You are the director of health information management at an acute care hospital. The hospital's radiology manager has come to you because an employee mistakenly included protected health information about a patient other than the patient who was authorized to receive the information. In other words, the radiology reports and images of two different patients were included on the same CD-ROM that was created. One set of reports and images is of the patient who signed to receive her records. The other set of reports and images is of adifferentpatient.

CASE STUDY: Nancy Keeley is a patient who was provided with a CD-ROM that contained her own radiographic images, which she needed to take for an appointment with her out-of-town specialist. Unfortunately, the CD-ROM also contained the radiographic images of Missy Smith, a different patient. Instead of destroying the CD-ROM, the specialist's office gave it back to the patient, Nancy Keeley. Their reasoning is because Nancy Keeley stated that would return the CD-ROM to her local hospital.

Upon returning home, the Nancy Keeley's husband contacted the local hospital to tell the Radiology Director about the incident. A meeting was scheduled with Nancy Keeley and her husband with the hospital's risk manager. Nancy Keeley was asked to bring the CD-ROM to the meeting; however, she did not have the CD-ROM with her for the meeting, and she stated that she wants financial compensation for returning it. The meeting ended without resolution.

Nancy Keeley called the hospital a few days later to ask what could be worked out so that she was compensated for returning the CD-ROM to the hospital. The hospital attorney advised her there was no privacy or security statutory process in place that would provide financial compensation under these circumstances.

Nancy Keeley threatened to view the radiographic images located on the CD-ROM and contact that patient, Missy Smith, so that she could file a lawsuit against the hospital for breach of privacy. Nancy also told the hospital attorney that she would not share with him or anyone at the hospital the name of that patient.

Nancy Keeley said she was not holding the CD-ROM for "ransom", and she and her husband needed to figure out how much money they "were out" for this situation. The patient stated that she and her husband's salary should be compensated because of a delay in treatment, and there should also be compensation for the error of including another patient's radiographic images on her CD-ROM.

The hospital attorney asked that Nancy Keeley return the CD-ROM, at which time Nancy's husband took the phone and stated that they would be waiting to hear from the hospital CEO, and then he hung up.Nancy Keeley and her husband would not specify the amount of compensation they expect, and they stated that they would not return the CD-ROM until an amount suitable to them is determined.

The hospital reported this incident as a HIPAA breach. Because Nancy Keeley refused to tell the hospital the name of the patient whose radiographic images were on the CD-ROM, the hospital did not know whose images they belong to. The patient and her husband mentioned the type of radiographic images included on the CD-ROM, and the hospital's Radiology Director was able to determine who patient's name.

You are the director of health information management at an acute care hospital. The hospital's radiology manager has come to you because an employee mistakenly included protected health information about a patient other than the patient who was authorized to receive the information. In other words, the radiology reports and images of two different patients were included on the same CD-ROM that was created. One set of reports and images is of the patient who signed to receive her records. The other set of reports and images is of adifferentpatient.

CASE STUDY: Nancy Keeley is a patient who was provided with a CD-ROM that contained her own radiographic images, which she needed to take for an appointment with her out-of-town specialist. Unfortunately, the CD-ROM also contained the radiographic images of Missy Smith, a different patient. Instead of destroying the CD-ROM, the specialist's office gave it back to the patient, Nancy Keeley. Their reasoning is because Nancy Keeley stated that would return the CD-ROM to her local hospital.

Upon returning home, the Nancy Keeley's husband contacted the local hospital to tell the Radiology Director about the incident. A meeting was scheduled with Nancy Keeley and her husband with the hospital's risk manager. Nancy Keeley was asked to bring the CD-ROM to the meeting; however, she did not have the CD-ROM with her for the meeting, and she stated that she wants financial compensation for returning it. The meeting ended without resolution.

Nancy Keeley called the hospital a few days later to ask what could be worked out so that she was compensated for returning the CD-ROM to the hospital. The hospital attorney advised her there was no privacy or security statutory process in place that would provide financial compensation under these circumstances.

Nancy Keeley threatened to view the radiographic images located on the CD-ROM and contact that patient, Missy Smith, so that she could file a lawsuit against the hospital for breach of privacy. Nancy also told the hospital attorney that she would not share with him or anyone at the hospital the name of that patient.

Nancy Keeley said she was not holding the CD-ROM for "ransom", and she and her husband needed to figure out how much money they "were out" for this situation. The patient stated that she and her husband's salary should be compensated because of a delay in treatment, and there should also be compensation for the error of including another patient's radiographic images on her CD-ROM.

The hospital attorney asked that Nancy Keeley return the CD-ROM, at which time Nancy's husband took the phone and stated that they would be waiting to hear from the hospital CEO, and then he hung up.Nancy Keeley and her husband would not specify the amount of compensation they expect, and they stated that they would not return the CD-ROM until an amount suitable to them is determined.

The hospital reported this incident as a HIPAA breach. Because Nancy Keeley refused to tell the hospital the name of the patient whose radiographic images were on the CD-ROM, the hospital did not know whose images they belong to. The patient and her husband mentioned the type of radiographic images included on the CD-ROM, and the hospital's Radiology Director was able to determine who patient's name.

Should the hospital report the specialist's office for breach of privacy because they gave the CD-ROM back to the patient, Nancy Keeley? (They knew at the time that radiographic images of another patient were mistakenly included on the CD-ROM.)