I Broke HIPAA

EVENT

I'm describing this as a political post because it ultimately is, even if I'm also describing my last week.

In the last several years I've worked in an oncology clinic in which four doctors visited with dozens of patients each daily, a box office in which the entire database of a sold-out season broke down a week before opening, and as a dishwasher with mafia style management and nightly fights in the parking lot. Nothing, none of these matches up to the Hell of working in the last week.

Take this blog as a sign; I managed to post and read the week my play went up as well as the week in which I got engaged. This week however, stuck me like a bad hangover. When I got home, all I could do was read pulp and sleep. Sorry.

I'll explain the situation. I told Advanced I was looking for a part time assignment in the Loop. They found me another full time assignment at the hospital; working reception for Orthopoedic Surgery. The specifics were the most grim of any of the departments I've worked for. OS has just expanded their practice from ten to thirteen doctors. Originally, there had been three receptionists among them, but within a week, two were gone. One, a veteran with eighteen years experience took all of her vacation time to "unwind a little." The other, less experienced, had a breakdown on the job, ran to the file room where she sobbed for two hours before she left and never came back.

At this point I was brought in to assist the only remaining receptionist.

But this is only the beginning:
- All of the new three doctors had to have all incoming patients reregistered; this meant asking them for insurance information and to fill out four forms, the last of which was an extensive medical history.
- Somehow the department's filing had an arcane system by which none of the charts were prepped until the night before or day of (all of the other departments I've worked in have done this at least a week in advance), inevitably leaving unsorted and unphabetized piles of sensitive patient information strewn across the desk.
- Receptionists disgruntled from being laid off when the doctors moved told patients to come in as walk-ins. So we had a constant stream of patients with no records and no appointments.

I was running from the moment I got in until the moment I was left.
I had no training. I had no knowledge of how to prep charts, or where to send information as I received it. I was not granted access to the encounter manager program necessary to arrive patients even though this was what I was supposedly doing all day long.
On the second day, the other receptionist was reduced to tears, and I snapped at a nurse who had been critical of my errors.
We both went home exhausted. We both had patients waiting three hours for appointments. We both skipped lunch and all breaks on several occasions.

Friday was supposed to be easier.

On Friday we had nineteen patients instead of one-hundred fifty. Everything should have gone smoothly. We took a deep breath and exclaimed how happy we were the weekend had arrived.

* * * * *

Take you back fifteen months.

My friend Armand is in med school. I had asked him how things were going, and he mentioned that all of the U of C hospital was freaking out because HIPAA guidelines must be followed by April 15.
"HIPAA?" I'd asked. I'd heard little about this at Northwestern, and certainly nothing from Advanced.
HIPAA stands for the "Heath Information Portability and Accountability Act." It is supposed to address questions of patient confidentiality, you might think such as protecting patient information against insurance companies. It is far reaching, however, to the extent that repeated accidental violations could lead to an individual being fined up to $10,000.
Any time a nurse steps into a reception area and calls a patient by name, he or she violates HIPAA.

On the Friday following April 15th, I went into Advanced to pick up my paycheck.
Britney, the receptionist asked me to sign a form before I picked up my paycheck. She was casual and relaxed about it. The form was stapled to a twenty or thirty page booklet. I asked if I could read it over. She seemed puzzled and surprised by this, but allowed me to take the booklet unsigned, along with my paycheck, though I needed to sign by the end of the day, she said.
In the elevator, I skimmed through the material. Sure enough the form was consent to abide by HIPAA. It mentioned the $10,000 fine and breezily outlined a million ambiguous actions which might denote a violation.

I returned immediately. I told Britney I had questions. I did not feel comfortable signing. The penalty was too harsh and the offences too unclear. I asked to speak to a manager. She put me on the phone with Loop upper management. I explained that I thought it was pretty sketchy asking temp employees who were unfamiliar with a hospital setting to sign off a complex consent form on the way to pick up their paycheck.
I was airily informed that employees were adults and took responsibility for anything they signed.
My point, of course, had not been that Advanced had violated any laws, but rather that they had conducted themselves in an ethically questionable way, enouraging employees to remain ignorant of important regulations and consequences. In the end, though, I signed. Why?

I HAD TO PAY THE RENT.

Fast forward a year, plus.

* * * * *

And so here I was.
Friday.
Relaxation.
Until two hours before we were set to leave.
A call came in.
A patient had complained about a number of things, including the visibility of social security numbers at the front desk.

And suddenly my day and weekend were ruined.
At least.
Because I am on record as the receptionist those days.
There is plenty of documentation that we were both violating HIPAA by having sensative information visible from the reception desk.

And here we go...

There was categorically no way to avoid the situation we encountered that Tuesday, Wednesday, and Thursday.
Most of our patients underwent a five to fifteen minute long registration and check-in process.
We assembled information that was not prepped or even organized.
We had days with 150+ patients spread between 2/3 the typical load of receptionists operating in an area of maybe 40 square feet tops.
The only alternative to a HIPAA violation would've been to cancel clinic and send everyone home.

And here I get political.

Here is my gripe.

In the late 90s and early 00s I heard an awful lot on the news about insurance companies getting unpleasantly cozy with medical providers. It would be interesting to see what impact these events had on the development of HIPAA and how HIPAA has affected these relationships, if at all.
What I do know is that, from the perspective of administrative security, there has been little or no improvement in any of the five hospital departments I've worked in since the implementation of HIPAA.

There aren't the resources.

I've worked in departments that have been universally understaffed and underfunded. Administrative support is the last priority. Doctors making 1.5 mil+ annually won't take a pay cut to allow a $22,000 annual full-time filing position.
I don't think HIPAA has anything to do with patient security.
I think it is an absolution of responsibilty.

Doctors and departments and legislators don't have the time or patience to deal with daily privacy dilemmas. Liability issues and malpractice suits cut heavily into profits. HIPAA takes responsiblity out of their hands and places it with an office staff ill equipped to meet the vague and encompassing need for "patient confidentiality." It's a quick fix that is aimed at symptoms, but it doesn't solve any of the problems the bill was created to address.

I could still walk into any hospital, roust up some poor patients SS number with little trouble, con him or her, and land the poor receptionist, file clerk, or service representive with a $10K fine.

And that's why I will be telling Advanced I do not want any more hospital assignments whatever after this coming Friday.

A potential $10,000 liability just isn't worth $11.06/hour without benefits.

It just isn't.

Besides, I've disliked this job for years now, and have hated this assignment more that rotting cabbage or bird shit in my hair.

I needed something like this to make it worth leaving.

* * * * *

I will not be working in hospitals any more.

~ Connor