You are a manager of a respiratory therapy department. One of your employees is registered in ALHE 4230, one of the courses required in the BASAH program. The employee is writing a paper on the different factors associated with COPD. The employee downloads information from the hospital database and saves it to a thumbdrive. The patient information is later accessed at home when the paper is being written.

You are alerted by the hospital compliance department that one of your employees has accessed information on patients. When you confront the employee, the employee says that she understands the rules of privacy, but because the information was used for the purposes of research, it is permissible. Further, she says that there was no way that a patient can be identified, as all of the names were removed.

Questions for discussion:

Is the employee correct? Why or why not?

If not, what course of action should you take as the department manager?