[Answered]: A dental office was in the practice of flagging…

A dental office was in the practice of flagging some of its medical records with red stickers containing the word “AIDS” on the outside cover. Further, office staff handled the records in a manner such that other patients and staff could read the stickers, even though they had no reason to know about the patients’ diagnoses. What HIPAA violation(s) can be identified in this scenario? Is there a way to identify records of AIDS patients to safeguard staff, while also maintaining the privacy of the patients? As a representative of the Office for Civil Rights, what corrective action steps would you require the dental practice to make? What other types of mitigation could the dental practice employ? Presume that this office had electronic health records instead of paper records. Would the risk of a privacy violation be as great? How could records of AIDS patients be identified to safeguard staff, while also maintaining the privacy of the patients?