Nurse Sacked for HIPAA Violation Loses Legal Action Against Termination

by | Oct 23, 2017

A nurse, Dianna Hereford, who had her employment terminated following an alleged HIPAA violation at Norton Audubon Hospital has lost her appeal against the termination.


The claimed HIPAA violation resulted in the termination of the Ms Hereford’s, a registered nurse, employment contract. She subsequently filed an action in the Jefferson Circuit Court claiming her employer wrongfully terminated her contract of employment on the grounds that a HIPAA violation had happened. Ms Hereford claims she had ‘strictly complied with HIPAA regulations’ during her time working at the hospital.

The incident that lead in her sacking was an alleged impermissible release of PHI. Hereford had been assigned to the Post Anesthesia Care Unit at Norton Audubon Hospital and was helping with a transesophageal echocardiogram. At the time of the claimed HIPAA breach, the patient was in an examination zone that was sectioned off with a curtain for privacy. Hereford was there accompanying a physician and an echocardiogram technician.

Before the procedure began, Hereford carried a ‘Time-Out’ to ensure the patient was certain as to what the procedure would entail, checked to ensure the site of the procedure was clearly marked and made sure proper diagnostic tools were present. Hereford also advised the technician and the physician that they should don gloves because the patient had hepatitis C.

After the surgical procedure the patient submitted a complaint, claiming Hereford had spoken loud enough to allow other patients and medical staff in the vicinity would to hear that that she had hepatitis C. While the complaint was examined Hereford was put on administrative leave, and later had her contract of employment terminated due to the HIPAA breach.

In her legal action for unfair dismissal, Hereford stated this was an ‘incidental disclosure’, which is not a breach of HIPAA Rules. Hereford also sought the professional opinion of an unemployment insurance referee that a HIPAA violation had not happened. She also alleged that defamatory statements had been made about her to the Metropolitan Louisville Healthcare Consortium.

The hospital filed a motion to dismiss or, as an alternative, a motion for summary judgement. The Circuit Court granted the motion to dismiss the claim for wrongful termination, as it was found that an unnecessary disclosure of PHI has occurred as a physician should not need to be reminded to wear gloves for a procedure to stop the possible contraction of an infectious disease. However, the motion filed to dismiss the defamation claim was not granted.

Norton sought summary judgement on the defamation claim and in October 2015, the defamation claim was thrown out with prejudice. The court found that speaking the truth about the breach of HIPAA being the reason for termination could not be deemed as a defamation of Hereford.

Next Ms Hereford took her legal case to the Kentucky Court of Appeals. The Court of Appeals found that Hereford could not rely on HIPAA for a wrongful discharge claim as “HIPAA’s confidentiality provisions exist to protect patients and not healthcare employees.”

In relation to the wrongful dismissal claim, the court came to its decision on the minimum necessary standard, which requires any disclosure of PHI to be restricted to the minimum necessary to accomplish the necessary purpose – 45 CFR 164.502 – explaining, “Under “HIPAA, Hereford’s statement was not the minimum amount necessary to accomplish the warning.” The court ruled a HIPAA violation had happened. The Court of Appeals also found the decision of the lower court to dismiss the defamation claim to be proper as there could be no defamation when the Metropolitan Louisville Healthcare Consortium was told the truth about the reason for the termination of the contract of employment.


Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.


Please enable JavaScript in your browser to complete this form.

Patrick Kennedy

Patrick Kennedy is a highly accomplished journalist and editor with nearly two decades of experience in the field. With expertise in writing and editing content, Patrick has made significant contributions to various publications and organizations. Over the course of his career, Patrick has successfully managed teams of writers, overseeing the production of high-quality content and ensuring its adherence to professional standards. His exceptional leadership skills, combined with his deep understanding of journalistic principles, have allowed him to create cohesive and engaging narratives that resonate with readers. A notable area of specialization for Patrick lies in compliance, particularly in relation to HIPAA (Health Insurance Portability and Accountability Act). He has authored numerous articles delving into the complexities of compliance and its implications for various industries. Patrick's comprehensive understanding of HIPAA regulations has positioned him as a go-to expert, sought after for his insights and expertise in this field. Patrick's bachelors degree is from the University of Limerick and his master's degree in journalism is from Dublin City University. You can contact Patrick through his LinkedIn profile:

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.

Comprehensive HIPAA Training

Used in 1000+ Healthcare Organizations and 100+ Universities

    Full Course - Immediate Access

    Privacy Policy