The U.S. Department of Health and Human Services (HHS) determined that the program director at DePoo Chemical Dependency Facility in Key West, Fla., violated HIPAA, according to a story posted on Keynoter.com. DePoo is a 49-bed unit operated by Lower Keys Medical Center (LKMC).

According to findings by HHS based on an anonymous complaint, the program director allowed her significant other (also a facility employee) onto DePoo's locked unit on more than one occasion. The report also indicated that the unauthorized employee was "often" in the dayroom with patients, and in the nurse's station.

HHS found that "a HIPAA violation had occurred," namely, the program director failed "to demonstrate appropriate care in handling confidential information that resulted in accidental access or accidental access due to lack of awareness or education."

The program director "received a written warning, which was placed in the employee files. In addition, [she] was required to receive training on specific HIPAA policies and procedures relative to the violation."

Hospital CEO Nicki Will, in a prepared statement e-mailed to Keynoter, wrote: "Upon receiving such information, LKMC administration conducted an in-depth investigation of all facts relevant to the potential violation...[which] showed that there had actually been no disclosure of protected health information to anyone.

"However...there had been an isolated incident whereby there existed the potential for such a disclosure, even though no such actual disclosure took place. This situation involved the presence of an individual in a place where [private information] was stored, and might have been sighted. Under HIPAA regulations, the 'potential' for such disclosure can constitute a violation, even where there is no actual communication of [personal information]. That is what happened here. No protected health information was accessed or communicated."

The statement continued: "...LKMC provided written warnings and supplemental HIPAA education and training to all involved persons. LKMC is unaware of any situation where [personal information] has actually been used for anything other than appropriate medical care and treatment."