Recently, 6,500 patients of Tri-City Medical Center in Oceanside, California were notified of a breach of their protected health information. A former employee (on his last day of employment in August) removed the medical records of the patients and brought them to the California Department of Public Health. Many have speculated that the employee was acting in a whistleblowing capacity.
The paper files that were removed from the premises were emergency department transfer logs for patients who were treated at the hospital ER and were either admitted to the hospital or transferred to another facility between December 1, 2013 and May 13, 2014.
While the hospital is busy sending out notification letters, the situation would not be classified as a breach of PHI if the employee was acting in a whistleblower capacity—that is acting in good faith to alert an appropriate oversight authority of suspected “conduct that is unlawful or otherwise violates professional or clinical standards, or that the care, services, or conditions provided by the covered entity potentially endangers one or more patients, workers, or the public.” For the relevant HIPAA regulation, see §164.502(j): Uses and disclosures of protected health information: general rules.
Like many hospitals across the nation, the finances of Tri-City Medical Center, a public institution, are challenged, as evidenced in the $11 million loss on net revenues of 300 million last year as published in their most recent financial report. Per the hospital financial report, the loss is due to patient volume decline. One source of patient volume declines is the “two midnight rule” of CMS which requires a patient to stay in the hospital two midnights in order to be classified as an inpatient. Otherwise, while the patient may be in the hospital receiving care, the case must be classified as “observation” which in general reimburses about half what an inpatient admission would provide.
ED employees in other institutions have alleged that management pressured them to falsify clinical documentation in order to increase reimbursement, for example, by exaggerating symptoms that would support an admission as opposed to an observation case. It would be completely speculative to suggest that such the physician in this case was making a similar allegation.
If this was the case, it’s not clear if the State Department of Public Health would be considered either a “health oversight agency” or “public health authority authorized by law to investigate or otherwise oversee the relevant conduct or conditions of the covered entity”. If this were the case, CMS would likely be the appropriate agency. We will monitor the situation and report any developments.
