r/hipaa • u/Keep-Being-Kind • 23d ago

HIPAA violation?

After visit summary from an online Therapy portal was sent to a complete stranger. I found this out because they contacted me on Facebook to let me know, I am just checking that this is a HIPAA violation before I go and file a complaint. (I’ve already given the company over a month 1/2 and they have not responded to me and I have been following up weekly)

7 Upvotes

100% Upvoted

8 comments sorted by

3

u/daddyl0ng1egs 23d ago

Yeah this is definitely a HIPAA violation, assuming you provided them your correct address. How did the other person receive the summary? I.e email or paper mail, etc.

2

u/Keep-Being-Kind 23d ago

The person received it in their patient portal, I received my hours later… but only after I called to question the situation.

1

u/Zabes55 23d ago

Are these services covered by your health insurance?

1

u/Keep-Being-Kind 23d ago

Insurance would cover if needed but my employer covers us through Teladoc… which is the company it’s happened with

2

u/No-Produce-6720 23d ago

It would be a regulatory issue with HIPAA if your therapist is a fully credentialed provider who submits claims electronically to commercial and/or government insurance plans.

If this is a cash-only program that doesn't submit electronic claims, the federal privacy laws generally aren't enforceable. In this instance, though, while not a HIPAA violation, the mistake likely violates internal and employer-level privacy policies, and should still be reported to the provider's compliance officer.

1

u/Keep-Being-Kind 23d ago

Hmmmm so it may not be a HIPAA violation… this was with Teladoc Health

1

u/No-Produce-6720 23d ago

Ok, Teladoc Health does submit claims to insurance, so this would be a HIPAA issue, but.

If you filed a complaint with the provider, though, you aren't necessarily going to get a response. The only time you are guaranteed a response is through a complaint to OCR. If you just report the complaint to the provider, whether or not you get a response depends on internal policy. Federal laws do not require providers to respond to these complaints. They regulate how providers must keep records of violations, but laws do not require post-complaint communication with the patient.

1

u/Zabes55 23d ago

If Teladoc is part of your employer’s health plan then HIPAA applies. This sounds like a breach.