On December 3, 2018, Thora Johnson was quoted in the Report on Medicare Compliance about a medical group in Connecticut, Allergy Associates of Hartford, which agreed to pay $125,000 to settle potential violations of the HIPAA Privacy Rule after one of its physicians spoke with a television reporter about a patient after the privacy officer had told him not to.
According to the article, a patient, the complainant, told Fox61, a TV station in Connecticut, that the physician "kicked her out" because she showed up for her appointment with a service dog. The HHS Office of Civil Rights (OCR) initiated an investigation once the physician spoke with the reporter, noting that the medical group failed to discipline or take corrective action with the physician. The story published with no details after the physician decided his comments weren’t on the record. The OCR resolution agreement states that "the workforce member impermissibly disclosed the PHI (protected health information) of the complainant."
When providers are slammed in the media or online, they have to keep mum, says Ms. Johnson. "Every bone in your body wants to be able to respond with facts that might indicate they are your patient or something about their condition, and that you can't do," she says. "The mere acknowledgment that someone is your patient is protected health information."
Johnson recommends providers make general statements in response to a criticism in the media or online, such as, "We strive to provide the best service to all our patents." She says providers can then reach out to the patient behind the scenes.