California hospitals can escape fines if workers expose patient info

A California state appeals panel has agreed hospitals can’t be sued if one of their employees posts confidential patient health information online so long as there are appropriate policies in place attempting to prevent such an outcome, according to the report.

In 2016, an employee of the Resnick Neuropsychiatric Hospital of UCLA posted diagnoses of about 10 patients on Instagram in a partially redacted image; according to court records, another employee saw the post and reported it to a supervisor, and the worker who made the post ultimately lost his job. Following the incident, the California Department of Public Health ordered the Regents of the University of California to pay a $75,000 penalty for the data exposure and alleged privacy violations.

UCLA Health’s Office of Compliance Services investigated the matter, found no patient reported adverse consequences, and notified all employees of the duty to protect patient confidentiality; the CDPH gave Resnick an initial and amended Statement of Deficiencies and Plan of Correction, and the hospital complied on schedule. The fine was a per-patient penalty of $7,500.