OCR issues fines for not obtaining written authorizations before sharing PHI
The Cadia Healthcare Facilities are rehabilitation, skilled nursing, and long-term care services providers located in Delaware and were fined $182K for “posting” a success story to their website without obtaining a written authorization from the patient.
The settlement resolves an investigation of Cadia Healthcare Facilities that OCR initiated after receiving a complaint in September 2021 alleging that Cadia Healthcare Facilities had impermissibly disclosed a patient’s name, photograph and information pertaining to the patient’s conditions, treatment, and recovery in the form of a “success story” posted to Cadia Healthcare Facilities’ website.
Additional disclosures
OCR’s investigation also determined that Cadia Healthcare Facilities disclosed the PHI of a total of 150 patients to its websites through its “success story” program without first obtaining valid, written HIPAA authorizations. OCR determined that Cadia Healthcare Facilities impermissibly disclosed PHI, failed to have appropriate administrative, physical, and technical safeguards in place to protect the privacy of PHI, and failed to provide breach notification to the affected individuals.
Under the resolution agreement
Under the terms of the resolution agreement, Cadia Healthcare Facilities agreed to implement a corrective action plan that will be monitored by OCR for two years and pay $182,000 to the OCR. Cadia Healthcare Facilities will also take steps to improve its compliance with the HIPAA Privacy and Breach Notification Rules.
This includes:
- Developing, reviewing, maintaining, and/or revising, its written policies and procedures to comply with the HIPAA Privacy and Breach Notification Rules.
- Providing training on their HIPAA policies and procedures to all members of their workforce, including marketing personnel.
- Cadia Healthcare facilities must notify any individuals (or their personal representatives) whose PHI was disclosed without valid authorization on websites, social media platforms, or in any other marketing materials.
Summary
“The internet and social media are important business development tools. But before disclosing PHI through social media or public-facing websites, covered entities and business associates should ensure that the HIPAA Privacy Rule permits the disclosure,” said OCR Director Paula M. Stannard. “Generally, a valid, written HIPAA authorization from an individual is necessary before a covered entity or business associate can post that individual’s PHI in a website testimonial or through a social media campaign.”
This case is a clear warning to ensure all employees, including marketing individuals, are included in HIPAA training and policies and procedures are implemented and followed.
At Aris Medical Solutions, our HIPAA Keeper™ platform helps healthcare organizations get compliant and maintain compliance with the HIPAA Privacy and Security Rules—all within one secure, cloud-based system.
Contact Aris to schedule a free HIPAA checkup today.
