Hipaa Whistleblower Rights and Safe Harbors Explained

As a HIPAA whistleblower, you have the right to report concerns about HIPAA violations without fear of retaliation. This right is protected under the law.

The HIPAA whistleblower protection program is enforced by the Office for Civil Rights (OCR), which investigates complaints and takes action against covered entities that retaliate against whistleblowers.

If you're a HIPAA whistleblower, you're entitled to safe harbors, which shield you from retaliation and protect your job.

For your interest: Ubs Whistleblower

Under the False Claims Act, courts require whistleblowers to provide specific examples of bills paid by the government that have been affected by fraud.

Courts need these examples to determine the extent of the fraud, and whistleblowers must use information covered by HIPAA to specify the false health claims submitted.

Whistleblowers must be careful when gathering evidence, as privilege and other considerations provide modest limits on their right to do so.

To gather evidence, whistleblowers need to be careful when copying documents or recording conversations to support allegations.

Whistleblowers must also be mindful of documents that contain HIPAA-protected PHI, which require special care.

De-identification and whistleblower safe harbors are critical for potential whistleblowers dealing with patient-identifying information.

These safe harbors can help whistleblowers navigate the complexities of HIPAA and protect patient confidentiality.

HIPAA provides protection for whistleblowers who report wrongdoing, but there are consequences for those who mishandle protected information. Whistleblowers are protected from retaliation under the Whistleblower Protection Act of 1989 and the Military Whistleblower Protection Act.

To be protected, a whistleblower must make a disclosure to an authorized recipient, such as the OIG Hotline, and the disclosure must be based on a reasonable belief that wrongdoing has occurred. The whistleblower safe harbor at 45 C.F.R. § 164.502(j) protects disclosures of HIPAA-protected material to a whistleblower's attorney and the government, so long as the whistleblower believes in good faith that their employer has engaged in unlawful or dangerous practices.

Whistleblowers who mishandle protected information risk serious trouble. For example, a California court ordered a whistleblower to return documents and notes containing HIPAA-protected information, and a Florida Magistrate Judge recommended sanctions for a relator and their counsel who attached PHI to a complaint.

Worth a look: Hipaa Employee Confidentiality Agreement

HIPAA contains important safe-harbors designed to permit vital whistleblower activities. These safe harbors protect whistleblowers from HIPAA penalties when they report allegations of fraud to the government. Whistleblowers and their attorneys are not relieved of the obligation to safeguard patient confidentiality, but they can use these safe harbors to share HIPAA-protected information with their attorneys and the government.

To qualify for whistleblower safe harbor, the disclosure must be made in good faith, and the whistleblower must believe that their employer has engaged in conduct that is unlawful or otherwise violates professional or clinical standards. This safe harbor also protects disclosures that believe patient care, services, or conditions potentially endanger one or more patients, workers, or the public.

Whistleblowers can use a method that removes underlying information from electronic documents when redacting PHI. This can be done using software such as Adobe Acrobat, Nuance Power PDF Advanced, or PDF Expert. Simply placing a black bar over the words is not enough; the underlying text must be deleted.

Take a look at this: Which of the following Is Not a Purpose of Hipaa

Here are the safe harbors for HIPAA whistleblower reporting:

These safe harbors can work in concert to protect whistleblowers from HIPAA penalties. In a case regarding pharmacy overcharging for prescriptions, the relator's complaint provided 18 specific examples needed to meet the particularity requirements of Federal Rule 9(b). The defendant claimed that the examples in the complaint violated HIPAA, but the Court found that because the relator had used initials to describe the patients, he had complied with the de-identification safe harbor and even if he had given all the details to his attorneys, his disclosure was protected under the whistleblower safe harbor.

Courts have been known to punish whistleblowers for perceived carelessness with HIPAA-protected information.

In California, a court ordered a whistleblower to return all documents and notes containing HIPAA-protected information to the defendant. This was the result of a case where the whistleblower obtained and shared documents with their attorney that contained PHI.

A Magistrate Judge in Florida recommended sanctions for a relator and their counsel who attached PHI to a complaint. This led to the defendant having to notify patients that their identifying information had been released.

Whistleblowers must be careful to follow HIPAA's safe harbors to avoid trouble.