I have a situation. It seems simple at first, but it I've been unable to ascertain a concrete answer during analysis. We have a husband and wife (married) who see 2 different providers at our organization. They are both prescribed controlled substances. The wife has a signed medication agreement on file. The husband does not. The med agreement says, among other things: "I will not share my prescription with others".
While the husband doesn't have a medication agreement on file, he recently submitted to a drug UA, which came back dirty. He explained to his provider that it's dirty because he's long used his wife's butalbital when he had a headache. The wife's provider became aware that she was sharing her medication with the husband. So, the wife's provider, after careful consideration, took her off of that but not her opioids (there's clinical reasoning for this; not relevant for the situation being investigated here). Further, the wife will now have more frequent monitoring, random pill counts, etc. to assure that none of her opiates are being used by her husband.
Now, the husband says he's upset because he thinks his provider used his personal and confidential information for something other than treating him.
I'm trying to determine if that's true – did the husband's provider breach his privacy because his wife's provider now knows that he was taking her prescription? i.e. is this situation a HIPAA breach. It's still a question as to how the wife's provider came to realize the situation, which I am looking into and will conduct interviews (if necessary).
Has anybody experienced a similar situation? How did you perform an analysis and what was your determination?