation. However, using information in the dental practice’s system for a non-health care reason is inappropriate.
PAST THURSDAY TROUBLESHOOTERS:
Team is frustrated dentist contacts them after hours
Is 'one big happy family' on the dental team a good thing?
Dental patient won't complete medical forms
Do YOU have a tough issue in your dental office that you would like addressed?
Send your questions for the experts to answer. Responses will come from various consultants associated with Speaking Consulting Network and Dental Consultant Connection. Their members will take turns fielding your questions on DentistryIQ, because they are very familiar with addressing the tough issues. Hey, it's their job.
Send your questions to [email protected]. All inquiries will be answered anonymously every Thursday here on DIQ.
