According to Murray Parents Association President Rita Winkeler, the administration at Murray is now allowing a private contractor to access all residents’ files at the center, despite legal documents restricting that access.
Winkeler says many of the staff feel that doing so is a violation of the federal Health Insurance Portability and Accountability Act, or HIPAA, so the employee union has responded to the issue, advising their members how to respond to direct orders regarding the files.
In a letter from American Federation of State, County and Municipal Employees (AFSCME), Winkeler was informed that AFSCME Council 31 staff representative Ed LaPorte and union director of public policy Anne Irving sent a letter Wednesday to Murray staff, regarding the situation with private contractor Community Resource Alliance (CRA), where management is seeking to subvert the normal procedures for consents.
“We stated that our union believes that providing resident health and treatment information to an outside entity violates Murray Center standard operating policy and procedure, the DHS Employee Handbook provisions on confidentiality, and the Health Insurance Portability and Accountability Act,” says the letter.
Irving says in the letter to Winkeler that members were reminded that the DHS Employee Handbook states only authorized persons are to have access to confidential and protected health information and failure to respect customer privacy can bring sanctions against DHS and the employee(s) involved. They also made members aware that MPS intends to aggressively prosecute violations of HIPAA.
“… while we told our members they must decide what they believe is the right thing to do in the face of a direct order from management, we believe the serious consequences related to privacy violations suggest that bargaining unit members should refuse to comply with an order that would lead to a violation,” Irving’s letter says.
She continues, saying that while Murray Center management may try to impose discipline on our members for refusing to comply with a direct order, the union would file a grievance contesting that discipline.
“We urged members to take some very specific steps in refusing to comply, including making clear their reason – that they believe complying with an order to share information without consents would violate HIPAA, DHS policies and their Murray Center training,” says the letter. “We also provided HIPAA violation complaint forms so they can report violations.”
Irving commented that on Tuesday she contacted DHS and asked that they provide the union with the legal reasoning for the about face on resident confidentiality and guardian consents, but had not yet received a response.