My Job wants the CSR's to do on-call orders outside of the facility.I think its a violation of patients rights

My Job, St. Elizabeth Health Support in New Hartford New York, is about to have the Customer Service Rep carry a laptop during off business hours. This Laptop would contain our Patient's Inquiry System, Billing Information, Personal Information of the patients which contains patients names, address, SS#, Phone#, DOB, Insurance Info, Personal Contact, etc. Doing this outside of the facility/company to me would be a violation of HIPPA and Patients Rights. I also work at another place during the weekends to where i'm surrounded by people, even at home, I have a house full of children and there's no privacy there. I asked the Director wouldnt this be a violation of HIPPA ? He stated "NO". The procedure would be that we would have to carry cell phones and when a patient needs equipment (DME) we are to enter the order on the laptop, verify patients information, (address & phone#) verify insurance and process accordingly to our delivery people. I'm surrounded by people during my off hours from the facility. Would this be a violation of HIPPA ?

Tell your boss that no, it's too risky and against your boss's best interests.

There was a case a few months ago where someone's laptop, containing sensitive information (SS numbers, personal medical history, etc.) was stolen out of the person's car--I believe it was an employee of the CDC. It was on CNN. But the media really painted the situation black, all those social security numbers floating around out there for anyone to exploit.....

Your boss is making a huge mistake. Tell your employer to call his insurer and ask THEM if it's okay to let employees do this if your employer doesn't believe me.

....and I sure wouldn't want to be a patient at St. Elizabeth's knowing that they were so careless with my personal information! [And you can tell them I said so]!

Probably not, unless you just left the laptop open and unsecured with patient information pulled up.

I assume you have to have passwords to get into the patient info systems? If so, make sure nobody has your password.

Speculation on my part:
With a password-protected login and reasonable care being taken, I don't think that this would be much of a HIPPA problem. It's not like you're going to be showing patient data to others anymore than you would take a printout home to show people.


Regardless of the HIPPA situation, though, my first question would be "What's the definition of 'off business hours'?" Are you now expected to make yourself available 24/7 including all nights and every weekend?