MMHA 6205 Week 6 Record Snooping Case Example

Six Screens in Four Minutes and One Remark Over the Fence: A Registration Clerk's Access to a Neighbor's Emergency Record and Her Disclosure Analyzed as Two Separate Privacy Violations

Student Name

Walden University

MMHA 6205: Health Law and Ethics

Instructor Name

Month Day, Year

Six Screens in Four Minutes and One Remark Over the Fence: A Registration Clerk's Access to a Neighbor's Emergency Record and Her Disclosure Analyzed as Two Separate Privacy Violations

The Audit Log

A patient complained to a community hospital's privacy officer that a neighbor seemed to know about her emergency department visit. The privacy officer pulled the access log for her record. The excerpt below shows every access by a user outside the patient's treatment team; the times, screens and user ID are fabricated for this analysis.

Table 1

Audit Log Excerpt for the Complaining Patient's Record

The clerk was on shift in the outpatient laboratory, which had no order or appointment for this patient.

Interviewed, the clerk acknowledged looking. She said she saw an ambulance at her neighbor's house that evening and was worried. Three days later, talking with another neighbor, she said the patient "had been in the ER for a broken wrist and had been drinking." That neighbor repeated it to the patient.

Violation One: Access Without a Job Purpose

Under the federal privacy rule, a hospital may use patient information to treat, to bill and to run its operations, and it must confine each workforce member's use to what that person's role requires (45 C.F.R. § 164.502). A registration clerk in the outpatient laboratory has a reason to view a patient's demographic and insurance information when registering that patient for a laboratory visit. She had no reason to view anything about this patient, and certainly not the triage note, physician note and laboratory results. The access was a use of protected health information without a permitted purpose, and it violated the hospital's access policy, which every employee signs.

Her motive was concern, and it may have been genuine. It does not change the character of the act. The rule does not allow workforce members to read records out of worry, curiosity or friendship. A clerk who was truly concerned could have knocked on the neighbor's door. The log also undercuts the account of concern a little: she opened the laboratory results and discharge instructions, which describe the injury and its circumstances in detail. A worried neighbor would have learned from the encounter list alone that the patient had been treated and sent home; everything after that screen served curiosity rather than concern.

Violation Two: Disclosure Outside the Hospital

The remark to the second neighbor is the more serious event. Telling a person outside the hospital about a patient's diagnosis and alcohol use is a disclosure that no provision of the Privacy Rule permits. Access harmed the patient's privacy in principle; disclosure harmed it in fact, spreading sensitive information through her neighborhood. It also changes the hospital's obligations, as the next section explains.

The Hospital's Obligations

Two obligations follow. First, the hospital must discipline workforce members who break its privacy policies and keep a record of the discipline (45 C.F.R. § 164.530). Sanctions must be applied consistently: a clerk who snoops and talks should face the same response as a physician who does the same.

Second, the hospital must assess whether a breach of unsecured protected health information occurred. The breach rules treat any impermissible use or disclosure as a breach unless the hospital's documented risk assessment finds it unlikely that the record was compromised (45 C.F.R. § 164.402). Four factors drive that assessment: how sensitive the information is, who received it, whether it was actually seen or taken, and how far the risk has been reduced. Here, sensitive information was disclosed to someone outside the hospital who repeated it. The low-probability standard cannot be met. The patient must be notified promptly, and no later than 60 days after the hospital discovered the breach (45 C.F.R. § 164.404). Even the access alone might have required notification; the disclosure removes any doubt.

Ethics and Proportionate Discipline

Confidentiality protects more than one patient. People tell clinicians things they tell no one else, and they come to emergency departments in their worst moments, because they trust that what happens there stays there (Beauchamp & Childress, 2019). A neighbor who works at the hospital is a reason some people avoid it. The clerk's professed concern does not weigh against that trust; her concern for the patient would have been better served by leaving the record closed.

What discipline is proportionate? Many hospitals use tiered sanctions, distinguishing accidental access, intentional access without disclosure and access with disclosure. On that scale, this case sits at the top tier despite being a first offense, because of the disclosure. Termination is defensible and consistent with how most hospitals treat intentional disclosure. A final written warning with retraining would be proportionate for snooping alone. The hospital should apply whatever its policy sets for this tier, and if the policy is silent, it should write the tiers now so that the next case is not decided ad hoc.

Preventing the Next Case

The incident also exposes a technical gap. The clerk's account let her open any patient's full emergency record, though her job required only demographics and insurance. Role-based access would limit registration staff to the screens they use, with a prompt requiring a stated reason before any clinical note opens. Hospitals that audit proactively, rather than only after a complaint, can also run routine reports that flag workforce members viewing records of patients who share their street or surname. Such reports would have caught this access the next morning, before any remark was made. Training should use cases like this one, described without names, because staff often believe that looking without telling is harmless, and a real example of how looking led to telling is more persuasive than a policy statement.

Finally, the hospital owes the patient an apology and an explanation of what it has done, without naming the clerk unless law and policy permit.

References

Administrative requirements, 45 C.F.R. § 164.530 (2024).

Beauchamp, T. L., & Childress, J. F. (2019). Principles of biomedical ethics (8th ed.). Oxford University Press.

Definitions, 45 C.F.R. § 164.402 (2024).

Notification to individuals, 45 C.F.R. § 164.404 (2024).

Uses and disclosures of protected health information: General rules, 45 C.F.R. § 164.502 (2024).