HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

3 University of Arkansas Medical Sciences Employees Fired for Violation of Patient Privacy

University of Arkansas Medical Sciences (UAMS) has fired three employees over alleged HIPAA violations that saw a patient’s protected health information impermissibly disclosed and published on Facebook.

UAMS provides training to all employees to make them aware of their responsibilities with respect to patient privacy and the requirements of HIPAA, yet despite that training, one employee violated the privacy of a patient by disclosing that individual’s name, age, HIV status, employment information, and surgical history to a colleague.

That employee shared the information with a friend who uploaded the PHI to Facebook. A third employee allegedly played no part in the violation but was aware of the disclosures yet failed to report the incident to the hospital.

The hospital took prompt action when the HIPAA violations were discovered and terminated all three employees for violating HIPAA Rules and the hospital’s code of conduct. The hospital is taking steps to ensure similar incidents are prevented and is working with the patient to resolve the privacy violation.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

The motives of the employees are unclear, but their responsibilities to ensure patient privacy was protected had been clearly explained and there can be no doubt that they were aware that their actions were in breach of federal regulations.

In addition to losing their jobs, the matter has been referred to the U.S. attorney’s office and criminal charges for the HIPAA violation are being considered.

The privacy violation should serve as a warning to all healthcare employees about the potential repercussions of HIPAA violations, and also that the failure to report a HIPAA violation by a co-worker could also result in loss of employment.

If a HIPAA violation is discovered in the workplace, the incident should be reported to the organization’s privacy officer to ensure prompt action can be taken to limit the harm caused.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.