Case Discussion
The following case study (Rinehart-Thompson) at hypothetical St. John Hospital illustrates numerous
issues that the HIPAA privacy rule presents and which HIPAA-covered entities must address on a daily
basis. As you conclude chapter 10, use this case study to identify the issue(s) presented on each date,
determining how each situation should be handled in order to comply with the HIPAA privacy rule.
Background: From May 26-30, Mary Jones was hospitalized in St. John Hospital, located in Johnson
County, for Type 1 diabetes and a possible drug overdose. She had a previous above-knee amputation of
the right leg, with prosthesis.
On July 18, Ms. Jones contacted the HIM department at St. John Hospital to request a copy of her
medical records from her May hospital admission. The chart was copied for her by ReadyChart, the
record-copying service utilized by St. John Hospital.
On October 5, St. John Hospital received a call from Mercy Hospital. Ms. Jones was in the emergency
department there with a severe infection of her prosthetic site. The nurse in the Mercy Hospital
emergency department asked for faxed copies of medical records from Ms. Jones’ September admission
at St. John, as she was being prepared for immediate surgery.
On October 15, Ms. Jones called St. John Hospital’s HIM department and asked that her medical records
from her May St. John Hospital admission be mailed to Dr. Lyon, as she has an appointment scheduled
with him on November 15. Ms. Jones stated that she had also changed jobs in September, and her new
health insurer was Liberty Life and Health.
On November 10, Ms. Jones received a brochure and samples from Comfort Healthcare, a pharmaceutical
company that manufactures ointment for patients with prostheses. Ms. Jones called the St. John Hospital
registration desk to complain. Jessica Carter, a volunteer, took Ms. Jones’ call.
On November 29, Liberty Life and Health submitted a request to Dr. Lyon’s office for copies of Ms.
Jones’ medical records from her May St. John Hospital admission and from Dr. Lyon’s office.
On November 30, a case worker from the Johnson County Children’s Services called the HIM department
at St. John and requested Ms. Jones’ medical records from her May hospitalization. Children’s services
had received a complaint that Ms. Jones had an “episode” on May 26 and there was concern that her
children were being subjected to ongoing abuse. As a result, it was initiating an investigation.
On December 2, Dr. King, an orthopedic surgeon, presented a seminar to the state association of
orthopedic surgeons on above-knee amputation techniques. He had performed this procedure on Ms.
Jones one year ago, and he showed slides that compared her condition before the procedure, immediately
after, six months later, and one year later.
Based on the HIPAA privacy rule issues discussed in chapter 10, identify the issue or issues presented on
each date in the above case study.
May 26-30 – Drug abuse protected under Drug Abuse Prevention, Treatment, and Rehabilitation Act of
1972. Facility directory
July 18 – Ms. Jones has the right to request a copy of her patient record. ReadyChart is St John Hospitals
BA, considered to be workforce members. There should be a business associate agreement between the
two.
October 5 – The nurse at Mercy Hospital is requesting a record for a surgery that supposedly occurred in
September. Since there is no record of a surgery occurring in September on the patient record this would
need to be confirmed before any information is given out. Ms. Jones would also have to give consent in
order for Mercy Hospital to receive the patient record.
November 10 – Comfort Healthcare has been given personal information regarding Ms. Jones. There is
clearly a violation of privacy between her patient records and Comfort Healthcare. She did not consent for
a release of her personal information.
November 29 – Ms. Jones would have to give a written agreement for Liberty Life and Health to get the
information.
November 30 – The HIM department can disclose whether Ms. Jones received medical treatment in May.
They cannot disclose any information on what occurred during her hospitalization. The only way they can
disclose this information is with the consent of Ms. Jones.
December 2 – Since Dr. King is using her information for research purposes, it would require the Ms.
Jones consent. If she did not give authorization for him to use it, he could be held liable.