OBGYN at Foxhall stole their list when she exited the practice and handed it to new employer

[Anonymous]

When she left, she sent an email. I thought it was unprofessional but didn’t think anything of it. I was not a patient but I think they billed under her based on your insurance coverage. When I got the letter I was shocked she shared the list with her new employer, especially given how high profile her husband is and the potential damage to both reputations. People do dumb stuff, even the hoity toity ones.

[Anonymous]

I don’t know. Even if we assume the worst, that she knowingly violated HIPAA (which I don’t assume) I still don’t see the actual harm to any of the patients violated, myself being one of them.

[Anonymous]

Anonymous wrote:She made a mistake, not her spouse.

I received the letter. I am satisfied with Foxhall’s handling of the matter.

Where was the “mistake”, PP?

[Anonymous]

Anonymous wrote:

Anonymous wrote:Demographic information without any accompanying health information is not protected under HIPAA. Whether she violated her employment or non-compete contract is another question that no one here can answer without a copy of that contract. But I’m guessing since she’s married to Eric Holder, she knows exactly what she can do under the terms of her contract.

https://www.hipaajournal.com/is-it-a-hipaa-violation-to-email-patient-names/

Patient names (first and last name or last name and initial) are one of the 18 identifiers classed as protected health information (PHI) in the HIPAA Privacy Rule.

*******

Patients names and other PHI should only be sent to individuals authorized to receive that information, so care must be taken to ensure the email is addressed correctly. Sending an email containing PHI to an incorrect recipient would be an unauthorized disclosure and a violation of HIPAA.

https://www.hipaajournal.com/considered-phi-hipaa/

Therefore, PHI includes health records, health histories, lab test results, and medical bills. Essentially, all health information is considered PHI when it includes individual HIPAA identifiers. Demographic information is also considered PHI under HIPAA Rules, as are many common identifiers such as patient names, Social Security numbers, Driver’s license numbers, insurance details, and birth dates, that when they are linked with health information become HIPAA identifiers.
The 18 HIPAA identifiers that make health information PHI are:
Names
Dates, except year
Telephone numbers
Geographic data
FAX numbers
Social Security numbers
Email addresses
Medical record numbers
Account numbers
Health plan beneficiary numbers
Certificate/license numbers
Vehicle identifiers and serial numbers including license plates
Web URLs
Device identifiers and serial numbers
Internet protocol addresses
Full face photos and comparable images
Biometric identifiers (i.e. retinal scan, fingerprints)
Any unique identifying number or code
One or more of these HIPAA identifiers turns health information into PHI, and PHI HIPAA Privacy Rule restrictions will then apply which limit uses and disclosures of the information. HIPAA covered entities and their business associates will also need to ensure appropriate technical, physical, and administrative safeguards are implemented to ensure the confidentiality, integrity, and availability of PHI as stipulated in the HIPAA Security Rule.

Thank you.

[Anonymous]

Anonymous wrote:She took each person’s name email and health insurance provider. The letter referenced HPPA in the opening paragraph.

Considering it is a HIPPA violation for practices to call for you in the waiting room or receptionists to call you to the desk as “first name last name,” yes, I’d say contact information is a HIPPA violation. It’s even a HIPPA violation to ask you to sign in as “first name last name” on a sign in sheet that they leave out for other patients to see.

What Dr. Malone did was a complete breech of privacy.

[Anonymous]

I'd be interested in joining a class action suit regarding this

[Anonymous]

Anonymous wrote:I'd be interested in joining a class action suit regarding this

Get an attorney to put out the word.

[Anonymous]

Can someone who received the letter from Foxhall summarize what it said? I got the email from Alloy and found it strange—I commented at the time to my husband that I assumed she had purchased the practice’s email list.

[Anonymous]

Anonymous wrote:

Anonymous wrote:

Anonymous wrote:Demographic information without any accompanying health information is not protected under HIPAA. Whether she violated her employment or non-compete contract is another question that no one here can answer without a copy of that contract. But I’m guessing since she’s married to Eric Holder, she knows exactly what she can do under the terms of her contract.

https://www.hipaajournal.com/is-it-a-hipaa-violation-to-email-patient-names/

Patient names (first and last name or last name and initial) are one of the 18 identifiers classed as protected health information (PHI) in the HIPAA Privacy Rule.

*******

Patients names and other PHI should only be sent to individuals authorized to receive that information, so care must be taken to ensure the email is addressed correctly. Sending an email containing PHI to an incorrect recipient would be an unauthorized disclosure and a violation of HIPAA.

https://www.hipaajournal.com/considered-phi-hipaa/

Therefore, PHI includes health records, health histories, lab test results, and medical bills. Essentially, all health information is considered PHI when it includes individual HIPAA identifiers. Demographic information is also considered PHI under HIPAA Rules, as are many common identifiers such as patient names, Social Security numbers, Driver’s license numbers, insurance details, and birth dates, that when they are linked with health information become HIPAA identifiers.
The 18 HIPAA identifiers that make health information PHI are:
Names
Dates, except year
Telephone numbers
Geographic data
FAX numbers
Social Security numbers
Email addresses
Medical record numbers
Account numbers
Health plan beneficiary numbers
Certificate/license numbers
Vehicle identifiers and serial numbers including license plates
Web URLs
Device identifiers and serial numbers
Internet protocol addresses
Full face photos and comparable images
Biometric identifiers (i.e. retinal scan, fingerprints)
Any unique identifying number or code
One or more of these HIPAA identifiers turns health information into PHI, and PHI HIPAA Privacy Rule restrictions will then apply which limit uses and disclosures of the information. HIPAA covered entities and their business associates will also need to ensure appropriate technical, physical, and administrative safeguards are implemented to ensure the confidentiality, integrity, and availability of PHI as stipulated in the HIPAA Security Rule.

Thank you.

Yes- thank you!

[Anonymous]

Anonymous wrote:What she did was unethical at best.

I don't know anyone who went to her the "loved her" her reviews were bad online. They seem to have disappeared. Not a surprise Yelp and google do that all the time.

I went to her and thought she was terrific. Really taken aback by this. I have not gotten a letter.

[Anonymous]

Anonymous wrote:I don’t know. Even if we assume the worst, that she knowingly violated HIPAA (which I don’t assume) I still don’t see the actual harm to any of the patients violated, myself being one of them.

It’s unethical to knowingly take patient information for personal gain and profit. There’s clear regulations around this that she violated.

Just compare this with one of the GW OBGYN threads where women are asking which doctors are leaving…where are they going… doctors can possibly tell patients one on one if they leave for a new practice but not a big solicitation email blast like this.

[Anonymous]

She seems to believe she’s above the law.

[Anonymous]

Anonymous wrote:I don’t know. Even if we assume the worst, that she knowingly violated HIPAA (which I don’t assume) I still don’t see the actual harm to any of the patients violated, myself being one of them.

This is not like signing up for the pottery barn website and getting all of their other catalogs.
Think about it this way -
You shared your personal information with a Drs practice so they can support you. You disclose private information so that they can provide the best care.
You share with the expectation that the drs are not selling the list to another company. Well this is in essence what she did. She knew when she was taking the information. Drs are fully aware that they do not take this information when they leave a practice - it is not some nuanced thing.

[Anonymous]

Anonymous wrote:I don’t know. Even if we assume the worst, that she knowingly violated HIPAA (which I don’t assume) I still don’t see the actual harm to any of the patients violated, myself being one of them.

That's not how law works.

[Anonymous]

Anonymous wrote:

Anonymous wrote:I dunno. If I have a doctor, my relationship is with them, not the firm. I appreciate knowing where they land.

+1 That’s how it works for lawyers.

She should send out a letter to clients *before* she leaves, telling them where she is going.

Also, *her* clients, not the whole practice’s list.

There are ways to do this properly. Stealing data is not it.