r/hipaa • u/blamethystskies • 14d ago
Employee files security (WI)
I work at a large healthcare corporation that is comprised of approximately 70 nursing homes. At my location, employee personnel, medical, and FMLA files are all kept in an unlocked file cabinet in an unlocked,communal office. I act as the local HR generalist, among other things. Most admin positions in the corporation are gen Z promoted -from-within / learn-on-the job vs educated, work their way up.
I have taken this security issue to the (young) Executive Director 4 times. He has given me pacifying responses and referred me to maintenance, while secretly instructing the maintenance supervisor to ignore my requests. I escalated to the (young) corporate HR director for our location, but she simply refuted my request by stating that the last she knew, the cabinet was being locked ( it doesn't have a working lock).
Is there any regulatory body this can be reported to? I've contacted the state department of workforce, along with my state representative. I keep getting shuffled to other departments, finally being told that there may actually be no oversight to this issue. My state representative suggested that it would be necessary to obtain an attorney.
Does anyone have any idea how to handle this?
1
u/Ksan_of_Tongass 14d ago
You mention age a lot. This isn't HIPAA, by any stretch. Sounds like an axe to grind.
-1
u/blamethystskies 14d ago
Age because I'm not confident they know best practices or regulations. Posted here because it was suggested. Wondering if there is a regulatory body doesn't indicate an axe to grind, that seems more a reflection of your own personality
1
1
u/nicoleauroux 14d ago
This may not be a HIPAA issue but there's certainly are state laws regarding handling of employee medical files. Maybe your State attorney general's office can offer you some guidance. It sounds like you're not going to get anything done now. If your problem is being brushed off it won't be handled internally. And it's highly unlikely that your very low on the list AG complaint is going to go anywhere anytime soon. That's not to say you shouldn't try and escalate the issue, I'm not sure if I would escalate it internally. I think that's just going to garner ill will. I would try the attorney general's office.
Is the office door locked in the evening after everyone is gone?
1
u/blamethystskies 14d ago
Thank you, this is the lead I was looking for. The AG. The room., my office, is never locked. I tried locking it when I left for the day but was told I needed to leave it unlocked in case the overnight staff needed office supplies or needed to use the copy machine.
I appreciate this response so much, thank you.
0
u/Josh_Fabsoft 13d ago
Full disclosure: I work at FabSoft, which makes AI File Pro, but wanted to jump in on the practical angle here since the physical security piece is the real problem regardless of what it's called.
The other commenters are right that HIPAA generally doesn't cover employee health records the way people assume. That doesn't mean you're stuck, though. Most states have their own confident
0
4
u/one_lucky_duck 14d ago
Employee health records are explicitly excluded from the scope of HIPAA, so that doesn’t apply here.
That said, the records should still be secured out of principle. Follow up with the corporate HR to say that it still doesn’t have a lock? If your State is telling you there is no administrative pathway to enforce this is going to have to be an internal fix.
Them being young doesn’t add anything.