Financial / billing info of pt. Accessing the financial or billing information of a patient without a job duty reason to do so (no significant harm to patient /guarantor and/or no reporting required.). as “Snooping”. Accessing, amending, and/or using billing information of a patient without a job duty / working reason to do so and/or disclosing the information to a non covered entity (none or any potential significant harm to patient/guarantor). This would include SSN and credit card / financial information. Disclosure OR Use Release PHI to wrong person or pt - Lack of proper ID verification Unintentional - not properly verifying the patient and disclosing PHI to another where patient identity is disclosed. (low or no harm to patient or breach notification) Willful neglect in not properly verifying the patient and disclosing PHI to another party where patient identity is disclosed. (low or no harm to patient or breach notification) Social Media posts Posting information regarding patients (no names) publicly such as on social media sites which are inappropriate or the patient could be reasonably identified. Posting information regarding patients (no names) publicly such as on social media sites which are inappropriate or the patient could be reasonably identified with significant harm to patient. Pt. or employee pt. with significant harm Accessing record of a patient (including employee pt.) without having a job duty reason to do so and/or disclosing the information to another party not involved in the patient’s care (significant harm to patient and reporting required) Access/amend PHI for personal gain / malicious intent Accessing, disclosing and /or amending PHI or Hospital information for personal or professional gain or intent to sell or sale of the information.
Data, Info Accuracy & Integrity Registration – wrong pt. Registration Errors – Negligence resulting in wrong patient being admitted/registered and a privacy breach (low/no harm to pt.). Registration Errors – Negligence resulting in wrong patient being admitted/registered and a privacy breach (significant harm to pt.). Intentional Registration Error – Wrong patient being admitted / registered resulting in a privacy breach and/or other legal issue. Registration – wrong information Registration Errors – Wrong pt. information documented resulting in a privacy breach (low/no harm to pt.) (PCP, contact, ins., etc.) Registration Errors – Wrong pt. information documented resulting in a privacy breach (significant harm to pt.) (PCP, contact, ins., etc.) Intentional Registration Error – Wrong/false pt. information documented resulting in a privacy breach and/or other legal issue Misdirected fax Misdirected Fax with PHI resulting in PHI disclosure (no harm to patient and/or no reporting required) Misdirected Fax with PHI resulting in PHI disclosure (second offense and low or no harm to patient and/or no reporting required) Willful neglect in misdirected Fax with PHI (significant harm to patient and/or reporting required of breach notification) Misdirected mail Misdirected mailing with PHI to another patient, person or entity in error (low or no harm to pt.) Misdirected mailing with PHI to another patient, person or entity in error (significant harm to patient and breach notification). Willful or intentional mailing of PHI to a wrong patient, person, or entity, resulting in significant harm to the correct patient and breach notification. Altering PHI - falsification Altering PHI or medical record/falsification of records. Restriction Requests Failure to respect approved pt. request Failure to respect approved patient requested restrictions with low or no harm to the patient. Failure to respect approved patient requested restrictions with significant harm to patient and/or breach notification. NOTE: These guidelines support the System Privacy and Information Security Sanctions Policy.