Dear ReWorker,
A patient has accused one of our employees of a HIPAA violation. The patient says the employee looked up her medical records and shared the information with her neighbor. We are, of course, conducting an investigation, but this is our first HIPAA investigation, so we're not sure what to do while it occurs.
Should the employee be suspended while we investigate? Should we withhold her patient access? Should she be paid? Naturally, if we find that she did do this, she'll be fired. But, what if she didn't? Do we apologize? And what do we do about the patient who accused her in the first place?
Sincerely,
Under Investigation
++++
Dear Under Investigation,
HIPAA violations are serious, and in the news: Fifty hospital employees were just terminated after inappropriately accessing a patient's medical records. It's important that you are investigating this. You never want to jump to conclusions in these situations—as anyone who works with other humans knows, not every complaint against an employee is a valid one.
Whether it's a HIPAA violation, an accusation of sexual harassment or you think an employee has stolen from the petty cash box, you investigate, and figure out the repercussions later. It's perfectly normal, however, to ask yourself what to do with the employee in the meantime.
Because this is a fireable offense (although not all HIPAA violations have to result in termination), a temporary suspension seems like the best thing to do. You certainly don't want someone untrustworthy with access to patient records. Even if you put her into a position where there is no patient access, which seems difficult in a medical office, she'll inevitably still see some patient interactions or overhear conversations in the office, which is problematic.
As for pay during suspensions, a good rule of thumb is to withhold payment. Then, if the person is cleared, you pay them for the days they missed. But, if the person is found guilty, the days remain unpaid. Normally you can't deduct pay from a salaried, exempt employee, but a suspension is an exception to that rule. Meanwhile, someone who is non-exempt only has to be paid for actual hours worked.
That leaves the matter of the patient, and what to do with her if it turns out that your employee is innocent. Well, it depends. Was she simply mistaken or was this a vicious attempt to get the employee fired? A mistake is cleared up easily. A deliberate lie, on the other hand, means you wouldn't want this person as a patient—or a customer.
The Aftermath
If the employee is ultimately cleared, you should apologize for any potential misunderstandings on behalf of the patient, but not for suspending and investigating her. These things are serious and you are obligated to follow the law, so even if she is proven innocent, you did the right thing. Make sure everyone knows she was cleared and don't hold the investigation against her in the future.
The rule is to always investigate promptly and fairly, and use suspensions when the outcome could be serious.
Your ReWorker,
