HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

12-Month Suspension for Nurse Who Provided Patient Information to New Employer

The New York State Education Department has suspended the license of a nurse practitioner for violating the privacy of patients by providing their contact information to her new employer.

In April 2015, Martha C. Smith-Lightfoot took a spreadsheet containing the personally identifiable information of approximately 3,000 patients of University of Rochester Medical Center (URMC) and gave that information to her new employer, Greater Rochester Neurology.

The privacy violation was uncovered when several patients complained to URMC about being contacted by Greater Rochester Neurology about switching providers.

Prior to leaving URMC, Smith-Lightfoot requested information on patients she has treated in order to ensure continuity of care.  URMC provider her with a spreadsheet that contained names, addresses, dates of birth, and diagnoses. URMC did not authorize Smith-Lightfoot to take the spreadsheet with her when she left employment.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

The provision of the patient list to Greater Rochester Neurology was an impermissible disclosure of PHI and a violation of the HIPAA Privacy Rule. When it became apparent what had happened, URMC contacted Greater Rochester Neurology and the list was returned.

The privacy breach was reported to the Department of Health and Human Services’ Office for Civil Rights, as required by HIPAA, and the New York attorney general. OCR investigated but closed the case without issuing any financial penalties, although then attorney general Eric Schneiderman fined URMC $15,000 for the HIPAA violation.

Criminal penalties were not pursued against Smith-Lightfoot, although the matter was investigated by the New York State Education Department which issues licenses for the professions.

Smith-Lightfoot admitted disclosing personally identifiable patient information to her new employer and, in November 2017, signed a consent-order with the state nursing board Office for Professional Discipline. That consent order was accepted by the Board of Regents in February.

In addition to the 12-month suspension of her license, Smith-Lightfoot received a 12-month stayed suspension and faces 2 years of probation when she returns to practice.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.