Jordan said:
@Tilden
If it’s a small practice and they outsource IT stuff, it’s very possible those controls are not in place.
If those controls are not in place, it’s not HIPAA compliant. If the complaint is made by OP to OCR, they’ll be asked to show evidence. If there’s no positive or negative evidence, that’s a violation in and of itself.
It’s not their word against yours if they accessed your record electronically; it would easily be traceable. So you have proof. File a formal HIPAA complaint.
Cory said:
It’s not their word against yours if they accessed your record electronically; it would easily be traceable. So you have proof. File a formal HIPAA complaint.
Assuming you’re in the USA:
https://www.hhs.gov/hipaa/filing-a-complaint/index.html
Also, for future reference, never tell your employers that you’re going to pop positive on a drug test.
If you pop positive, the drug testing company will contact you for your medical records. Assuming you have a legitimate medical reason for popping positive, you will pass your drug screening. Your employer will receive a report that you have passed your drug screening. Your medical information is none of their business.
@Cairo
I definitely don’t plan on doing so ever again.
Sadly, they aren’t using a third-party vendor to do their drug screen. They allowed my colleague and I to start, work for an entire week, and then ask us to provide a urine specimen for them to send out to LabCorp for a drug test.
@Jesse
Um, they handled your specimen? You should have gone to a lab and had them take your sample. Yikes, this private practice is breaking a lot of rules/laws.
James said:
@Jesse
Um, they handled your specimen? You should have gone to a lab and had them take your sample. Yikes, this private practice is breaking a lot of rules/laws.
Yeah, this is a pretty big red flag chain of custody wise. This place sounds like a real mess.
@Jesse
I don’t understand, are they running your U-tox as if you were a patient?
Chain of custody is a big deal for a pre-employment drug screening, and whatever you just described isn’t at all how that works.
It sounds like amateur hour over there.
@Jesse
LabCorp, even if you process the sample correctly by providing it at one of their locations, does not accept any information about prescription medications at the time the sample is submitted.
They only collect patient contact information alongside employer contact information. If something tests positive, they call the patient first to ask if there is a medical reason for the positive result. If you are able to provide evidence of a prescription, then they report back to the employer that the tests came up clean.
At no point in time does the employer or the sample collection point need to be informed of any prescriptions you are taking.
@Kellen
But they provide the lab results to the employer, right?
Kennedy said:
@Kellen
But they provide the lab results to the employer, right?
They do not, at least not in explicit detail.
They tell the employer pass/fail with respect to each controlled substance the employer is testing for. If you test positive for a controlled substance but have a prescription for it, they report “pass” for that substance back to the employer.
There is no way for an employer to know if you have tested positive or negative for any individual substance; only whether you passed or failed, with passes meaning either a negative test or a justified positive.
Depending on the configuration for the testing ordered by the employer, it can even be as simple as a single pass/fail that is reported back to them without details on what item specifically was failed (that information would be retained by the testing company and available to the patient, however, in addition to their call upon receiving a positive result to check for prescriptions that would justify it).
If they accessed them through an electronic medical record system, there will be an electronic record tracking what they did. It’s worth reporting this.
Obviously, I was pretty shocked to hear this but I really need this job.
What is your desired outcome?
Obviously, I was pretty shocked to hear this but I really need this job.
What is your desired outcome?
I’m not 100% sure. All I know at this current moment is that it bothered me that they didn’t just wait for the note that I was in the process of getting for them.
I definitely think it’s probably a good idea to continue to look for other positions while I’m employed at this particular office.
@Jesse
Beyond reporting the HIPAA violation, there doesn’t seem to be a clear legal issue here.
@Jesse
That is not how drug testing works. Your information is private; you consented to a drug screening. The drug screening is private, a licensed MRO (Medical Review Officer) is contracted to review the drug screening results. Just because you are on prescribed medications does not preclude your employment (if you are taking a narcotic that may put you in a situation where you could not drive, the MRO will contact you to see if you indeed are prescribed said drug. He is then allowed to report a “positive result”; he is NOT allowed to disclose the prescribed narcotic. That is a HIPAA violation. If your employer circumvents any of these steps, he has violated your HIPAA rights. Get a lawyer.
@Teo
If you are prescribed a controlled substance and provide proof of the RX to the MRO, it is actually turned over as a negative result to your employer and not a positive result. 
@Teo
Why would you get a lawyer? There is no private right to sue for a HIPAA violation. No money means no lawyer.
@Teo
HIPAA doesn’t have a private right of action. And the drug testing company definitely tells you what the test was positive for.
@Jesse
You should probably loop their licensing body in on this. You can’t do anything about the HIPAA violations, but they can.
How was the other owner able to access your medical records without your consent?