Is this a HIPAA violation??? I submitted my information for new enrollment for health insurance.?

Question

I hadn't received anything when expected, so I called to check on the status of my enrollment.About three weeks or so before this, I received a letter at my company asking for one correction on my enrollment form.I made the correction and sent it back to the insurance company. During my call to the insurance company, the rep tells me that they sent me a letter asking for another correction. I did not receive this letter and asked her to fax it to me. After receiving the fax and reveiwing it, I figured out why I didn't get it. It was sent to to the WRONG company. Not only did this letter have my full name, but also had my social on it. The next morning, I contacted the company and found out that they had much more info on me than this. HR at this company told me that she tried to correct the problem when she received my first letter, but continued to get my info. She received two COMPLETED copies of my enrollment form with all my info, VERY personal info. What should I do?

What makes me so mad, is that I had no idea that my personal information was even being sent to this company. When I did find out and I found out exaclty what info they had, I felt VIOLATED because of what is included on the enrollment form. Not just demographics, but some very personal information.

HR at the other company, mailed me everything that she received. Even the faxed copy that was sent to the insurance company notifying them of the misake. She told me she called them and told them, but they still continued to send my info.

Answer 1

It sounds like it could be a HIPAA violation if they don't correct the problem. At first it sounds like a simple mistake and the HR people at the other company should just destroy the documents or send it to you but if you won't fix the problem then just say that this needs to be fixed immediately or you will be motivated to file a HIPAA complaint. That should get them moving, if not...
http://www.hhs.gov/ocr/privacyhowtofile.htm

Answer 2

It is a hipaa violation. The company that sent it should be told about it, and taken to task for it. The company that received it must destroy any copy of the material they received without extracting any of your personal information from it.

Then, if you find no resolution, you must notify the depatment of health and welfare, or the department of justice, to lodge your complaint.

Answer 3

For there to be a HIPAA violation, it requires a willful violation. If your form is accidentally sent to another person, than it is not a violation, but if they know and still send it to the wrong person, than it is a violation. Until they knew they sent it to the wrong person, no violation has occurred.