Excerpt from HealthitSecurity Article, Published on Nov 21, 2023 

In a recent development, the HHS Office for Civil Rights (OCR) concluded its investigation into St. Joseph’s Medical Center, a New York-based institution, regarding the unauthorized disclosure of protected health information (PHI) belonging to three COVID-19 patients. The investigation stemmed from allegations that the medical center had shared sensitive patient data with the Associated Press without proper consent.

The outcome of the probe resulted in St. Joseph’s Medical Center agreeing to a settlement of $80,000 with the OCR, coupled with the commitment to implement corrective measures to prevent such incidents in the future.

The investigation was instigated after the Associated Press published an article detailing the medical center’s response to the pandemic. This article featured explicit patient details, including diagnoses, medical statuses, prognoses, vital signs, and treatment plans of three individuals. The medical center had disclosed this information to the Associated Press without obtaining the necessary written consent from the patients, a violation of the HIPAA Privacy Rule.

As part of the settlement, St. Joseph’s Medical Center pledged to undergo a thorough review and revision of its privacy policies. Additionally, they committed to ensuring that all staff members undergo compliance certification before accessing any PHI. These corrective actions aim to fortify the institution’s protocols surrounding PHI disclosure and establish robust internal reporting mechanisms to avert any future unauthorized disclosures.

Commenting on the issue, Melanie Fontes Rainer, OCR’s director, emphasized the critical importance of safeguarding patient privacy in healthcare facilities. She reiterated the obligation of healthcare providers to prioritize patient confidentiality and pledged continued enforcement actions to uphold patient privacy rights.

This settlement serves as a reminder of the stringent regulations governing patient data protection and underscores the necessity for healthcare organizations to rigorously adhere to HIPAA guidelines to ensure patient confidentiality and privacy.

To delve deeper into this topic, please read the full article on HealthitSecurity