An LA Times column just blew the lid off a California hospital’s seemingly blatant disregard for patient privacy. Michael Hiltzik reports that Prime Healthcare Services and executives from Shasta Regional Medical centre freely showed former patient Darlene Courtois’ medical chart to her hometown newspaper without her express permission.
Prime, which is already under investigation for possible Medicare fraud, claimed it was perfectly legal to share Courtois’ records since she had shared part of her medical history with another news outlet.
That news outlet was California Watch, which reported last month that Courtois’ doctors billed Medicare for services she never received, like treatment for malnutrition. (See how to catch costly mistakes on your medical bill.)
Once the story broke, Prime contended that Courtois as good as threw away her rights to patient privacy, leaving them free to divulge whatever they wanted to the press.
There’s just one problem: That’s pretty much illegal under the Health Insurance Portability and Accountability Act (HIPPA).
The hospital would have needed Courtois’ express written consent to turn over any of her medical history, and her daughter told the Times they never so much as asked.
In a previous post about outsourcing your medical paperwork to a private company, Your Money editor Jill Krasny underscored the important protections HIPPA offers when it comes to protecting your sensitive medical data.
The U.S. Dept. of Health and Human Services takes complaints on its site from consumers who are suspicious that their medical records may have been shared without their consent.
Even on its complaint page, the agency says a medical provider covered by HIPPA can’t retaliate against anyone who files a complaint.
Here are the requirements for complaints, per the agency:
Your complaint must:
- Be filed in writing, either on paper or electronically, by mail, fax, or e-mail;
- Name the covered entity involved and describe the acts or omissions you believe violated the requirements of the Privacy or Security Rule; and
- Be filed within 180 days of when you knew that the act or omission complained of occurred. OCR may extend the 180-day period if you can show “good cause.”