Proof of affiliation of a person with third-party to lawsuit.

Question

What proof of affiliation between third-party business entity and person can be requested from hospital, if hospital disclosed to third-party entity data of hospital patient? 
Person's name is known from records, who exactly generated records from software system, but his affiliation with third party is TBD.  
Person was granted access rights to hospital's system, but may be affiliated with third-party business entity.

James L. Arrasmith · Answer

In a situation where a hospital has disclosed a patient's data to a third-party entity, and you suspect that the person who accessed the records is affiliated with that third party, you may request the following information from the hospital to establish proof of affiliation: 
 
1. Access logs: Request detailed access logs that show when the person in question accessed the patient's records, including timestamps, IP addresses, and any other identifying information. 
 
2. User account details: Ask for information about the user account that was used to access the records, such as the account name, creation date, and any associated contact information or email addresses. 
 
3. Contractual agreements: Inquire about any contracts, business associate agreements (BAAs), or other legal documents that outline the relationship between the hospital and the third-party entity. These documents may contain information about the specific individuals authorized to access patient data on behalf of the third party. 
 
4. Authentication methods: Ask the hospital about the authentication methods used to grant access to the person in question. This may include details about access cards, login credentials, or other means of authentication that could help establish the person's affiliation. 
 
5. Training and orientation records: Request any records related to training, orientation, or onboarding sessions provided by the hospital to individuals affiliated with the third-party entity. These records may help establish the person's connection to the third party. 
 
6. Correspondence: Ask for any relevant correspondence, such as emails or letters, between the hospital and the third-party entity that may mention the person in question or their role in accessing patient data. 
 
It's important to note that the hospital may have certain legal obligations and privacy concerns when it comes to disclosing information about their relationships with third parties and the individuals involved. You may need to work with legal counsel to draft an appropriate request and navigate any potential challenges in obtaining the necessary information.

Q: Proof of affiliation of a person with third-party to lawsuit.