Think HIPAA When Talking to Reporters: A Case Example

Allergy Associates of Hartford, P.C. has agreed to pay $125,000 to the Office for Civil Rights as a settlement for HIPAA violations. The physician practice has also agreed to implement a two-year corrective action plan to monitor its HIPAA compliance. The Resolution Agreement is available on the U.S. Department of Health & Human Services’ website.

The patient had complained to a TV reporter that the medical practice turned her away from its office when she arrived with her service animal. The reporter then sought comments from the practice’s doctor. Although the practice’s Privacy Officer had advised the doctor either to not respond or to say “no comment,” the doctor chose to speak to the reporter anyway and disclosed the patient’s protected health information without the patient’s consent in violation of HIPAA.

The case serves as a reminder to covered entities to tread carefully and consider HIPAA requirements when responding to the media.  The same HIPAA risks may also arise if covered entities attempt to respond to patient remarks posted on social media.