How an EOB from our insurance company addressed solely to my husband disclosing all the details of our adult children's and my visits isn't a violation of HIPAA? Because it feels pretty violating. I've been hiding them from him but I don't know how long I can do that. He's not a great person and he simply does not need access to this information because he will use it to hurt people.

There seems to be a big misconception, that my software is competing with consultants.

That's really not what I'm trying to do. If anything, I think consultants could be some of the people who benefit from it the most. A consultant might be working with several organizations at once, reviewing policies, analyzing documents, investigating incidents and keeping track of recommendations and follow-ups.

And so much of that takes time. The whole point of my platform is to speed up that work, whether that's analyzing documents, getting compliance guidance or managing investigations, so consultants can spend less time on repetitive tasks and more time actually helping their clients.

I've had some really positive feedback from people working in healthcare and compliance, particularly around how much manual work could be reduced.

But I still think there's still some skepticism regarding AI in compliance, people somehow think its replacing the people doing the job. Personally, I see it as giving those people the ability to do more, potentially take on more clients and grow their own businesses.

Also interested in speaking with consultants who are currently managing compliance work across multiple clients. Id be keen to hear which parts of the process take up the most time and whether tools like this could help

One I have no provider/patient relationship with, but I do have a personal relationship with them (went to HS with them 30+ years ago, socialized with them at reunions, Facebook friends, etc). What is the best way for me as a patient to respond to this?

If it matters, they are now showing in my Upcoming Appointments section for an appt in November and one in December, but they are not my provider at this practice (I didn't even know they worked for a different office for this company). I do have an appointment with my provider, tomorrow, which is why I was looking at that section of my online account.

Thanks!

We build software for healthcare teams, so we end up seeing how a lot of small practices actually run day to day. The EHR is almost never the problem. It's everything that grew up around it.

The stuff we keep running into:

1. Vendors nobody signed a BAA with. Someone signs up for a scheduling or reminder tool to save time, and a year later it's full of patient data. Lately it's AI note takers.
2. Shared logins. Three people on one front desk account means you can't tell who looked at what. HIPAA expects unique user IDs, and this one comes up in audits.
3. People who left but still have access. Portals, billing, the shared drive. Offboarding usually covers the EHR and stops there.
4. PHI sitting in email and texts. Lab results sent from a personal phone, an error alert with a patient's name in it, a spreadsheet export in a shared folder. Those copies live outside every control you've set up.
5. Audit logs nobody reads. Most systems keep them. Almost nobody looks unless something already went wrong.
6. A risk analysis from years ago. It's required, and an outdated one is one of the most common problems OCR cites. Every time you add a tool, it should get updated.

None of this needs a big budget. A vendor list with BAA status, an offboarding checklist, named accounts, and someone checking access once a month covers most of it.

We're not attorneys, so run specifics by your compliance person.

If you manage compliance for a small practice, which of these has been the hardest to actually fix?

Hi everyone, I think what just happened to me was a HIPAA violation although I’m not sure how to go about addressing it and ensuring it doesn’t happen again.

For context I haven’t spoken to my mother in over 10 years. It ended with policed being involved and advising her not to contact me. I moved away from her across state lines 10 years ago and have successfully cut off contact after tremendous effort due to keeping an extremely low profile and private life.

Now on to the situation: about a year ago, I went to see my primary care doctor and they had a new space within their office that did bloodwork onsite, so I didn’t have to go get it elsewhere. I proceeded to get blood work done while at appointment. I guess I was under the impression that the service was included in the co-pay I had already paid when I checked-in as I never received a bill and I didn’t realize it was a separate business (labcorp). I realize now that that was stupid of me to assume but I just didn’t think about it, I have good insurance. (Also I’ve worked very hard to be debt-free a few years ago and check my credit score every month and this bill hasn’t shown up).

Fast forward to this week, apparently Lapcorp never billed my insurance and sent a bill of almost $1,000 to collections. No one called me and instead a collections agency called my estranged mother this week for some reason. They gave her my first and last name, which led to her being able to figure out that I have since been married and who my husband is. She has not contacted me directly, but has already contacted my husbands family, my work, and my other family members, and has made multiple social media posts (of course she is embellishing by claiming I’m in trouble with thousands of dollars of debt and is ‘just trying to help’)

Needless to say, I am experiencing my worst nightmare. I panicked and paid the bill immediately and will try to sort out what happened with my insurance. I asked the collections agency how they got my mom’s number and they told me that they received it from labcorp and gave me their contact info. Labcorp claims they don’t have that phone number on file had no idea where the collections agency could have gotten it. After further back and forth said they must have received it from my primary care doctors office. (I also called my doctors office and confirmed they only have my number on file). Ultimately they were VERY unsympathetic about the situation and blamed the collections agency and then my drs office. At one point they even said I could have avoided the situation if I had paid my bill (but again I didn’t know about the bill!!!!!)

Questions
- Did the collections agency commit Hipaa by contacting and giving my new name to my mother?

- How do I go about ensuring none of these places contact my mother in the future and remove this phone # from their file? Labcorp and my doctors claim they don’t have her contact info on file but it had to have come from somewhere - they are uninterested in getting to the bottom of it, so I feel like they will need to be compelled to do so. I just really can’t go through all of this again.

Edit to add context: I’m currently 35 years old, so not a minor. I also am not, nor have I ever been covered under her insurance.