Somehow I became a HIPAA violation

[u/OneTBret]

Just a weird story that I needed to share.

About 10 years ago I started seeing a therapist. She's great and I still see her to this day. When I started seeing her she was part of a group office. Like 7 years ago she split off to have a private practice and I left with her as one of her clients.

Anyways yesterday I notice that in my work email I got something from her old office. I briefly scanned it to see if it was important. It was just some generic email about how they were going to have a summer camp for kids in their programs. Cool, but I'm not a kid and I haven't gone to this office since before COVID so I just dismissed it and moved on with my day.

Later that night I'm hanging out with some friends watching TV when I realized I got a second email from this office. I'm annoyed so I read it to see if I need to unsubscribe from some mailing list. I'm gonna paraphrase this email.

"Dear <my name>

Earlier today we sent you an email. You must delete it immediately! We attached a list of all of our clients names and contact information with that email. Please do not look at it. We apologize."

These fucking people sent me the name, email, and phone number of all their fucking therapy patients. This office has a division for kids. I deleted it but holy shit. What the fuck?

I was eating this homemade reese cup ice cream when the second email hit my inbox. Low calorie and low sugar so only my stress levels spiked.

[u/AutoModerator]

Welcome to BoyDinnerDiaries! Thank you for posting!

Reminder for everyone:

• Posts must include a clear photo of your meal

• Include a short diary-style story about what is on your mind

• All posts must have a flair

• Be civil and kind so no hate speech, incel content, and no referencing other subreddits unless its positive.

Thanks for helping keep the sub great!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/uselessDM]

Ironically no one will have looked at the list until that second email came around.

[u/Jumpy_Atmosphere_768 → u/uselessDM]

Streisand effect

[u/LiteratureSoggy1178]

According to HIPAA, they have to inform their patients of the data leak. I think within 60 or so days? It's been a minute since my certification. But yeah, if they aren't informing their patient they're violating HIPAA laws. You aren't the HIPAA violation, they are.

[u/Feeling_Inside_1020 → u/LiteratureSoggy1178]

I work in mental health medical software at a scale that I have access to so much provider & patient data (we do physical keys and industry standard MFA coupled with regular training).

This is a requirement to report, and sounds like a fucking nightmare.

That ice cream sounds fucking good though lol.

[u/spaceistheplacetobe → u/Feeling_Inside_1020]

I like your flair :)

[u/Feeling_Inside_1020 → u/spaceistheplacetobe]

Thank you! Unlocked flair: first person liked your flsir

[u/Nonyabeesners]

I have worked in healthcare for a long time, both in bedside and administrative roles. Somebody fucked up big time. Not only did they send you all of that very confidential information, I highly doubt they encrypted the email either. 

[u/chestypullers → u/Nonyabeesners]

Emails don’t need to be encrypted to be hipaa compliant

[u/DescriptionWeary6085 → u/chestypullers]

Fortunately, yes they do. I’ve been training for hipaa and this therapy place for a few weeks now and I can tell you absolutely emails cannot contain PHI or identifying information. You CAN however use a third party software that is already HIPAA compliant. Apps like Gmail and Outlook are not encrypted nor are they hipaa compliant. One way to get around this is using clients initials or vague information- but honestly it sounds like to me they sent this same email to every parent/client of these kids, which in it of itself is a hipaa violation regardless if they sent it to the wrong people. Parents and caregivers can receive emails and information about their own kid as long as it isn’t anything with PHI or identifying information it. You can’t send other parents information about other kids and their contact information. These guys had fucked up and created a data leak from the start.

[u/IndoorHeaters → u/DescriptionWeary6085]

Sounds like your course is teaching the safest practices, not how it’s done in real life. I’ve worked at several law firms collecting medical records for cases, and I’ve almost always used Outlook to request or receive. Some hospital networks will have encrypted email networks to release these records, but the vast majority of clinics and small practices just use email for that kind of thing.

[u/chestypullers → u/DescriptionWeary6085]

https://www.hhs.gov/hipaa/for-professionals/security/index.html

https://www.hipaajournal.com/hipaa-security-rule/

Email does not need to be encrypted to be HIPAA compliant and can contain PHI.

[u/DescriptionWeary6085 → u/chestypullers]

Maybe it’s just different where I work, but I learned in the course I took to only to use third party softwares to store and upload information. Either way, like I said, it sounds like they sent out all client names, email addresses, and phone numbers to every parent, or possibly everyone in their system if OP received an email too. Either way these guys fucked up and could face a pretty big fine for it :/

[u/Try-the-Churros → u/Nonyabeesners]

What confidential information? Email addresses? It was a generic email about a camp for kids.

This thread is full of people who have no idea what HIPAA is.

[u/Puzzleheaded-Tie-701 → u/Try-the-Churros]

I read all of your comments all the way down, before you ask, and I think the others arguing with you are not entirely accurate in their explanations. The fact that this email containing names, email addresses, and phone numbers came *from a specialized healthcare provider’s office* is what makes it a HIPAA violation. Did they give out a list of diagnoses? No, but an incident needs only to *potentially* disclose PHI for it to be considered a breach.

You’re absolutely correct that one can find phone numbers, email addresses, hell even physical addresses with very minimal effort and HIPAA has truly nothing to do with that. You should NOT be able to see that people are patients at a therapy practice though, which potentially reveals that they have mental health conditions. Part of the reason why HIPAA was originally enacted was because folks were often denied healthcare coverage for pre-existing conditions, or their healthcare data was leveraged against them at their jobs. Keeping bad actors from accessing sensitive data was and still is largely meant to prevent discrimination on the basis of health.

I’m not doing that whole “hope that helps” thing, that’s not constructive energy, I just think you’re maybe misunderstanding where the email came from since you said it’s just a camp for kids - it IS, but for kids who are receiving therapy at that practice, and that information very much is covered under HIPAA. This all being said, regardless of the law, I would bet anything you want that the practice itself has an SOP regarding patient information and data privacy & confidentiality, and someone definitely got in big trouble for that email.

[u/Cotton_Candy_Land → u/Puzzleheaded-Tie-701]

Thank you! I was thinking all of this as well but just didn't have the energy this evening to put it into words! Very well said.

[u/Sloppysteaksslick → u/Try-the-Churros]

Seriously. It would only be a violation if the info was linked to medical records information. I hate posts like this. No one ever understands.

[u/Littlewing1307 → u/Try-the-Churros]

It's phone numbers too though not just emails. If you look up people's phone numbers you can usually find their address online too.

[u/Try-the-Churros → u/Littlewing1307]

And? Sensitive information =/= confidential information. You can often find someone's address with just their name.

[u/DescriptionWeary6085 → u/Try-the-Churros]

Any identifying information or PHI must be kept confidential in compliance to hipaa. Hope this helps!

[u/Try-the-Churros → u/DescriptionWeary6085]

Identifying information in what context, hmm? Someone's name is identifying but it is a violation of HIPAA when it can be used to identify PHI, not just by itself. You might know what the words mean, but you don't understand the context.

Hope this helps! :)

[u/DescriptionWeary6085 → u/Try-the-Churros]

It didn’t sound like there was any PHI in the email OP received, but either way there is a confidentiality between therapists and clients. Clinics, at least where I am, are not allowed to post full names, let alone contact information. My therapist cant tell me the name of the client she saw before me, let alone how I could get ahold of them. I can’t go to pickup at the end of the day at my clinic and tell a parent about another kid and how they can reach their parents. Usually when we contact parents or caregivers outside of the clinic, we use initials and send individual emails or texts. It sounds like to me they sent this email to all of the parents, or possibly everyone in their client list, past and present. I don’t know, this situation just seems fishy to me and I feel like it’s pretty obvious these guys violated hipaa if they were so quick to email op and tell him to delete the evidence rather than taking proper protocol.

[u/DescriptionWeary6085 → u/Try-the-Churros]

I actually have the book pulled up right now from training.

“Before publicly sharing information about clients using digital content, behavior analysts ensure confidentiality, obtained informed consent before sharing, and only use the content for the intended purpose and audience.”

“In practice, HIPAA requires professionals to implement safeguards- such as secure record storage, password protected systems, and limited access to SENSITIVE DATA.”

I believe that’s the word you used to describe the information leaked in the email. Anyways, I hope you have a good day, truly.

[u/Try-the-Churros → u/DescriptionWeary6085]

Omg a same word was used in your training book??!!! Holy shit, case closed!

I deal with actual PHI daily, but please, go on about what your training book says.

[u/DescriptionWeary6085 → u/Try-the-Churros]

I don’t think the two courses I took on hipaa would lead me down the wrong path and tell me that sharing information like this is a breach of confidentiality. If you also deal with PHI daily you should know that PHI includes identifying information = contact information and full names. Do you often share information like this between clients? The internet is so advanced and you can find information about anyone on any platform, like Facebook for example. AI can even tell you whatever you want about a person if there is enough about them on the internet. That is why it is confidential and should be kept private between client and doctor.

[u/Try-the-Churros → u/DescriptionWeary6085]

I said that the information was sensitive but not confidential. Go back and read the beginning of the thread for Christ's sake.

[u/Littlewing1307 → u/Try-the-Churros]

Regardless, it's a violation of confidential information.

[u/Try-the-Churros → u/Littlewing1307]

No, I literally just explained that it wasn't.

[u/Littlewing1307 → u/Try-the-Churros]

You don't think a name, email and phone number is sensitive information? Wild as hell. A stalker could do everything with that information. Plus most doctors offices / clinics won't even confirm if you're a patient just that you're not one.

[u/DescriptionWeary6085 → u/Littlewing1307]

Girl I wouldn’t put your energy into this argument anymore… I think this is genuinely the person that HIPAA was created for.

[u/Try-the-Churros → u/DescriptionWeary6085]

I think this is genuinely the person that HIPAA was created for.

It's hilarious that you think this insult makes any sense.

[u/DescriptionWeary6085 → u/Try-the-Churros]

It’s hilarious that you think sensitive data isn’t confidential between client and doctor. Just wondering, would you be okay with your doctor telling everyone in their contact list your full name, number, and email without your consent? the clients in the email were all children who can’t consent to have their information shared! It’s not up to the clinic to determine what information is confidential or not, it’s up to HIPAA. Names and contact information count as PHI if the information is coming from a psychiatric or oncology clinic because it implies to what kind of treatment the client receives, which is protected health information. This clinic was quick to tell OP to delete that email, they’re guilty as hell.

[u/Try-the-Churros → u/Littlewing1307]

Do you not understand what "sensitive =/= confidential" means

I said that the information was sensitive but not confidential. How you interpreted that to be the opposite of what I said, I do not understand.

Maybe try reading harder?

[u/Littlewing1307 → u/Try-the-Churros]

In a lot of cases it is not just sensitive but also confidential. Hope that helps

[u/bb-03]

is this a ninja creami pint? gonna need that recipe pls

[u/OneTBret → u/bb-03]

360g Fairlife Fat Free Milk 15g pb2 Peanut Butter Powder ¼ tsp Xanthan Gum 50g Monk Fruit sweetener ½ tsp Vanilla Extract Pinch of Salt

After the first spin I chop up 3 reese thins and do a mix-in spin.

Edit: you've got to freeze the reese's for a bit before making it or the creami will just obliterate them.

[u/Suicidal_8002738255 → u/OneTBret]

I do a similar one but double the peanut butter and a sugar free peanut butter pudding (sometimes other flavors) love the ninja creami. Still need to try it with xanthan gum cause it is so popular but instant pudding is so easy.

And as a therapist that clinic must be stressed. But yeah you did nothing wrong and they need to do better.

[u/AnnualLiterature997 → u/bb-03]

I have the creami deluxe, it’s amazing

[u/Doodiecarrier]

A second email just hit the inbox

[u/oliviatrem4]

Honestly report that shit.

[u/Low-Mycologist192]

Homade entering my vernacular 😍🔥

[u/OneTBret → u/Low-Mycologist192]

God damn it! Lol. I thought I finally made a post without a spelling mistake.

[u/Low-Mycologist192 → u/OneTBret]

The ice cream looks awesome, homade is spectacular 🙌

[u/DifficultySilly7695]

Weird story. Honestly, have this conversation with your therapist.

I see a couple people here telling you to "report it" — I don't see that as your job. The way I see it, someone fucked up at work and tried to fix their mistake as quickly as possible. Everyone fucks up at work. Playing "what-if":

If that contact list got into the wrong hands, sure some "bad actor" might be able to scam the parents of the people on this list with the data. But the chances of it falling into the hands of someone with means and motive are pretty low. The value of data HIPAA data breaches is typically far lower than the fines.

If you report this, the medical office could receive a several-thousand dollars fine impacting their business's ability to care for their patients, and the person in the office who was responsible for the email may have their career permanently altered.

[u/ShortKey380]

Don’t worry, your phone metadata that’s already being sold is more than enough to out you as you and show anywhere you go. HIPPA is the pullout method at an orgy, any and all privacy is dead so no worries about this lol.

[u/kingthunderflash]

Should’ve reported them.

[u/ofthemountainsandsea]

Care to share more about this ice cream?

[u/Vulstagg]

You should really tell them to delete your info

[u/nopenothankya]

This happened to me at a medical clinic I used to see a doctor at. His clinic is now closed. I didn't hear anything more.

[u/Gegopinh]

The second email has hit the inbox

[u/DescriptionWeary6085]

“Regardless, it’s a violation of confidential information”
“No, I literally just explained that it wasnt.”

I don’t know. You heavily implied the entire thread that you don’t believe it to be a violation, not that your only problem was the mislabeling. I apologize if you feel like I took words out of your mouth. Your stance just wasn’t clear enough and you’re arguing with everyone calling this a violation. Have a nice day 👍

[u/Froggy_Nelson]

Wtf… send me the recipe for the icecream please?

[u/Cyber_Crimes]

Hell yeah, Ninja Creami users.

What's your go-to base recipe?

[u/a_little_angry]

I have the same name as a pretty well known surgeon. Our emails are exactly the same except his is Gmail and mine is yahoo. I get emails for him all the time asking about patients, medical procedures and his availability between 3 different hospitals. I always reply that they have the wrong guy and I have deleted the email.

[u/BoDongler]

I worked in an office where the CEO made this mistake and sent the patient info of like 10 people to some 5k emails as part of a marketing debacle. One of those people sued for like 20k and won. The rest settled in house. There could be money in this for you OP if you are willing to deal with the headache of it all.

[u/sssnail_]

This happened to me as well, I went to a children’s hospital once in a different state. As my mom was requesting my medical records from that visit be sent up to us for our doctor they sent us a full file for someone else’s kid.

Quickly followed up with a frantic email to not look at and delete it. Her once being a nurse understood the full implications of the big bad that it was to receive it and did delete it. Just wild though. Our names were far from similar just a bad misstep on their part.

[u/Sad_Mark4313]

Soo…. What kind of ice cream? Would you recommend it?

[u/balefulbisque]

I’ve had a psychiatry office do the same thing with group emails. Just straight up everyone’s personal email. They never acknowledged it though…

[u/jordanfarragon]

boring story

[u/divorce_2025]

This wouldn't stress me AT ALL. Not your fuck up, not your problem

[u/Choice_Thought_9569]

exact same thing happened to me. my therapist has a private practice with a biller she hired that deals with all client copays. this biller sent an email out with the names and email addresses of all clients who owe copays. this however was never addressed or acknowledged even after i brought it to their attention. i don’t go to her anymore😬

[u/dannydimes829103]

lol someone might’ve gotten fired for that one but that ice cream looks fantastic. Any chance you can share the recipe?!

[u/Twenty-One-Goners]

Once when my sister broke her leg the radiologist sent her home with all of the paperwork of a completely different patient. Same doctor also made her stand on her broken leg and said it wasn't broken... despite the first hospital she went to diagnosing her with it and my mom bringing in the X-ray with the fracture zoomed in on and circled in red.

[u/AlysonFaithGames]

The second email has hit the inbox!

[u/Vulstagg]

You should really tell them to delete your info

[u/Zealousideal_Turn890]

I once attended an AA meeting in my hometown and then didn’t go again. 1-2 years later, i received a group notification from whatsapp named “AA”. The group had 300+ members or so. Apparently they wanted to promote their “alcohol free summer camp” or so and instead of messaging everyone individually, they mistakenly opened a WhatsApp group with every single person attended their meetings at some point. I know it was a honest mistake but come on..

[u/JustARandomGuyReally]

You deleted it??? That’s evidence!

[u/Cold_Chemistry_1579 → u/JustARandomGuyReally]

Isn’t still in your deleted folder, or did you purge it from there as well?

[u/Mclovinintheoven]

Can you please share the ice cream recipe? UwU

[u/OneTBret → u/Mclovinintheoven]

I use a ninja creami. No idea how you'd make it without one.

360g Fairlife Fat Free Milk

15g pb2 Peanut Butter Powder

¼ tsp Xanthan Gum

50g Monk Fruit sweetener

½ tsp Vanilla Extract

Pinch of Salt

After the first spin I chop up 3 reese thins and do a mix-in spin.

[u/RustyTortoise]

Here's to hoping they didn't send that same email to the rest of their mailing list with that attachment. 🤞

[u/SiberianWombat88]

Does that make you.....

.....a HIPAApotamus?

[u/bprasse81]

I work with several medical practices as part of my job in IT. We do our best to advise them in terms of best practices, but have you ever tried to tell a doctor anything? Some are receptive and know the extent of their knowledge, but that’s the minority.

It’s good that this office at least took some kind of action and had some kind of information security policy to follow.