HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Psychiatrist Violates Privacy of Oregon State Hospital Patients

An error by an Oregon State Hospital psychiatrist has resulted in the protected health information of 19 patients being improperly disclosed to six individuals with no relationship with the hospital. Patients affected by the error were receiving treatment in the hospital’s maximum security ward.

The psychiatrist used a cellphone to take a photograph of a census sheet containing patient information, but the photo was accidentally sent to individuals unauthorized to view the information. The error happened on June 9, 2016. The psychiatrist was actually trying to send a different photograph, but attached the wrong image to the message.

The error was rapidly identified and the psychiatrist contacted all six individuals who received the photo and instructed them to delete the photo. All six individuals have confirmed that the photo has now been deleted. All patients affected by the privacy breach have received a breach notification letter alerting them to the error. According to the Statesman Journal, some patients were upset to find out that their information had been accidentally disclosed.

The data on the census sheet include the names of patients, their ID numbers, unit room number, legal status, vitals, names of treatment team members, names of patients’ physicians, precaution and privilege levels, treatment information, and a photograph of each patient.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

Oregon State Hospital employees are currently allowed to use their personal mobile phones at work, although they have received training on HIPAA Rules regarding patient privacy and they are prohibited from removing any patient data from the hospital without prior authorization.

The physician has been told not to use his personal phone to store PHI, and further privacy training has been provided. To prevent similar breaches from occurring procedures are being reviewed and will be updated as appropriate. The hospital will be looking into other measures that can be taken to reduce the risk of similar incidents occurring in the future.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.