Private Practice Revises Policies and Procedures Addressing Activities Preparatory to Research
Private Practice Revises Policies and Procedures Addressing Activities Preparatory to Research
Covered Entity: Private Practice
Issue: Impermissible Disclosure-Research
A private practice physician who was the principal investigator of a
clinical research study disclosed a list of patients and diagnostic
codes to a contract research organization to telephone patients for
recruitment purposes. The disclosure was not consistent with documents
approved by the Institutional Review Board (IRB). The private practice
maintained that the disclosure to the contract research organization was
permissible as a review preparatory to research. Activities considered
“preparatory to research” include: preparing a research protocol;
developing a research hypothesis; and identifying prospective research
participants. Contacting individuals to participate in a research study
is a use or disclosure of protected health information (PHI) for
recruitment, as it is part of the research and is not an activity
preparatory to research. To remedy this situation, the private practice
revised its policies and procedures regarding the disclosure of PHI and
trained all physicians and staff members on the new policies and
procedures. Under the revised policies and procedures, the practice may
use and disclose PHI for research purposes, including recruitment, only
if a valid authorization is obtained from each individual or if the
covered entity obtains documentation that an alteration to or a waiver
of the authorization requirement has been approved by an IRB or a
Privacy Board.
| Large Provider Revises Patient Contact Process to Reflect Requests for Confidential Communications Covered Entity: General Hospital Issue: Impermissible Disclosure; Confidential Communications A patient alleged that a general hospital disclosed protected health information when a hospital staff person left a message on the patient’s home phone answering machine, thereby failing to accommodate the patient’s request that communications of PHI be made only through her mobile or work phones. In response, the hospital instituted a number of actions to achieve compliance with the Privacy Rule. To resolve this matter to the satisfaction of OCR, the hospital: retrained an entire Department with ...read more |
| Pharmacy Chain Revises Process for Disclosures to Law Enforcement Covered Entity: Pharmacies Issue: Impermissible Uses and Disclosures A chain pharmacy disclosed protected health information to municipal law enforcement officials in a manner that did not conform to the provisions of the Privacy Rule. Among other corrective actions to resolve the specific issues in the case, OCR required this chain to revise its national policy regarding law enforcement's access to patient protected health information to comply with the Privacy Rule requirements, including that disclosures of protected health information to law enforcement only be made in response to written requests from ...read more |
| Clinic Sanctions Supervisor for Accessing Employee Medical Record Covered Entity: Outpatient Facility Issue: Impermissible Use and Disclosure A hospital employee's supervisor accessed, examined, and disclosed an employee's medical record. OCR's investigation confirmed that the use and disclosure of protected health information by the supervisor was not authorized by the employee and was not otherwise permitted by the Privacy Rule. An employee's medical record is protected by the Privacy Rule, even though employment records held by a covered entity in its role as employer are not. Among other corrective actions to resolve the specific issues in the case, a letter ...read more |
| Private Practice Revises Process to Provide Access to Records Regardless of Payment Source Covered Entity: Private Practices Issue: Access At the direction of an insurance company that had requested an independent medical exam of an individual, a private medical practice denied the individual a copy of the medical records. OCR determined that the private practice denied the individual access to records to which she was entitled by the Privacy Rule. Among other corrective actions to resolve the specific issues in the case, OCR required that the private practice revise its policies and procedures regarding access requests to reflect the ...read more |
|
November 2025
| Su | Mo | Tu | We | Th | Fr | Sa |
| | | | | | 1 |
| 2 | 3 | 4 | 5 | 6 | 7 | 8 |
| 9 | 10 | 11 | 12 | 13 | 14 | 15 |
| 16 | 17 | 18 | 19 | 20 | 21 | 22 |
| 23 | 24 | 25 | 26 | 27 | 28 | 29 |
| 30 |
Blog Home
Newest Blog Entries
1/21/25 Understanding Business Associate Agreements
11/12/22 Modernizing Medicine Agrees to Pay $45 Million to Resolve Allegations of Accepting and Paying Illegal Kickbacks and Causing False Claims
11/12/22 Indian National Charged in $8 Million COVID-19 Relief Fraud Scheme
11/12/22 Former Hospital Employee Pleads Guilty To Criminal HIPPA Charges
11/12/22 Covered entities and those persons rendered accountable by general principles of corporate criminal liability may be prosecuted directly under 42 U.S.C. § 1320d-6
11/12/22 The Delaware Division of Developmental Disabilities Services Data Breach
11/12/22 OCR Settles Three Cases with Dental Practices for Patient Right of Access under HIPAA
11/12/22 HHS Issues Guidance on HIPAA and Audio-Only Telehealth
11/12/22 Five Former Methodist Hospital Employees Charged with HIPAA Violations
11/12/22 May a covered entity use or disclose protected health information for litigation?
11/12/22 When does the Privacy Rule allow covered entities to disclose protected health information to law enforcement officials?
Blog Archives
November 2022 (54)
January 2025 (1)
Blog Labels
BAA (4)
Telehealth (1)
Data Breach (1)
HIPAA (2)
HIPAA Enforcement (3)
Covered Entity (40)
ePHI (2)
PPP Fraud (1)
EHR Fraud (1)
|
