Problem solve Get help with specific problems with your technologies, process and projects.

Will an off-site employee exit procedure violate HIPAA regulations?

In this expert response, Mike Rothman discusses if it is a HIPAA violation to discuss clients or handle business matters in a public environment.

I am resigning from a medical case management company and was told to meet with a group at a local restaurant to transfer the files and give verbal information about these clients. I have said that I feel it will be breaking HIPAA regulations to do this. What should I do? Do I do as ordered or do I stand my ground and not meet in such a non-controlled atmosphere, in which any conversation could be easily overheard?
It's not a matter of "getting anyone in trouble," it's a matter of doing what you believe to be the right thing. Something about meeting at a local restaurant to "transfer files" seems fishy to me. I believe you are absolutely in the right to refuse such a request. It does sound like a HIPAA violation to transfer the records off premises and even more so to discuss the clients in a public place

Now the real question becomes: who do you "stand your ground with" and what do you do to document your actions? It's not clear to me where this order was coming from. Was it human resources, or was it just your supervisor? Who is in the group that will be receiving this information?

If HR personnel were not involved in this request, then your best bet is to go to them to clarify what the exit procedure is for your job. You can ask an innocent (or seemingly innocent anyway) question to make sure that a professional information hand-off takes place. You don't have to tip your hand that you've been asked to divulge this information in a public place.

In the event HR is involved and has approved this strange process, then first express some reservations about the policy in writing. Get a response back from the corporation in writing. At that point, you've done all you can do to cover your backside, so go to the restaurant and transfer the information.

There is also what I'll call a nuclear option. You could report the process to the Department of Health and Human Services or go to your clients (for whom you are managing the medical cases), tell them about the process and explain your discomfort with it. This basically throws everyone in the organization under the bus. It also will put you at odds with your former employer and could result in messy lawsuits. I don't think this is a good option, but it is an option.

For more information:

  • In this expert Q&A, Mike Rothman discusses if it is a violation of HIPAA to collect consumer Social Security numbers.
  • A case study reveals how merging networks helped one medical facility with HIPAA compliance requirements.
  • This was last published in December 2007

    Dig Deeper on HIPAA

    Have a question for an expert?

    Please add a title for your question

    Get answers from a TechTarget expert on whatever's puzzling you.

    You will be able to add details on the next page.

    Start the conversation

    Send me notifications when other members comment.

    Please create a username to comment.