A nurse practitioner who breached the privacy of patients by sharing their contact information with her new employer has been suspended for 12 months by the New York State Education Department.
In April 2015, Martha C. Smith-Lightfoot obtaine a spreadsheet containing the personally identifiable information of around 3,000 patients of University of Rochester Medical Center (URMC) and shared that information to her new employer, Greater Rochester Neurology.
The privacy breach was noticed when several patients complained to URMC about being contacted by Greater Rochester Neurology about switching health care providers.
Before departing URMC, Smith-Lightfoot requested data on patients she has treated in order to ensure continuity of care. URMC provider her with a spreadsheet that included names, addresses, dates of birth, and diagnoses. URMC did not give Smith-Lightfoot permission to take the spreadsheet with her when she left her role with them.
Supplying the patient list to Greater Rochester Neurology was an impermissible disclosure of PHI and a breach of the HIPAA Privacy Rule. When it became apparent what had occurred, URMC contacted Greater Rochester Neurology and the list was given back.
The privacy breach was made known to the Department of Health and Human Services’ Office for Civil Rights (OCR), as required by HIPAA, and the New York attorney general. OCR looked into the instance but closed the case without issuing any financial penalties, although then attorney general Eric Schneiderman fined URMC $15,000 for the HIPAA breach.
Criminal penalties were not sought against Smith-Lightfoot, although the matter was looked into by the New York State Education Department which issues licenses for the professions.
Smith-Lightfoot admitted sharing personally identifiable patient information to her new employers and, in November 2017, signed a consent-order with the state nursing board Office for Professional Discipline. That consent order was recognized by the Board of Regents in February.
Along with the 1-year suspension of her license, Smith-Lightfoot received a 12-month stayed suspension and faces a two-year probation when she returns to work.