A recent case highlights how one medical provider appropriately managed its HIPAA compliance by consistently enforcing its policies and keeping tabs on who accessed protected health information. While the case involves a provider, employers with health plans subject to HIPAA can also learn some valuable lessons from this case.

Background

Lankenau Medical Center (Lankenau) is an acute care hospital that is part of Main Line Health (MLH), a not-for-profit health system. Gloria Terrell (Terrell) worked as an operating room (OR) secretary for Lankenau for more than 35 years. As an OR secretary, Terrell was responsible for the OR schedule, calling for patients, sending for blood and medications, patient billing and charts, office supplies, ordering uniforms and other related duties.

In her capacity as OR secretary, Terrell had access to the hospital system used to store various forms of protected health information such as patient names, dates of birth, social security numbers, phone numbers, and insurance information. However, she did not have access to patient medical charts. As in many health care organizations, employees were often also patients of Lankenau.