The New York State Education Department has suspended the license of a nurse practitioner for violating the privacy of patients by providing their contact information to her new employer.
In April 2015, Martha C. Smith-Lightfoot took a spreadsheet containing the personally identifiable information of approximately 3,000 patients of University of Rochester Medical Center (URMC) and gave that information to her new employer, Greater Rochester Neurology.
The privacy violation was uncovered when several patients complained to URMC about being contacted by Greater Rochester Neurology about switching providers.
Prior to leaving URMC, Smith-Lightfoot requested information on patients she has treated in order to ensure continuity of care. URMC provider her with a spreadsheet that contained names, addresses, dates of birth, and diagnoses. URMC did not authorize Smith-Lightfoot to take the spreadsheet with her when she left employment.
The provision of the patient list to Greater Rochester Neurology was an impermissible disclosure of PHI and a violation of the HIPAA Privacy Rule. When it became apparent what had happened, URMC contacted Greater Rochester Neurology and the list was returned.
The privacy breach was reported to the Department of Health and Human Services’ Office for Civil Rights, as required by HIPAA, and the New York attorney general. OCR investigated but closed the case without issuing any financial penalties, although then attorney general Eric Schneiderman fined URMC $15,000 for the HIPAA violation.
Criminal penalties were not pursued against Smith-Lightfoot, although the matter was investigated by the New York State Education Department which issues licenses for the professions.
Smith-Lightfoot admitted disclosing personally identifiable patient information to her new employer and, in November 2017, signed a consent-order with the state nursing board Office for Professional Discipline. That consent order was accepted by the Board of Regents in February.
In addition to the 12-month suspension of her license, Smith-Lightfoot received a 12-month stayed suspension and faces 2 years of probation when she returns to practice.
The post 12-Month Suspension for Nurse Who Provided Patient Information to New Employer appeared first on HIPAA Journal.