OSHA Whistleblower Protection
The OSH Act contains whistleblower protections that prohibit employers from retaliating against employees who report workplace health and safety concerns. Examples of retaliation include suspension, termination, demotion, intimidation, harassment, or reducing pay or hours in response to an employee’s report of health hazards in the workplace.
The General Duty Clause of the OSH Act requires employers to provide a safe and healthful workplace, free from recognized hazards. If an employee reports having concerns regarding health or safety in the workplace, the employer has a duty to address such concerns and should not undertake any retaliatory actions against the employee. Complaints of employer retaliation may be reported electronically
(https://www.osha.gov/whistleblower/WBComplaint) or by contacting an OSHA area office.
OIG Protected Disclosures
Employees who make reports of suspected fraud, waste, or abuse of federal funds are also protected by law. Employers are not permitted to retaliate against employees for making a “protected disclosure.” A disclosure is protected if it meets the following criteria:
1. The report is made in good faith, meaning it must be based on a reasonable belief that fraud, waste, or abuse has occurred.
2. The report is made to a person or entity that is authorized to receive it. Employees may make a good faith report to the Compliance Officer or Committee of your organization or to the OIG Hotline: https://oig.justice.gov/hotline
The OIG makes it clear that anyone who makes a good faith report may not be subjected to or threatened with retaliation. If you believe you have been retaliated against for making a protected disclosure, you may file a retaliation complaint to the OIG Hotline.
Patient Privacy Complaints
If a patient believes that their HIPAA privacy rights have been violated, they may choose to make a formal complaint to your organization. The patient should be asked to complete a privacy complaint form to document their concerns and allow the Privacy Officer or Compliance Committee to investigate the complaint.
A patient may also choose to report a suspected Privacy Rule violation directly to the Department of Health and Human Services’ Office for Civil Rights (OCR). OCR will review the complaint and take action to investigate if the patient’s rights were violated and the complaint was filed within 180 days of the violation.
Regardless of the method of reporting that a patient uses to make a complaint, an organization must never retaliate against the patient, including by withholding healthcare, access to their PHI, or by dismissing the patient from care without sufficient cause.
NOTE: Subscribers to Eagle Associates’ compliance programs have relevant policies in section 1.03 of the Safety Manual, section 3.38f of the HIPAA Manual and section 1.04 of the OIG Policy Manual.
