Consider the following scenario: Staff at Community Hospital, a 200-bed facility, have recently been busy with HIPAA Privacy Rule issues. Community Hospital is regularly surveyed by the city safety department for compliance with local codes related to issues such as fire and water safety. Community Hospital’s privacy officer has issued an unsigned business associate agreement to the department of health, instructing the chief of its survey office to sign it because its surveyors, who may come into contact with Community Hospital’s PHI, function as business associates. Recently, the hospital’s emergency room staff have informed the privacy officer that patients’ family members have been bringing cameras into the emergency room to photograph treatment as it is occurring. The privacy officer instructs emergency room staff to log the names of individuals who are taking the pictures. He then sends letters to the family members, notifying them that they have committed a HIPAA violation and their names may be turned over to the Office for Civil Rights for investigation. Elderly patients are frequently discharged from the hospital to local nursing homes for skilled rehabilitation following orthopedic issues such as hip fractures and many types of surgeries. Staff on the units from which patients have been discharged have routinely copied the entire patient chart to accompany the patient to the nursing home, but the privacy officer informed them that this is a violation of the HIPAA Privacy Rule. Identify the HIPAA Privacy Rule concept that is at issue in each paragraph of this scenario.

Has Community Hospital’s privacy officer correctly interpreted the Privacy Rule requirements in each situation?

For each, analyze and explain why or why not.