A nurse who shared patient data with her new employer has been suspended for 12 months by the New York State Education Department, while her former employer has been fined $15,000 for the breach of Protected Health Information.
In April 2015, Martha C. Smith-Lightfoot – a nurse practitioner formerly working at University of Rochester Medical Center (URMC), NY – requested data on patients she had treated in order to ensure the continuity of care after she left URMC to take a new position at Greater Rochester Neurology.
Smith-Lightfoot was sent a spreadsheet containing the names, dates, of birth, addresses, and diagnoses of 3,403 patients. However, without the knowledge of URMC or authorization of the patients, Smith-Lightfoot impermissibly disclosed the Protected Health Information to her new employers.
The HIPAA violation was noticed when several patients complained to URMC about being contacted by Greater Rochester Neurology about switching health care providers. When it became apparent what had occurred, URMC contacted Greater Rochester Neurology and the list was given back.
URMC then notified HHS’ Office for Civil Rights and the New York Attorney General of the data breach. HHS’ Office for Civil Rights investigated the impermissible disclosure but found URMC was not at fault and took no further action. The New York Attorney General felt differently and fined URMC $15,000.
No criminal charges were brought against the nurse who shared patient data, but the matter was referred to the New York State Education Department – the licensing authority for healthcare professionals in the State of New York. The Department suspended Smith-Lightfoot’s license for one year and gave her a two-year probation for when she returns to work.
Footnote: Following the data breach, URMC announced it had tightened regulations around access to Protected Health Information and heightened workforce awareness about HIPAA policies. Other healthcare organizations can learn from URMC’s compliance shortcomings inasmuch as it is not uncommon for departing employees to take confidential data with them to a new employer and this possibility should be factored into a risk assessment to determine HIPAA policies and the HIPAA training that needs to provided on the policies.
