Over the past few weeks, we have been exploring HIPAA, which has made its way back into the news. We have talked about how computer viruses and malware can be dangerous to Protected Health Information (PHI) on your network and what to do when you think you have a breach. But we’re compelled to ask: Do you also know that you are responsible if an employee commits a violation of HIPAA?
We are going to continue on our HIPAA readiness journey by discussing how you, as a pharmacy owner, are held responsible for when your employees commit a violation of HIPAA, what measures you can take to ensure HIPAA compliance, and the precautions to be followed to minimize your liabilities against HIPAA violations by employees, if need be.
Who is Responsible for HIPAA Compliance?
All organizations, agencies, and individuals that belong to the category of “covered entity under HIPAA” are required to comply with its regulations pertaining to PHI. This group covers everybody who interacts with patient health data as a part of their job responsibilities, including pharmacists and IT professionals who control the server that holds the patient database.
#3 Respondeat superior: The Sins of the Tech Shall Be Visited Upon the Pharmacy Owner (Violation of HIPAA)
What if Joe, your pharmacy tech, lets slip to his friends that “Jane Doe” was prescribed medication for a pretty embarrassing medical condition? That’s a clear violation of HIPAA, and if you hear about it, you’ll fire Joe. But what if Jane hears about it and files a lawsuit? Will she sue Joe, or will she sue you? Who has the deeper pockets?
Respondeat superior is Latin for “let the master answer.” As a legal doctrine, Respondeat superior means that the employer can be held liable for illegal actions of employees that are done within the scope of their employment. Even though you have done nothing wrong, the law holds that you, “the master,” have a measure of control over your employee and may have to answer for his wrongdoing.
An employer takes on a certain amount of vicarious liability for employees. You are responsible for training your employees on how to do their jobs and what not to say or do. So, in essence, you are responsible if an employee commits a violation of HIPAA.
Employer Responsibility for HIPAA Violations
Naturally, there are conditions that must be met before employer liability will be imposed for the wrongful conduct of an employee. To be within “the scope of employment,” conduct must (1) be of the type the employee was hired to perform; (2) take place within the time and space limits authorized by the employer; and (3) be at least partly motivated by a purpose to serve the employer. Often, these questions are decided by a jury.
In case of any confidentiality breach, although the practice is typically held liable for HIPAA violations, an employee may also be held responsible depending on the specific case and violations. However, even in such cases, the employer may partly bear the consequences for failure to provide proper or adequate training.
In any case, ignorance on the part of the employer or employee is not considered an acceptable or reasonable excuse. This means that there are huge ramifications for employers, in any event, whether they may or may not be at fault. Therefore, providing proper training to employees to ensure the organization is HIPAA compliant is just one of the crucial measures.
In addition, all pharmacies should have policies and procedures in place that clearly spell out the responsibility of employees not to disclose confidential or private medical or treatment information. Employees should be trained on your HIPAA Policies and Procedures, and they should also electronically acknowledge or sign a document stating that they’ve participated in your HIPAA training.
This training, along with their job description, should clearly lay out the scope of their duties and the conduct that is inappropriate or illegal. Did you know: if you do all you can to document your HIPAA compliance and employee training, you may not be held responsible if an employee commits a violation of HIPAA, which means that Joe may, indeed, take the rap alone.
For more information about HIPAA and other pharmacy compliance solutions for your pharmacy, call PRS at 1-800-338-3688 and speak with one of the Specialists. Please visit the Blog for additional posts on compliance issues and what you need to know as a pharmacy owner.
