Legal Risks of Retaliation: How to Handle Employee Complaints Safely

Legal Risks of Retaliation: How to Handle Employee Complaints Safely

by | Dec 10, 2024 | Clinical Compliance, Compliance and Regulatory - Directors, Human Resources, Keys to Compassionate Care, Regulatory Compliance

When an employee brings forward a compliance concern, they’re engaging in what the law defines as protected activity. This might involve reporting a potential violation of hospice regulations, concerns about Medicare fraud, or even raising issues about unsafe working conditions. These are rights guaranteed under various laws, like the False Claims Act, OSHA protections, and Title VII of the Civil Rights Act, which protect employees who speak up.

In responding to employee concerns, there is a fine line between addressing workplace concerns and crossing into retaliation territory. Retaliation isn’t always a blatant act of revenge. Sometimes, it’s more subtle, even subconscious. Sometimes management at the hospice agency may feel frustrated or betrayed by an employee’s complaint and – without realizing it – allow those feelings to influence their decisions. Maybe the employee was already struggling with performance, or maybe there were pre-existing tensions on the team. But when an adverse action—like firing, demotion, or cutting hours—happens shortly after a complaint, it’s easy for that decision to be seen as retaliatory, even if it wasn’t intended that way.

What is Retaliation?

To clarify what retaliation means, it’s any adverse action taken against an employee because they engaged in protected activity. Timing is a major red flag here. If an employee files a compliance report and is terminated shortly after, it raises questions. Even if you feel justified in your decision, the timing alone can look suspect to a court, regulatory agency, or even the employee’s peers.

What are the Consequences of Retaliation

And the consequences for retaliation? They’re not just legal—they’re also reputational. If a claim is brought against an agency, the agency could face:

  • Reinstatement of the employee to their position, even if you’ve moved on.
  • Back pay, damages, and legal fees, which can quickly add up.
  • Regulatory scrutiny, which might open the door to deeper investigations into the agency’s practices.
  • And, perhaps most damaging, the perception that we don’t care about compliance or employee rights. That’s not a message we can afford to send.

From the employee’s perspective, they have a number of options if they feel they’ve been retaliated against. They might file a complaint with OSHA, EEOC, or state regulators. They could seek legal action for wrongful termination or take their concerns to external auditors or even the media. Once that door is opened, the hospice agency loses control of the narrative.

How Can You Avoid Retaliatory Behavior?

So, what can you do to avoid even the appearance of retaliation? Here’s are some suggestions:

  • Document everything: If there are performance concerns or other issues unrelated to the complaint, make sure there’s a clear, consistent record. This documentation can be your best defense.
  • Separate decision-making: If you’re in the middle of handling a compliance complaint, let someone outside the situation—like your compliance officer or HR—review any proposed actions against the employee.
  • Follow established protocols: Deviating from your normal policies, especially when dealing with someone who has raised a complaint, can make it look like you are targeting them.
  • Train your leaders: Everyone in management needs to understand what retaliation looks like and how to avoid it.

Leadership sometimes expresses concerns about employees “stirring up trouble” or raising issues for self-protection. But the law doesn’t distinguish between “valid” and “troublesome” complaints. Protected activity is protected activity, full stop.

Take a step back. If you’re ever considering taking action against an employee who has engaged in protected activity, discuss it first with your HR or compliance team. Together, you can ensure the decision is based on legitimate, well-documented reasons and not influenced—even unconsciously—by the complaint itself.

At the end of the day, your goal is to serve patients and families with integrity and compassion. That means creating a culture where employees feel safe to speak up about compliance issues without fear of retaliation. Protecting that culture isn’t just about avoiding lawsuits—it’s about doing what’s right for your team, your agency, and the people you care for.

Helping with Medications: What Hospice Aides Need to Know

Helping with Medications: What Hospice Aides Need to Know

by | Aug 23, 2024 | Care Keys - Aides, Care Keys - Nurses, Clinical Compliance

As a hospice home health aide (HHA), you have an important job in taking care of patients. Part of your job is helping with medications, but it’s really important to know what you can and can’t do. The rules might change depending on the state you work in, because each state has its own guidelines. Knowing these rules helps you give the best care to your patients while staying safe and following the law.

Why Medications Are Important

Medications help patients feel better when taken the right way. Here are some things hospice aides should do:

  • Remind Patients: Make sure patients take their medicine on time.
  • Watch for Changes: Pay attention to how patients feel after taking their medicine.
  • Report to a Nurse: If a patient feels sick or different after taking medicine, tell a nurse right away.

Doing these things helps keep the patient safe and healthy. Let’s look at these ideas more closely.

What You Need to Know About Medications

  1. Medication Adherence: It’s really important that patients take their medicine exactly as the doctor says. If they miss doses or take it wrong, their symptoms might get worse. You can help by reminding patients to take their medicine and making sure they take the right amount at the right time. But remember, what you can do to help might be limited by state rules.
  2. Recognizing Side Effects: You should know about the common side effects of the medicines your patients take. You don’t need to know everything, but be aware of signs like dizziness, sleepiness, or changes in behavior. If you notice something unusual, tell the nurse right away. State guidelines often say it’s your job to watch for and report these things.
  3. Understanding Medication Schedules: Some medicines need to be taken at certain times, with food, or on an empty stomach. You should know these basic rules so you can help patients stick to their schedule. But remember, you can’t change the schedule or the medicine—only a doctor or nurse can do that.
  4. Communication with the Healthcare Team: It’s really important to tell the healthcare team about any problems with taking medications, side effects, or new over-the-counter (OTC) medicines the patient might be using. State rules usually say you must keep clear and accurate notes about your observations.

What Can a Hospice Aide Do with Medications?

  • Remind Patients: In most states, you can remind patients to take their medicine. This is really important, especially for patients who might forget or have a strict schedule. But remember, reminding isn’t the same as giving the medicine. Usually, you can’t put the medicine in the patient’s mouth or give them a shot unless you have special training and the state allows it.
  • Help with Medication Setup: In some states, you might help patients by setting up a pillbox or organizing their medicine, but only under a nurse’s supervision. This helps make sure the patient takes the right dose at the right time. Remember, the patient or a licensed professional must give the medicine.
  • Observe and Report: You spend a lot of time with the patient, so you might be the first to notice changes in how they feel. You should know which medicines the patient is taking so you can spot any side effects, missed doses, or other problems. Always report these to the nurse and write down what you observed, if your state allows it. Just remember, only write down what you see—don’t make any medical guesses.

What Can’t a Hospice Aide Do with Medications?

  • You can’t give the medicine directly to the patient, like putting a pill in their mouth
  • You can’t give shots or injections.

Your job is to help and remind patients about their medicine, not to give it directly.

Safety First!

  • Follow the Rules: Every state has different rules about what you can do with medications. Some states let you help a little more, like setting up pillboxes, while others have stricter rules. Following these rules keeps everyone safe.
  • Ask if You’re Not Sure: If you’re not sure about something with medications, always ask a nurse or follow your agency’s guidelines.

Where Can You Find Out More

Writing an Incident Report

Writing an Incident Report

by | Aug 11, 2024 | Care Keys - Aides, Clinical Compliance

An incident report is a special kind of report that you write when something unusual or unexpected happens during your visit with a patient. This could be anything that isn’t part of the normal care routine.

When to Write an Incident Report

An incident report is needed if:

  • The Patient Falls: If the patient slips, trips, or falls, even if they don’t seem hurt.
  • An Injury Happens: If the patient, a family member, or even you get hurt in any way.
  • A Medication or Care Error: If the wrong medicine is given, or if medicine is given at the wrong time or if there a different error in patient care.
  • Behavior Changes: If the patient suddenly becomes very confused, angry, or upset.
  • Safety Concerns: If something dangerous happens or almost happens, like if a patient tries to leave the house when they shouldn’t or if you feel uncomfortable or unsafe.
  • Property Damage: If anything breaks or is damaged during the visit.
  • Blood or Fluid Exposure:  If you are exposed to blood or body fluids during the visit.

How to Write an Incident Report

  • Write It Right Away: Write the report as soon as the incident happens. This way, the details are fresh in your mind.
  • Stick to the Facts: Describe exactly what happened. Don’t guess or add your opinions. Just describe what you saw and heard.
  • Be Specific: Include details like the time, place, and exactly what happened. If someone said something important, use their exact words.
  • Report Injuries: If anyone was hurt, describe the injury and what was done to help.
  • Include Witnesses: If someone else saw what happened, include their name and what they saw.
  • Stay Calm: Use clear and simple words. Don’t blame anyone in the report, just describe what happened.
  • Tell Your Supervisor: Always report the incident to your supervisor as soon as possible.

Why Incident Reports Matter

  • Safety: Incident reports help keep patients and caregivers safe by making sure everyone knows about any problems or risk.
  • Improvement: These reports help the care team learn from mistakes and prevent them from happening again.
  • Legal Protection: Documenting incidents protects you and the agency by showing that you reported what happened.
Do you have a reportable data breach?

Do you have a reportable data breach?

by | Jul 31, 2022 | Clinical Compliance, Compliance and Regulatory - Directors, Data Security, Emergency Preparedness Plan

Concerned that you have a data breach?

Not everything that looks like a data breach is, in fact, a reportable data breach.  Before you report a data disclosure to the US Department of Health and Human Services Office for Civil Rights (OCR), you should confirm that what you are concerned is a reportable data breach is, in fact, a HIPAA breach.

A HIPAA breach is defined as the acquisition, access, use, or disclosure of protected health information (PHI) in a manner not permitted under HIPAA that compromises the security or privacy of the data. 

Not every disclosure of PHI is a breach. There are three important exceptions.

Three data disclosures that are not considered a reportable breach:

  • Unintentional Access:

An employee unintentionally accesses PHI but does not further disclose the PHI in a manner that is not permitted per the HIPAA regulations.  For example, a clinician wishes to enter information in the chart for patient “John Smith”. The clinician opens the chart for patient John Smith living on Bay Ridge street instead of patient John Smith living on Reed Street. The clinician closes the chart as soon as the mistake is identified.

  • Inadvertent Disclosure to Authorized Person:

An individual who is authorized to see the PHI inadvertently shares the PHI with another person in the organization. That second person does not further disclose the information in a manner that is not permitted per HIPAA regulations. For example, a technician sends lab results for the wrong patient to a physician. The physician deletes the results.

  • Inability to Retain the PHI:

PHI is inadvertently disclosed to someone unauthorized to have access to the information but that person would not be reasonably expected to retain the information. For example, a clinician’s young child is on the phone while the clinician is discussing patient PHI.

Is every disclosure that does not fall into one of these three exception categories considered a reportable breach?

The regulations allow for a four factor analysis to assess the overall level of risk of compromise, to discover the extent of the data breach, and to determine whether or not notification is required. Only after this four factor analysis is completed, the hospice agency determines whether or not a breach occurred and the level of risk. 

The following are the four factors:

  • Factor 1: Nature and Extent of PHI Involved

What information is involved? Can the patients be identified? What personal or helath information is included?

  • Factor 2: Who Accessed the Data/ to Whom was the Data Disclosed

Was the data disclosed to a person in the organization or in another HIPAA covered organization who is required to follow data privacy rules? In either of these cases, the risk is reduced as both of these types of persons are trained in HIPAA regulations.

  • Factor 3: Was PHI Actually Acquired or Viewed

Was the PHI actually viewed or acquired? For example, an encrypted device with PHI is stolen but based upon forensic analysis it is determined that no one accessed the PHI. In this case, there was a risk of data breach but analysis determined that PHI was not actually acquired or viewed.

  • Factor 4: To What Extent have you Mitigated the Risk

What actions have been taken to reduce the risk of PHI access. For example, has the PHI been returned to you? Have you taken steps to track down the device that was not returned by the former employee?

What should I do if a breach has occurred?

If, upon completion of the four factor analysis, it is determined that a breach has occurred, then notification is required. 

Affected person must be notified and media and the state may be required to be notified as well.

If fewer than 500 persons are involved, the OCR must be notified at the end of the calendar year. Otherwise, the OCR must be notified within 60 days.  

Take appropriate action

Not every disclosure of data is a breach. Investigation must be conducted to determine if the disclosure constitutes a reportable data breach. If the disclosure is a data breach then appropriate actions must be taken to report the breach to all relevant parties within the required time frames. Note that required actions may vary by state. 

Where can you get more information?