A pharmaceutical company sales representative comes into the office to provide information on a new discount program for the company's antidepressant medication. One of the office staff members performs a search of the practice electronic record system; she finds 2 patients on the schedule for the following week who are taking the drug and provides the names and addresses to the sales representative so that he can send information about the program. Later that day, when the clinician is notified of what happened, she immediately instructs the sales representative to not contact the patients and delete their information from his laptop computer. Which of the following is the most appropriate next step in addressing this situation?

Question

A pharmaceutical company sales representative comes into the office to provide information on a new discount program for the company's antidepressant medication.  One of the office staff members performs a search of the practice electronic record system; she finds 2 patients on the schedule for the following week who are taking the drug and provides the names and addresses to the sales representative so that he can send information about the program.  Later that day, when the clinician is notified of what happened, she immediately instructs the sales representative to not contact the patients and delete their information from his laptop computer.  Which of the following is the most appropriate next step in addressing this situation?

Quizplus · Accepted Answer

Explanation: 11ec2b69_c1ee_b678_8f63_311a475af6dd_MD0005_00 The Health Insurance Portability and Accountability Act of 1996 (HIPAA) established standards that providers and other health care entities (eg, insurance plans) must follow to protect patient confidentiality (ie, protected health information [PHI]). PHI refers to any personally identifiable information regarding the patient's health, services provided to the patient, and payments made for services. Providers are required to protect PHI against unauthorized disclosure and take steps to ensure compliance by their workforce (eg, office staff). These steps should include restricting physical access of unauthorized persons within health care facilities, device security measures (eg, password protection), and employee training. In general, PHI can only be transferred to persons outside the facility on direct authorization by the patient. Exceptions can be made for purposes of treatment (eg, sending records to a treating specialist), payment (eg, insurance audits), health care operations, or legal/regulatory requirements (eg, law enforcement). A breach of privacy refers to disclosure of PHI to an unauthorized person or for an improper purpose. In this case, patient information was given to an unauthorized person for a purpose (ie, marketing) that does not fall under any of the relevant exceptions. In cases of breach, the patient must be notified in writing (Choices B and C); first-class mail is preferred, but email is acceptable if the patient has agreed to electronic notifications. The notification should include a description of the breach, what information was disclosed, and what actions are being taken to mitigate the breach and prevent future disclosure. (Choice A) Although notification must be made within 60 days, it should be made as soon as possible without any unreasonable delays. Inquiring whether the patient received any contact from the unauthorized person who received PHI is unnecessary. (Choice D) The unauthorized person receiving PHI should be explicitly instructed not to allow further disclosure, but directing noncovered entities (ie, organizations not subject to HIPAA) to institute disciplinary action is not required. In addition, this does not ensure the patient is made aware of the breach of information. Educational objective: A breach of privacy refers to disclosure of patient information to an unauthorized person or for an improper purpose. In cases of breach, patients must be notified in writing, including a description of the breach, what information was disclosed, and what actions are being taken to mitigate the breach and prevent future disclosure.

A Pharmaceutical Company Sales Representative Comes into the Office to Provide