To continue reading for free, register below or login
To read more you must become a member of SearchSecurity.com
It's not a matter of "getting anyone in trouble," it's a matter of doing what you believe to be the right thing. Something about meeting at a local restaurant to "transfer files" seems fishy to me. I believe you are absolutely in the right to refuse such a request. It does sound like a HIPAA violation to transfer the records off premises and even more so to discuss the clients in a public place
Now the real question becomes: who do you "stand your ground with" and what do you do to document your actions? It's not clear to me where this order was coming from. Was it human resources, or was it just your supervisor? Who is in the group that will be receiving this information?
If HR personnel were not involved in this request, then your best bet is to go to them to clarify what the exit procedure is for your job. You can ask an innocent (or seemingly innocent anyway) question to make sure that a professional information hand-off takes place. You don't have to tip your hand that you've been asked to divulge this information in a public place.
In the event HR is involved and has approved this strange process, then first express some reservations about the policy in writing. Get a response back from the corporation in writing. At that point, you've done all you can do to cover your backside, so go to the restaurant and transfer the information.
There is also what I'll call a nuclear option. You could report the process to the Department of Health and Human Services or go to your clients (for whom you are managing the medical cases), tell them about the process and explain your discomfort with it. This basically throws everyone in the organization under the bus. It also will put you at odds with your former employer and could result in messy lawsuits. I don't think this is a good option, but it is an option.
For more information:
In this expert Q&A, Mike Rothman discusses if it is a violation of HIPAA to collect consumer Social Security numbers.
A case study reveals how merging networks helped one medical facility with HIPAA compliance requirements.
|
