About Us Alliances News Education Resources
New Account?  Forgot Password?     


Media Releases

HIPAA: Hospital fined for immigrant disclosure
Memorial Hermann Health System in Houston will pay a $2.4 million fine to U.S. Health and Human Services for revealing the name of a patient who was arrested, even though her identity became public through police records.

According to the Houston Chronicle, the incident began when a 44-year-old woman from Mexico who had been living in the United States illegally for more than a decade, presented a fake Texas driver's license when she checked in for an appointment at one of the hospital’s clinics. Office staff alerted authorities who arrested the woman, taking her away in handcuffs in front of her two daughters.

HHS began to investigate after news accounts reported the incident as a possible violation of the woman’s patient-privacy rights. The agency ultimately concluded that the disclosure of her identity to law enforcement officials was allowed under HIPAA.

But the health system got into trouble when in the days following the incident, as Memorial Hermann administrators sought to assuage local protestors, the health system included the illegal immigrant’s name, without her consent, in a news release defending its actions.

Between September 15 and 19, 2015, Memorial Hermann disclosed the patient's name through press releases issued to 15 media outlets and reporters. HHS said senior hospital executives also disclosed the patient's protected information to an advocacy group, state representatives, a state senator, and on its website.

The agency says senior management should have known that disclosing a patient’s name on the title of a press release was a clear HIPAA Privacy violation. “This case reminds us that organizations can readily cooperate with law enforcement without violating HIPAA, but that they must nevertheless continue to protect patient privacy when making statements to the public and elsewhere,” the agency said.