Hipaa Question

Location: Connecticut

A month ago, I was taken to the emergency room because of concerns that I was drugged at a party. My family usually uses the hospital my sister works in as it is one of the better hospitals in the area. My sister was working that evening and she had to access my chart in accordance with her job which I had no issues with. It was about 3am and she was the only one working in her position. She isn’t a nurse or a provider, she does medication reconciliations. I was unconscious when I arrived, her position requires that she verify and inform my provider which medications are prescribed to me that may have caused or continued to my condition. I was not able to verify this information myself as I was not conscious upon arrival.

My sister is now being investigated at her job because she accessed my chart while I was there being treated. Her human resources department has now called her in to be interrogated twice and told her they still are not sure their “investigation” is completed. She recorded these meetings because she recently filed for FMLA herself and her employer has behaved in a way that seemed retaliatory multiple times even before this incident. In the recordings, they admit that she had only accessed my chart twice within a 20 minute span when I first arrived and then did not access it again. Her boss, who is a pharmacist, verified in the first meeting that employees are allowed to access their family’s charts as long as it is within the scope of their work, and since I was a patient in the emergency room where she was working and my chart was only accessed while I was there being treated, she did not break HIPAA. My mother was also seen in the emergency room while she was working and was then admitted for several days last year, she had also accessed her chart but there was no investigation then since they knew my mother had been seen in the emergency room and her access was during that timeframe.

They called her into another meeting yesterday despite nothing changing since the last meeting. They asked the same questions as they asked in the first meeting, but in a far more accusatory manner. Her answers had obviously not changed. They stated again that she had only accessed my chart twice within 20 minutes then did not access it again. Her shift ended before I was discharged. Her manager confirmed again that she hadn’t done anything that violated HIPAA. The HR representatives however, based on their own statements, had accessed my chart MANY times since my visit. They stated that they had gone through all the “notes” on my account, my medication history, my entire visit summary, previous visit summaries, and whatever else is in my chart. They also sent it to her boss. She asked if she was going to be called in again, even after if has been confirmed since the first meeting that she hadn’t done anything wrong, and they said they needed to “do more research” so they could not answer. This means continuing to access my chart and all the information in it for basically however long they want to. Again, this is all recorded so I know that she had not done anything inappropriate.

I am not at ALL comfortable with this. The reason for my visit was very personal, they are not medical professionals, they were not involved in my care nor have I ever met or spoken to them, and my chart is continuously being accessed and examined over a month since my visit by them, her manager, and whoever else, and by their own statements, they will continue to do so for pretty much as long as they want. This means that they will have access to any new care or prescriptions I receive/d since my hospital visit. If she had accessed my chart improperly, I would be just as upset, but she didn’t. Is her job allowed to access and share my chart and all the information in it, despite not having any involvement with my care, for as long/as many times as they want? I am not understanding how them doing this is somehow appropriate under HIPAA but her accessing my chart for the couple minutes it took to verify what medications I may have taken, while I was being treated in the emergency room she was working in, is still being “investigated” over a month after my visit, even though her manager, a licensed pharmacist, has already determined that she has not done anything inappropriate nor did any of this happen when she accessed our mother’s chart in the exact same manner last year?

I feel like they are violating my privacy FAR more than my sister could possibly have done in the few minutes she was in my chart to verify my medications during my visit and has not accessed it again since. I have never consented for them to have access to my chart and I definitely did not consent for them to have full, unrestricted access to it and to access and share everything it contains for however long they want? Is there anything I can do to get them to stop? I have a procedure this week that has nothing to do with my hospital visit last month. Since they say “still investigating” they will have access to all the information from this visit too. Is all this appropriate? Is it legal under HIPAA for HR (and whoever HR chooses to share with) at my sister’s job to have permanent, unrestricted access to my medical information? Do family members of individuals who work in healthcare have less privacy than people who don’t? I don’t know much about her situation at work other than that she has been under the microscope and has already been having issues with her employer seemingly trying to find any reason to fire her since she filed for FMLA (which she is still on, she is on intermittent FMLA) and I don’t want to be a pawn in their quest to invent a reason to fire her, but I am more concerned with my privacy being significantly and continuously violated and will continue being violated in the process. I am a patient, same as any other patient, and I feel like I deserve the same privacy as anyone else.