Court Upholds Sacking Termination for Nurse HIPAA Violation

A nurse HIPAA violation claimed by a patient of Norton Audubon Hospital resulted in the sacking of the registered nurse’s employment contract. The nurse in question, Dianna Hereford, submitted an action in the Jefferson Circuit Court claiming her employer wrongfully ended her contract on the basis that a HIPAA violation had taken place, when she says she had always ‘strictly complied with HIPAA regulations.’

The incident that led to her sacking in her dismissal was an alleged impermissible disclosure of PHI. Hereford had been posted to the Post Anesthesia Care Unit at Norton Audubon Hospital and was assisting with a transesophageal echocardiogram. At the time of the suspected HIPAA violation, the patient was located in an examination area that was closed off with a curtain. Hereford was there along with a physician and an echocardiogram technician.

Prior to the procedure taking place, Hereford carried out a ‘Time-Out’ to ensure the patient understood what the procedure would been comprised of, checked to make sure the site of the procedure was clearly marked and made sure proper diagnostic tools were available. Hereford also advised the technician and the physician that they should don gloves because the patient had hepatitis C.

Following the procedure the patient submitted a complaint, alleging Hereford had spoken quite loudly and that other patients and medical staff in the vicinity would have heard that she had hepatitis C. While the complaint was looked into Hereford was placed on administrative leave, and was later sacked for the HIPAA violation – an unnecessary sharing of confidential health information.

In her legal action for unfair dismissal, Hereford told the Judge that she believed this was an ‘incidental disclosure’, which is not a violation of HIPAA Rules. Hereford also submitted the professional opinion of an unemployment insurance referee that a HIPAA violation had not occurred. She also said that she believed the defamatory statements had been made about her to the Metropolitan Louisville Healthcare Consortium.

Norton submitted a motion to dismiss or, as an alternative, a motion for summary judgement. The Circuit Court allowed the motion to dismiss the claim for wrongful termination, as it was deemed there was an unnecessary sharing of PHI as a physician should not need to be told to wear gloves for a procedure to prevent the contraction of an infectious disease. However, the motion to throw out the defamation claim was denied.

Norton sought summary judgement on the defamation legal action and in October 2015, the defamation claim was thrown out with prejudice. The court ruled that speaking the truth about the nurse HIPAA violation being the reason for termination could not have defamed Hereford.

Hereford then brought her case to the Kentucky Court of Appeals. The Court of Appeals ruled that Hereford could not depend on HIPAA for a wrongful discharge claim as “HIPAA’s confidentiality provisions exist to protect patients and not healthcare employees.”

In relation to the wrongful dismissal claim, the court based its ruling on the minimum necessary standard, which requires any sharing of PHI to be limited to the lowest amount necessary to accomplish the necessary purpose – 45 CFR 164.502 – explaining, “Under “HIPAA, Hereford’s statement was not the minimum amount necessary to accomplish the warning.” The court found that a nurse HIPAA violation had occurred. The Court of Appeals also found the decision of the lower court to dismiss the defamation claim to be proper as there could be no defamation when the Metropolitan Louisville Healthcare Consortium was told the truth about the basis for dismissal.