PHI is protected health information, and HIPPA has strong rules against a creditor, health provider, or anyone else in biz from releasing yours without your express permission. In attempting to validate some very old medical bills being reported to my credit report, a very large health provider has spilled the beans to me, in writing, but good. They sent me some detailed records about another adult (over 18); one whom I have no contractual relationship with, am not the guarantor of their debts, or nothing. Some of the info they sent me consisted of exact dates of service (35 in all!) one as recent as 4 weeks ago, including the medical billing codes that if I had a legend I'd know what services were provided. Does anyone know if there is any way I can use this unauthorized release of PHI to my advantage?
You can file a complaint with the OCR and contact the hospital's privacy department, which will then need to notify the person whose information was wrongly divulged. However, I don't see how their mistake would help you much. That is, unless you can determine that they sent you this wrong information because they don't actually have anything on file for you.
yeah... Yeah, that's what I was thinking too. After asking for removal of the information that they were unable to validate, I did mention the spilled PHI in reference that their internal procedures and information handling was obviously insufficient to properly document that bad credit history entry to FCRA standards. In attempting to validate their purported debt, they sent me documentation of someone else's 35 visits to their health facility, their own accountholder contact record shows them contacting that other person (not me, even once), and they've established no legal and/or guarantor relationship between that person (their patient of record) and me. Not even a signed admission form. I expect them to remove the record (in their own sweet time of course) next.
