You can get fired for an accidental HIPAA violation depending on the nature of the HIPAA violation, the consequences of the violation, your employer’s workplace sanctions policy, and your previous record of accidental violations. .
Whether accidental or not, HIPAA violations are serious events. PHI often contains very sensitive material, and it it gets into the wrong hands it could lead to identity theft or insurance fraud. Even without those severe consequences, a patient has the right to keep their medical information private.
The HIPAA Privacy Rule lays out how PHI can be used and to whom it can be disclosed. Failing to adhere to either of these stipulations is considered a HIPAA violation, even if it was an accident on the part of the employee.
It may be a cliché, but everyone makes mistakes. Accidental HIPAA violations can occur through a variety of means. Falling for a PHIshing attack, for example, that left PHI exposed would be considered an accidental violation. Sending information to the incorrect recipient (for example, accidentally cc’ing someone or typing the incorrect email address) would also result in a HIPAA violation.
As soon as an accidental HIPAA violation is discovered, the organization’s HIPAA Privacy Officer should be notified. They will be able to assess the magnitude of the breach, and potentially mitigate any further harms. Though it is mandatory to report such violations, doing so quickly can help the employee’s case against disciplinary action.
Whilst it is not unprecedented that employees will be fired for HIPAA violations, the penalty will vary between scenarios. The Department for Health and Human Services (HSS) does not stipulate the remedial actions to be undertaken by employers if someone in their workforce accidentally violates HIPAA. Instead, it will depend on the employer’s own workplace policy.
For more minor violations that are limited in scope (for example, if it only involves a few patients’ PHI, or where the PHI was not made public), the employee may be put on additional HIPAA training courses. More severe cases with broader scope may result in a warning, suspension, or even termination. In 2021, a nurse who worked in Jackson Memorial Hospital posted a photograph of a baby with gastroschisis on her Facebook account. This was a clear-cut violation of HIPAA and resulted in the nurse’s termination.
Therefore, whilst there are a range of disciplinary actions that may result from accidental HIPAA violations, it will ultimately depend on the nature of the violation, its scope, and the employee’s previous compliance record. Nevertheless, it is possible to be fired for accidentally violating HIPAA.