Oops! Is this a HIPAA Violation?

A recent Facebook discussion I found very interesting occurred in a chain pharmacy. Apparently, that day, the staff was filling quite a few antidepressant prescriptions and a pharmacy staff member joked something along the lines of 'it must be depression day.' In the waiting area one of the patients filling an antidepressant was extremely angry and offended. This patient complained to the corporate office and wanted to file a HIPAA violation complaint. There was a spirited discussion of whether this was indeed a HIPAA violation or unprofessional without being a HIPAA violation.

With no clear answer, I reached out to Angelo Cifaldi, RPh, JD, and Satish Poondi, RPh, JD* for their opinions. Both are pharmacist attorneys with many years of practice in the area of pharmacy law. They agreed that this scenario could be a Potential HIPAA violation.

When this happens, the patient may choose to file a case with the Office for Civil Rights (OCR). If the OCR were to enter into a case like this based on a complaint, the outcome could be as simple as reviewing HIPAA policies and procedures with the entire pharmacy staff, or could be more complex, involving interviews with staff and patients and some kind of resolution.

Because there is a possibility of lawsuits stemming from HIPAA violations, Mr Cifaldi and Mr Poondi noted that a pharmacy may have liability insurance that only covers physical damages and not emotional distress as would potentially occur with a HIPPA violation. In the 'depression day' case, it is difficult to evaluate damages. Perhaps it is a small town and people hear this private health information, and the patient feels as if his/her reputation is damaged.

The outcome may depend on many factors such as an investigation, practices of the pharmacy, where it occurred, how identifiable the patient was. (Was he the only patient there or were there ten people there?) The U.S. Department of Health and Human Services website shows how many HIPAA complaints there have been and how they were resolved.

Mr Cifaldi and Mr Poondi reported that they are generally seeing more lawsuits against providers based on privacy violations. For example, a patient tells the pharmacy that no one else may pick up their medication. Let's say this never gets recorded anywhere (it seems some pharmacies do not have a reliable system to enforce this), then someone else picks up the medication and discovers for example that his/her spouse has HIV, and then a lawsuit is filed against the pharmacy.

Building on that, Mr Cifaldi and Mr Poondi agreed that an important tip for pharmacists is to check their malpractice insurance policy. If you don't have malpractice insurance, do you need it?

Our expert lawyers absolutely agree that not only should we sign up for malpractice insurance, but we should get as much as we can afford. Even if the pharmacy has malpractice insurance, every pharmacy employee (anyone behind the counter—pharmacists, technicians, cashiers) should invest in an insurance policy. HPSO and Pharmacists Mutual are two reputable companies that offer this service at an affordable rate.

Since many malpractice insurances only cover physical injuries and not emotional distress without a physical injury, Mr Cifaldi and Mr Poondi recommended checking policies carefully to see what is covered. A HIPAA violation may not be covered if the particular policy only covers physical damages. The lawyers emphasize that a thorough review of the policy is necessary. Is it an aggregate policy or is it per occurrence? What is the limit? Does the insurance include paying the lawyers or is that separate?

Mr Cifaldi and Mr Poondi explained that pharmacy malpractice can be an expensive litigation. If a case drags on for five years, and the policy covers $500,000, but the lawyers cost $500,000 then there is nothing left to pay for the damages. Always know what your insurance covers and how it works.

In summary, HIPAA violations can be very serious and may result in extensive (and expensive) litigation to the entire pharmacy team. Remember that we are in a fishbowl and there are eyes and ears everywhere. If you do not yet have individual malpractice insurance, now is the time to sign up. Read the policy carefully and ask questions to make sure you are covered in every possible scenario. If you already have coverage, be sure to review your coverage so if you find yourself in a litigation, you will be covered as much as possible.

*information from Mr Cifaldi and Mr Poondi is general information and not legal advice. Consult your lawyer for legal advice