Corinna Peters, Joey Grice, Kira Dunn, Rosetta Saiz
Team 16C
Executive Summary
Central Colombia Hospital (CCH) is a community-based hospital with a mission to serve
the public in a professional, caring and cost-effective manner. Newly-appointed President and
CEO, Anita Green, is setting high expectations for her staff members with hopes of surpassing
the competition. Executives are concerned about a potential violation of the Health Insurance
Portability and Accountability Act (HIPAA) by a group of employees, as well as a potential
violation of the Code of Conduct. CCH does not have a dedicated Corporate Compliance Officer
to oversee such issues. To decrease the risk of future disputes, we recommend that CCH
management hires a Corporate Compliance Officer, as well as amends the current Code of
Conduct to include a new social media policy. Concerns about workplace environment among
CCH employees will continue to be overseen by Frank Scott, current HR manager, by
implementing an open door policy to increase communication between employees and
management.
Major/Minor Problems with Causes
The most obvious long-term problem is that CCH has no designated Corporate
Compliance Officer to specifically handle HIPAA concerns. This was recognized by Anita
Green as a legal risk for CCH. William Toth, current risk manager for CCH, has stated that he
prefers to stay focused on patient safety goals, and is unwilling to expand his position to oversee
HIPAA, Medicare issues, and regulations such as orientation documentation, educational
requirements, and safety protocols and procedures. Absence of a Corporate Compliance Officer,
as well as a vague Code of Conduct, caused a HIPAA violation by CCH employee Charles
Sotherby. This violation is an immediate issue and needs to be dealt with using the limited
resources CCH has at this time.
Charles’ post on social media, “the big guy on MedSurg2 [that was admitted] for a simple
respiratory infection,” violates the privacy policy in the Pennsylvania HIPAA Privacy
Implementation Handbook¹. This policy states that a patient’s protected health information (PHI)
cannot be disclosed without their consent. Renee and Holly were discussing the patient in
enough detail that someone outside the conversation could identify the patient, solidifying the
violation of HIPAA. While remarks made by Charles and his peers about their discontent with
work conditions are protected under the Wagner Act and do not warrant discipline, his specific
remarks about the patient’s medical status warrant disciplinary action under HIPAA.
A minor issue which stems from the actions above is the employee conversations
concerning general work complaints, such as understaffing of the hospital and concerns about
recent recruitment hires. Because the conversation by the employees on social media is
considered concerted activity; therefore, there is no violation of the Code of Conduct. We believe
general work concerns are a minor issue because they can be settled without further legal action.
We are under constraint to recommend any changes due to the fact that working long hours is
typical of a hospital environment, and there are other opportunities, such as monthly meetings,
where employees can voice their concerns to upper management. These meetings have
acceptable attendance rates, but management has acknowledged that employees have not been
bringing such concerns to their attention. The CCH Code of Conduct is unclear in regards to the
use of social media since it uses the outdated term “electronic communication.” The material has
not caught up with societal trends, which includes an increase of social media use as a personal
and public form of communication. Without clear guidelines, employees can mistakenly interpret
their social media use as personal and protected when in reality social media is considered
public.
¹http://keepkidssafe.pa.gov/cs/groups/public/documents/manual/s_001612.pdf
A minor problem relating to the vague Code of Conduct is that employees feel the need
to complain about their frustrations via social media, rather than voicing their issues in the
hospital’s monthly meetings. The most recent cultural assessment completed by all hospital
employees shows an overall decrease in employee contentment. Poor workplace fulfillment
stems from hospital shortcomings, including excessive amounts of work assigned to employees,
inefficiencies in recruiting new employees, and insufficient compensation. Although the monthly
meetings are available for employees, not all of them believe that the meetings are an effective
way to communicate with their superiors, or are able to attend the meetings due to shift
obligations.
Recommendations
Most importantly, a violation of HIPAA warrants some disciplinary action. After
researching previous violations, we recommend suspending Charles for two days without pay.
Until a Corporate Compliance Officer is hired, formal discipline regarding Charles’ actions will
be dealt with by current CCH staff, specifically William Toth and Frank Scott. In order to be in
compliance with HIPAA’s obligations, we recommend hiring a compliance officer who will
address issues such as staff educational requirements, orientation procedures, patient care, and
safety protocols and procedures. This will not only put CCH in compliance with HIPAA, but will
better prepare the future hires with policies and procedures that could be costly to the hospital.
The Code of Conduct is outdated by five years; therefore, we recommend amending the
code to include a social media policy stating that company policy of electronic communication
extends to all forms of social media, and applies both on- and off-duty. Examples will be
provided in the revised Code of Conduct to illustrate how seemingly innocuous comments can
constitute a HIPAA violation, and the policy will abide by the Pennsylvania’s Social Media
Privacy Protection Act². Copies will be distributed to all employees and they will be required to
sign waivers stating that they have read and understood the new policy. Included in the social
media policy will be statements such as, but not limited to, the following: a statement that “afterhours or off-duty social media activity may subject an employee to disciplinary action for
violation of the Code of Conduct”; a statement that “employees are not allowed to publish, post,
or release confidential information on social media that may be detrimental to CCH or patients,”
including an example that would violate HIPAA and the Code of Conduct (eg. “Remember the
tall guy on floor 3 with a broken leg on Monday?”); and a statement that “this social media
policy is an addition to all other aspects of the Code of Conduct”.
In order to shape a more efficient HR unit, we considered hiring a Vice President of HR
per Anita’s vision. However, the lack of information about CCH’s budget and specific hiring
processes used constrains us to recommend this as an alternative. Instead, we recommend
eliminating monthly meetings and implementing an open door policy with Frank Scott. In
addition, we recommend restructuring the performance evaluation process at CCH. This will
encourage employees to discuss feedback directly with their supervisor, and allow an
opportunity for concerns about the workplace or job satisfaction to be addressed. CCH should
also seek employee input on the skills and abilities necessary for new hires, and relay their input
to recruitment officials for future hires. This will increase employees’ satisfaction and let them
know they are meaningful in the hiring processes and day-to-day operations of the hospital.
With these recommended changes we believe that CCH can achieve a more strategic
competitive advantage, comply with the state legal requirements, and increase employee morale
and satisfaction.
² http://www.theemployerhandbook.com/2012/07/pa-introduces-bill-to-protect.html