Doctor concerned with health care law

Breaking news and expert analysis on legal and compliance issues

[Back To Home][Back To Archives]

From Health Law Daily, May 12, 2017

Releasing a patient’s name to the media is a Privacy Rule violation

By Sarah E. Baumann, J.D.

Memorial Hermann Health System (MHHS), a Texas-based health system, violated the Health Insurance Portability and Accountability Act (HIPAA) (P.L. 104-191) Privacy Rule when it released the name of a patient to various media outlets, after the undocumented immigrant presented a false driver’s license at an MHHS facility and MHHS contacted law enforcement. The HHS Office for Civil Rights (OCR) emphasized that the disclosure to law enforcement was lawful, but that opined that "senior management should have known" that inclusion in a press release was a "clear HIPAAPrivacy violation." Although MHHS did not admit liability, it entered into a resolution agreement with the OCR, agreed to pay $2.4 million, and entered into a two-year corrective action plan (CAP) (Resolution agreement, May 10, 2017).

The OCR initiated review of the incident based on multiple media reports. It determined that MHHS released the patient’s name to 15 media outlets and/or reporters in the course of four days without the patient’s written consent, and that senior leaders released the names to an advocacy group, state representatives, and a state senator over the course of three meetings.

As part of the CAP, MHHS must develop, maintain, and revise written policies and procedures addressing uses and disclosure of protected health information (PHI), including releases to the media and law enforcement, identification of personnel or representatives to whom stakeholders may turn with privacy questions, internal reporting procedures, and the application and documentation of appropriate sanctions. It must distribute such policies and procedures to all workforce members and provide training. MHHS must notify the OCR of reportable events. Failure to comply with the terms of the CAP may result in the imposition of civil monetary penalties (CMPs).

Companies: Memorial Hermann Health System

MainStory: TopStory CMPNews ConfidentialityNews EnforcementNews HIPAANews

Back to Top

Health Law Daily

Introducing Wolters Kluwer Health Law Daily — a daily reporting service created by attorneys, for attorneys — providing same-day coverage of breaking news, court decisions, legislation, and regulatory activity.


A complete daily report of the news that affects your world

  • View full summaries of federal and state court decisions.
  • Access full text of legislative and regulatory developments.
  • Customize your daily email by topic and/or jurisdiction.
  • Search archives for stories of interest.

Not just news — the right news

  • Get expert analysis written by subject matter specialists—created by attorneys for attorneys.
  • Track law firms and organizations in the headlines with our new “Who’s in the News” feature.
  • Promote your firm with our new reprint policy.

24/7 access for a 24/7 world

  • Forward information with special copyright permissions, encouraging collaboration between counsel and colleagues.
  • Save time with mobile apps for your BlackBerry, iPhone, iPad, Android, or Kindle.
  • Access all links from any mobile device without being prompted for user name and password.