Nurse Dianna Hereford’s employment contract was terminated after a patient of Norton Audubon Hospital complained of a nurse HIPAA violation. Hereford filed an action in the Jefferson Circuit Court against her employer for wrongful termination of her contract because she claimed that she always complied with HIPAA regulations.
Here’s how the alleged improper disclosure of PHI happened: Hereford was assisting with the patient’s transesophageal echocardiogram inside an examination area enclosed with a curtain. Before the procedure, Hereford told the echocardiogram technician and the physician to wear gloves because the patient had hepatitis C. After the procedure, the patient filed a complaint against Hereford for speaking loud enough so that other patients and hospital staff in the area heard that she had hepatitis C. Hereford was first placed on administrative leave during the investigation. Later, she was terminated for unnecessary disclosure of confidential health information.
Hereford filed an action for unfair dismissal claiming that it was an “incidental disclosure” and not HIPAA Rules violation. She further claimed she was defamed to the Metropolitan Louisville Healthcare Consortium. In response, Norton filed a motion to dismiss or a motion for summary judgment. The Circuit Court ruled in favor of Norton granting the motion to dismiss the claim for wrongful termination as it deemed there was unnecessary disclosure of patient information. The physician did not need the reminder to wear gloves. But the motion to dismiss the defamation claim was denied.
Norton sought summary judgment on the defamation claim and it was dismissed with prejudice on October 2015. The court ruled that speaking about the nurse HIPAA violation as grounds for Hereford’s termination did not defame her.
Hereford made an appeal to the Kentucky Court of Appeals. The Court decided based on the minimum necessary standard, 45 CFR 164.502, which demands that PHI disclosure be limited to the minimum necessary to accomplish the necessary purpose. Hereford’s statement was not the minimum necessary to accomplish the warning. So, the court affirms that a nurse HIPAA violation occurred. It also confirms the lower court’s decision to dismiss the defamation claim as correct.
The penalties for nurse HIPAA violation have four tiers. Tier one’s minimum fine is $100 per violation. Tier two’s fine is $1,000 per violation. Tier three’s fine is $10,000 per violation and tier four’s fine is $50,000 per violation. The exact penalty amount is determined by the state attorney general or the Department of Health and Human Services.