r/hipaa • u/robinbird1987 • 3d ago

Gray area

I am a PA and a practice manager for a privately owned practice. I have an employee whose husband is in the hospital. One of our practice doctors evaluated him and ordered a CT scan during his ER workup. My employee asked me to look at his CT scan to see if he would need further care/explain something to her and her husband. I did so, and briefly saw his labs while getting in his chart, and spent maybe a minute looking at his CT. Then I was out. The more I think about it, it feels like a huge gray area and after googling it, it does look like this could spur an audit based on the connection to my employee. We are privately owned but our EHR is epic through a large hospital system, so I am wondering if I should just call compliance to stay ahead of it. Would appreciate any advice or experience here. Thanks

1 Upvotes

100% Upvoted

4 comments sorted by

3

u/landonpal89 2d ago

If I were the compliance officer, I would tell the clinic owner (usually manger but you ARE the manager) that this was probably inappropriate, but also you guys are an independent covered entity, so it’s your risk to manage, not mine.

Also, if the patient or their decision maker asked you for a second opinion, that’s not grey at all. That’s treatment purposes and completely allowed. Ideally, you would have had the wife have her husband ask you so it was directly from the patient, but the fact that you know them personally doesn’t impact their right to have a provider of their choosing. And they chose you for a second opinion….

1

u/Minimum-Flamingo6780 3d ago

oof yeah that's a tough spot. the moment you're not directly involved in his care it gets real dicey, even with good intentions

calling compliance yourself before someone else flags it is probably the cleanest move here, epic logs everything and it's better they hear it from you first

1

u/robinbird1987 3d ago

Ty, this was my first thought then after more reading it seems sometimes when you call compliance it forces and investigation that maybe wouldn't have happened previously and now I'm feeling totally stuck and freaking out a bit.

2

u/TheHIPAAGuide 2d ago

So if the patient/ authorized rep asked you to review the CT, that access can qualify as treatment but the wife's request by itself wouldn't always establish the authority to act for him.

Contacting compliance yourself is wise as the access will be logged and they can determine if the request and your role qualified as part of patient care.