A falsified billing document without proven data access

Overview

VRP Medical Center reported falsified receipts and statements of account used for an HMO claim. After comparing the documents, the NPC found insufficient evidence that the falsifier accessed the real patients’ personal data. It concluded that this record did not establish a personal data breach requiring notification and closed the matter.

Practice implications

Parao Law practice guidance

For physicians

Escalate a suspicious billing or insurance document, but preserve the original and system record before assuming a chart leak. Compare identifiers, templates and access logs. A fraud investigation and a privacy-breach assessment may reach different conclusions and both need documentation.

For lawyers

Test whether there is evidence of loss, alteration, unauthorized disclosure or access to actual personal data. Record why a document match or mismatch does or does not establish access. Do not treat every forged hospital form as a notifiable breach, or dismiss an incident without investigating the data path.