A nurse, Dianna Hereford, who had her employment terminated following an alleged HIPAA violation at Norton Audubon Hospital has lost her appeal against the termination.
The claimed HIPAA violation resulted in the termination of the Ms Hereford’s, a registered nurse, employment contract. She subsequently filed an action in the Jefferson Circuit Court claiming her employer wrongfully terminated her contract of employment on the grounds that a HIPAA violation had happened. Ms Hereford claims she had ‘strictly complied with HIPAA regulations’ during her time working at the hospital.
The incident that lead in her sacking was an alleged impermissible release of PHI. Hereford had been assigned to the Post Anesthesia Care Unit at Norton Audubon Hospital and was helping with a transesophageal echocardiogram. At the time of the claimed HIPAA breach, the patient was in an examination zone that was sectioned off with a curtain for privacy. Hereford was there accompanying a physician and an echocardiogram technician.
Before the procedure began, Hereford carried a ‘Time-Out’ to ensure the patient was certain as to what the procedure would entail, checked to ensure the site of the procedure was clearly marked and made sure proper diagnostic tools were present. Hereford also advised the technician and the physician that they should don gloves because the patient had hepatitis C.
After the surgical procedure the patient submitted a complaint, claiming Hereford had spoken loud enough to allow other patients and medical staff in the vicinity would to hear that that she had hepatitis C. While the complaint was examined Hereford was put on administrative leave, and later had her contract of employment terminated due to the HIPAA breach.
In her legal action for unfair dismissal, Hereford stated this was an ‘incidental disclosure’, which is not a breach of HIPAA Rules. Hereford also sought the professional opinion of an unemployment insurance referee that a HIPAA violation had not happened. She also alleged that defamatory statements had been made about her to the Metropolitan Louisville Healthcare Consortium.
The hospital filed a motion to dismiss or, as an alternative, a motion for summary judgement. The Circuit Court granted the motion to dismiss the claim for wrongful termination, as it was found that an unnecessary disclosure of PHI has occurred as a physician should not need to be reminded to wear gloves for a procedure to stop the possible contraction of an infectious disease. However, the motion filed to dismiss the defamation claim was not granted.
Norton sought summary judgement on the defamation claim and in October 2015, the defamation claim was thrown out with prejudice. The court found that speaking the truth about the breach of HIPAA being the reason for termination could not be deemed as a defamation of Hereford.
Next Ms Hereford took her legal case to the Kentucky Court of Appeals. The Court of Appeals found that Hereford could not rely on HIPAA for a wrongful discharge claim as “HIPAA’s confidentiality provisions exist to protect patients and not healthcare employees.”
In relation to the wrongful dismissal claim, the court came to its decision on the minimum necessary standard, which requires any disclosure of PHI to be restricted to the minimum necessary to accomplish the necessary purpose – 45 CFR 164.502 – explaining, “Under “HIPAA, Hereford’s statement was not the minimum amount necessary to accomplish the warning.” The court ruled a HIPAA violation had happened. The Court of Appeals also found the decision of the lower court to dismiss the defamation claim to be proper as there could be no defamation when the Metropolitan Louisville Healthcare Consortium was told the truth about the reason for the termination of the contract of employment.