A patient has accused one of our employees of a HIPAA violation. The patient says the employee looked up her medical records and shared the information with her neighbor. We are, of course, conducting an investigation, but this is our first HIPAA investigation, so we're not sure what to do while it occurs.
Should the employee be suspended while we investigate? Should we withhold her patient access? Should she be paid? Naturally, if we find that she did do this, she'll be fired. But, what if she didn't? Do we apologize? And what do we do about the patient who accused her in the first place?
Dear Under Investigation,
HIPAA violations are serious, and in the news: Fifty hospital employees were just terminated after inappropriately accessing a patient's medical records. It's important that you are investigating this. You never want to jump to conclusions in these situations—as anyone who works with other humans knows, not every complaint against an employee is a valid one.
Because this is a fireable offense (although not all HIPAA violations have to result in termination), a temporary suspension seems like the best thing to do. You certainly don't want someone untrustworthy with access to patient records. Even if you put her into a position where there is no patient access, which seems difficult in a medical office, she'll inevitably still see some patient interactions or overhear conversations in the office, which is problematic.
As for pay during suspensions, a good rule of thumb is to withhold payment. Then, if the person is cleared, you pay them for the days they missed. But, if the person is found guilty, the days remain unpaid. Normally you can't deduct pay from a salaried, exempt employee, but a suspension is an exception to that rule. Meanwhile, someone who is non-exempt only has to be paid for actual hours worked.
That leaves the matter of the patient, and what to do with her if it turns out that your employee is innocent. Well, it depends. Was she simply mistaken or was this a vicious attempt to get the employee fired? A mistake is cleared up easily. A deliberate lie, on the other hand, means you wouldn't want this person as a patient—or a customer.
If the employee is ultimately cleared, you should apologize for any potential misunderstandings on behalf of the patient, but not for suspending and investigating her. These things are serious and you are obligated to follow the law, so even if she is proven innocent, you did the right thing. Make sure everyone knows she was cleared and don't hold the investigation against her in the future.
The rule is to always investigate promptly and fairly, and use suspensions when the outcome could be serious.
Suzanne Lucas, Evil HR Lady
Photo: Creative Commons
Want to keep learning? Explore our products, customer stories, and the latest industry insights.
Ethics in human resources: 6 guidelines for HR teams
Today's human resources professionals manage more moral, ethical and legal responsibilities than ever before. Beyond compensation and benefits, HR teams are now tasked with challenges like fostering workforce diversity, addressing inequality issues and setting standards around workplace conduct.
Your holistic guide to talent success
The 2023 Talent Health Index: Your holistic guide to talent success, a new report led by the Cornerstone People Research Lab, provides you with a comprehensive view of the state of talent programs across organizations worldwide. The study found that most organizations are falling behind with their talent health initiatives, but they don’t have to stay that way. With the 2023 Talent Health Index, you can better understand what a successful talent program looks like and what steps you can take to redefine your talent strategy and unlock your organization’s full potential.