Here is the link to the case: https://www.healthcareitnews.com/news/memorial-hermann-ordered-pay-24-million-over-immigrant-incident
Eight important facts are:
- Memorial Hermann Health System has gotten slapped with a $2.4 million fine after being found liable for breaking HIPAA rules by releasing the name of a patient who was arrested, even though the identity became public through police records.
- In September 2015, a patient at one of Memorial Hermann’s clinics presented an allegedly fraudulent identification card to office staff, according to HHS. Staff immediately alerted authorities, and the patient was arrested.
- Between Sept. 15 and 19, 2015, Memorial Hermann disclosed the patient’s name through press releases issued to 15 media outlets and reporters
- The patient was 44-year old Blanca Borrego, an immigrant from Mexico who was arrested at a gynecologist’s office after presenting a fake ID
- Borrego’s fate since the 2015 incident is not known
- The resolution agreement, signed on April 20 by Memorial Hermann President and CEO Benjamin Chu, MD, agrees to pay the U.S. Department of Health and Human Services $2.4 million and to adopt a comprehensive corrective action plan.
- This case reminds us that organizations can readily cooperate with law enforcement without violating HIPAA, but that they must nevertheless continue to protect patient privacy when
- making statements to the public and elsewhere. The action plan requires MHHS to update its policies and procedures on safeguarding private information from impermissible uses and to train its workforce.
Five questions to ask about the case are:
- If a patient gives a fake ID and a healthcare provider leaks their information, does it still violate HIPAA laws?
- Do you think the fine was too much or is it justified?
- Do you think the hospital or the press was to blame?
- Do you believe the case was racially motivated?
- What do you think became of Borrego?