HHS Office for Civil Rights Settles with Holy Redeemer Hospital Over Disclosure of Patient’s Protected Health Information, Including Reproductive Health Information

Settlement emphasizes the need to ensure the privacy of PHI, including reproductive health information

Today, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a settlement with Holy Redeemer Family Medicine (Holy Redeemer), a Pennsylvania hospital, concerning an alleged violation of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule due to an impermissible disclosure of a female patient’s protected health information, including information related to reproductive health care. OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules, which set forth the requirements that covered entities (health plans, health care clearinghouses, and most health care providers) and business associates must follow relating to the privacy and security of protected health information. The HIPAA Privacy Rule establishes national standards to protect individuals’ medical records, requires appropriate safeguards to protect the privacy of protected health information and sets limits and conditions on the uses and disclosures that may be made of such information without an individual’s authorization, (such as disclosures for health oversight activities or for law enforcement purposes), and gives individuals rights such as the ability to access their own medical records.

“It is imperative that health care providers take their duty to protect patient privacy seriously and follow the law,” said OCR Director Melanie Fontes Rainer. “Patients must be able to trust that sensitive, health information in their files is protected to preserve their trust in the patient-doctor relationship and ensure they get the care they need. This is particularly true for reproductive health privacy.”

In September of 2023, OCR received a complaint alleging that Holy Redeemer impermissibly disclosed a female patient’s protected health information to the patient’s prospective employer, including her surgical history, gynecological history, obstetric history, and other sensitive health information concerning reproductive health care. OCR’s investigation found that Holy Redeemer disclosed the patient’s full medical record, including protected health information concerning her reproductive health care, that it did not have the patient’s authorization for the broad disclosure of her protected health information, and that there otherwise was no applicable requirement or permission under the Privacy Rule for such a broad release of her medical records.  The complainant stated that she had requested that Holy Redeemer send one specific test result, unrelated to her reproductive health, to a prospective employer.

Under the terms of the resolution agreement, Holy Redeemer paid $35,581 and agreed to implement a corrective action plan that identifies specific steps it will take to comply with the HIPAA Rules and protect patient privacy to prevent this from happening again. OCR will monitor the implementation of this corrective action plan for two years:

• Submit a breach notification report to HHS regarding this incident;
• Review, develop or revise its policies and procedures to ensure compliance with the Privacy Rule, and submit all such policies and procedures to HHS for approval;
• Distribute all HHS-approved policies and procedures to its workforce and ensure that each member of the workforce certifies receipt and understanding of the policies and procedures;
• Train all members of its workforce on its HHS-approved policies and procedures, including all workforce members of its affiliated entities;
• Within 120 days after HHS approval of Holy Redeemers policies and procedures, Holy Redeemer must submit a written report to HHS detailing the status of its implementation of the corrective action plan;
• Provide a report to OCR regarding any non-compliance with its policies and procedures by any members of its workforce;
• Provide annual reports to OCR regarding Holy Redeemer’s compliance with the corrective action plan.

The resolution agreement and corrective action plan may be found at: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/holy-redeemer-hospital-ra-cap/index.html.

OCR is committed to ensuring the privacy of lawful reproductive health care. Please see OCR’s 2024 final rule on HIPAA Privacy Rule to Support Reproductive Health Care Privacy for more information.

OCR enforces the HIPAA Rules that protect the privacy and security of peoples’ health information. Guidance about the Privacy Rule, Security Rule, and Breach Notification Rule can also be found on OCR’s website.

If you believe that your or another person’s health information privacy or civil rights have been violated, you can file a complaint with OCR at: https://www.hhs.gov/ocr/complaints/index.html.

Follow HHS OCR on X (formerly Twitter) at @HHSOCR.