Due to the time I spent in the healthcare technology industry, I notice some HIPAA problems when they occur.
The Pharmacy Gave Me The Wrong Prescription
When I pulled up to the drive up window to pick up my prescription and said my name, the woman at the window came back with a bag containing medication and I took the bag, paid, and drove away. I was about one block away before my cell phone rang.
Me: "Hello?"
PH: (pharmacy) "Hello, Ms. Whatsup? You just picked up a prescription and when you said you name I thought I heard this name. I gave you the wrong medication."
She goes on for a bit telling me why my name sounds the same as another name. (same first initial, same last name)
When I went back to pick up my blood pressure medication, the pharmacy worker continued to tell me how much my name sounds the same as another name.
(its a small town)
Me: "Yes, she is my adult daughter."
*We live in the same town, but not the same house, block, etc.
PH: [looking very nervous] "I am very sorry,.. blah, blah . . ., I'm sorry"
Me: "No harm in this case."
The interesting part is although neither me or my daughter would have been worried about it. This could have been a huge problem for the pharmacy worker as well as the Pharmacy.
Neither of us (daughter or I) had a legal case in this situation due to not suffering harm or loss. (nor did I care that much) However, It could have kicked off an entire chain of events forcing the Pharmacy to spend more time and money on procedure, training, and documentation. Depending on if and where I filed a compliant there may have been an outside audit of their privacy protocols new requirements drafted, etc.
Why is HIPAA even a law? (applied to this situation) In theory, I could have read the prescription and with the right amount of knowledge (or Google) I could have narrowed down or identified a private medical condition violating another person's health information.
The situation reminded me how expensive it is for healthcare professionals to try to protect this information. Yet, getting signed off on HIPAA training is extremely easy and the tests are usually implemented across every staff member that works for a company regularly handling this information. Hundreds of people can legally access your healthcare information in a single day, especially if you have an active or complex medical condition.
Is this law of any benefit?
My thought is yes. (key word "any")
Like any protective regulation, is it worth the cost?
I think it is extremely questionable. (opinion)
A legal opinion on HIPAA violations and pharmacies: PHARMACY TIMES NEWSLETTER
What is HIPAA?
http://searchhealthit.techtarget.com/definition/HIPAA