New Jersey psychiatry practice pays $30,000 to settle complaint about impermissible disclosure of protected wellness data by disclosing this data in on line assessment

Currently, the U.S. Division of Wellness and Human Solutions (HHS), Workplace for Civil Rights (OCR) announces a settlement with Manasa Wellness Center, LLC, a wellness care provider in New Jersey that gives adult and kid psychiatric solutions. The settlement resolves a complaint received by OCR in April 2020, alleging that Manasa Wellness Center impermissibly disclosed the protected wellness data of a patient when the entity posted a response to the patient’s adverse on line assessment. Following an OCR investigation, prospective violations of the Wellness Insurance coverage Portability and Accountability Act (HIPAA) Privacy Rule incorporate impermissible disclosures of patient protected wellness data in response to adverse on line evaluations, and failure to implement policies and procedures with respect to protected wellness data. Manasa Wellness Center paid $30,000 to OCR and agreed to implement a corrective action program to resolve these prospective violations.  

“OCR continues to get complaints about wellness care providers disclosing their patients’ protected wellness data on social media or on the net in response to adverse evaluations. Just place, this is not permitted,” stated OCR Director Melanie Fontes Rainer. “The HIPAA Privacy Rule expressly protects individuals from this variety of activity, which is a clear violation of each patient trust and the law. OCR will investigate and take action when we discover of such impermissible disclosures, no matter how massive or little the organization.”

OCR opened an investigation in response to a complaint by a patient alleging that Manasa Wellness Center posted a response to the patient’s adverse on line assessment that incorporated distinct data relating to the individual’s diagnosis and remedy of their mental wellness situation. In addition to the patient who filed the complaint, OCR’s investigation identified that Manasa Wellness Center impermissibly disclosed the protected wellness data of 3 other individuals in response to their adverse on line evaluations. OCR’s investigation also identified that Manasa Wellness Center failed to implement HIPAA Privacy policies and procedures.

In addition to the monetary settlement, Manasa Wellness Center will undertake a corrective action program that will be monitored for two years by OCR to guarantee compliance with the HIPAA Privacy Rule. The corrective action program incorporates the following methods:

• Create, retain, and revise its written policies and procedures to comply with the HIPAA Privacy Rule,
• Train all members of Manasa Wellness Center’s workforce, such as owners and managers, on the organization’s policies and procedures to comply with the HIPAA Privacy and Safety Guidelines,
• Inside 30 calendar days of the agreement, Manasa Wellness Center shall concern breach notices to all folks, or their individual representatives, whose protected wellness data is disclosed on any net platform with no a valid authorization, and
• Inside 30 calendar days of the agreement, Manasa Wellness Center shall submit a breach report to HHS regarding folks whose protected wellness data is disclosed on any net platform with no a valid authorization.

The resolution agreement and corrective action program may well be identified at: https://www.hhs.gov/hipaa/for-experts/compliance-enforcement/agreements/manasa-ra-cap/index.html

OCR is committed to enforcing the HIPAA Guidelines that safeguard the privacy and safety of peoples’ wellness data. If you think that your or a different person’s wellness data privacy or civil rights have been violated, you can file a complaint with OCR at: https://www.hhs.gov/ocr/complaints/index.html.