Case Study: A new high school volunteer is placed in a health information services department. While sorting a stack of records returned to the department, she recognizes the name of one of her classmates and peruses the record out of curiosity. She notes an item in the history that would be juicy gossip among her friends. The volunteer has attended the facility's mandatory HIPAA training sessions but doesn't see the harm in mentioning this little tidbit to others since it is not a health issue. During the following week, you learn of this disclosure from 4 the patient's parent who quickly calls to complain that the patient is now being treated poorly at school as a result of the disclosure.

• Should nonemployees be permitted to work with health records, or should there be restrictions to access?
• What steps would you take, as the director, to deal with this particular situation and to avoid a future occurrence?
• Is the hospital liable because the volunteer underwent the mandatory training? If so, why?