Q&A: Treating employees

Q. A clinic employee is being seen as a patient of the clinic for additional vaccinations. The medical assistant rooming the patient wants to review the vaccination history. Is this a HIPAA violation?

A. It is not a HIPAA violation if the medical assistant has a valid reason to review the vaccination history. The medical assistant might wish to review the patient’s vaccination history with the patient to make sure the record is accurate. If the medical assistant is reviewing the vaccination record to determine if there are any other gaps in the vaccination history so that the patient might be offered additional vaccinations, that is also permissible. In the end, it comes down to adhering to role-based access requirements. The medical assistant can only have access to the records, or portions of records, needed to perform his or her job. Audit log monitoring should occur to make sure staff are not accessing records that are not necessary to perform their job duties.

Editor’s note: This question was answered by Chris Apgar. Apgar is president of Apgar & Associates, LLC, in Portland, Oregon. He is also a Briefings on HIPAA editorial advisory board member. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Opinions expressed are that of the author and do not represent HCPro or ACDIS. Email your HIPAA questions to Editor Nicole Votta at nvotta@hcpro.com.