Medical Center Settles Alleged Privacy Rule Violations for $80,000

by | Nov 21, 2023

St. Joseph’s Medical Center in Yonkers, NY, has agreed to settle alleged Privacy Rule violations for $80,000 and must comply with a corrective action plan to address the cause of the alleged violations – namely that members of the workforce impermissibly allowed a reporter to obtain information about three patients being treated for COVID without authorization.

In April 2020, a news reporter visited the St. Joseph’s Medical Center and was given access to clinical information relating to three patients being treated for COVID. The information – including personal identifiers – was subsequently published in an Associated Press article. On becoming aware of the article, HHS’ Office for Civil Rights (OCR) launched an investigation.

The investigation found that, as the patients had not authorized the disclosures of Protected Health Information (PHI), St. Joseph’s Medical Center was in violation of §164.502 of the Privacy Rule. In order to avoid formal proceedings, St. Joseph’s agreed to settle the alleged violations for $80,000 and comply with a corrective action plan for a minimum of two years.

Corrective Action Plan Focuses on Privacy Training

The primary objective of the corrective action plan is to prevent repeat violations. St. Joseph’s must review and revise where necessary all its policies and procedures relating to uses and disclosures of PHI with special attention being given to the use of photographic, video, and audio recording equipment in the medical center and to patient authorizations.

HIPAA training on all Privacy Rule policies and procedures must be provided to all members of the workforce – regardless of their function or their access to PHI – within 60 days of any revised policies being approved by OCR. Refresher Privacy Rule training must also be provided annually, while Security Rule training should be ongoing.

Each member of the workforce must attest that they have received the training and understand the training requirements. Under the terms of the corrective action plan, St. Joseph’s Medical Center must not provide access to PHI to any member of the workforce who does not attest to understanding the training requirements.

In a press release announcing the settlement, OCR Director Melanie Fontes Rainer said:

“When receiving medical care in hospitals and emergency rooms, patients should not have to worry that providers may disclose their health information to the media without their authorization. Providers must be vigilant about patient privacy and take necessary steps to protect it and follow the law. The Office for Civil Rights will continue to take enforcement actions that puts patient privacy first.”

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.


Please enable JavaScript in your browser to complete this form.

Ryan Coyne

Ryan Coyne is a results-driven leader in the healthcare compliance industry, specializing in regulatory compliance, compliance training, and assisting healthcare organizations and business associates in achieving and maintaining compliance. With a deep knowledge of healthcare regulations and a keen understanding of the challenges faced by the industry, Ryan has developed a reputation as a trusted advisor and advocate for ethical and compliant practices in healthcare. Ryan has successfully advised and guided numerous healthcare organizations, business associates, and healthcare professionals on achieving and maintaining compliance with regulatory training requirements. Ryan's professional focus is using his in-depth expertise and leading a world class team of subject matter experts at ComplianceJunction in regulatory compliance to help organisations navigate the complex landscape of ensuring staff adhere to healthcare regulations. You can connect with Ryan via LinkedIn and follow on Twitter

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.

Comprehensive HIPAA Training

Used in 1000+ Healthcare Organizations and 100+ Universities

    Full Course - Immediate Access

    Privacy Policy