Are complaints to hospital administration PHI under HIPAA&#39;s Privacy Rule
<p>Paul has heart surgery. While he's recovering, staff is constantly distracted by their phones and fails to check in on him at required intervals, administer medication on time, and provide medically recommended therapy.</p>
<p>Before he checks out, Paul sees that the hospital's website has a form for making a complaint to hospital administration. Paul fills it out and notes all the information above.</p>
<p>The hospital's CEO reads the form, disciplines all the staff identified, and takes no further action with it.</p>
<p>To what extent is the form covered by HIPAA's Privacy Rule?</p>
<p>I'm looking for answers supported by law addressing similar facts.</p>

<p>PHI is health information that is individually identifiable. Any record, even a post-it note, can be PHI.</p>
<p>In this case, the complaint form is PHI if it contains the patient's name or other identifier along with the details of treatment.</p>
<p>When PHI is held by a covered entity, including the hospital CEO, it is protected by HIPAA privacy regulations.</p>

united-states privacy hipaa