Staff at Community Hospital, a 200-bed facility, has been busy with HIPAA Privacy Rule issues recently. Community Hospital is regularly surveyed by the city safety department for compliance with local codes related to issues such as fire and water safety. Community Hospital's privacy officer has issued an unsigned business associate agreement to the department of health, instructing the chief of its survey office to sign it because its surveyors, who may come into contact with Community Hospital's PHI, function as business associates.

Recently, the hospital's emergency room staff has informed the privacy officer that patients' family members have been bringing cameras into the emergency room to photograph treatment as it is occurring. The privacy officer instructs emergency room staff to log the names of individuals who are taking the pictures. He then sends letters to the family members, notifying them that they have committed a HIPAA violation and their names may be turned over to the Office for Civil Rights for investigation.

Elderly patients are frequently discharged from the hospital to local nursing homes for skilled rehabilitation following orthopedic issues such as hip fractures and many types of surgeries. Staff on the units from which patients have been discharged have routinely copied the entire patient chart to accompany the patient to the nursing home, but the privacy officer informed them that this is a violation of the HIPAA Privacy Rule.

1. Recommend the next steps the Privacy Officer should take to mitigate each of the scenarios.