The 95-year-old president of The Church of Jesus Christ of Latter-day Saints underwent surgery at LDS Hospital to remove a cancerous growth earlier this week. He was recovering on schedule and doctors were pleased with his progress, church spokesman Dale Bills said Friday on the faith's Web site, lds.org.

Aryn Nelson, a gastroenterologist technician, said she was terminated on Wednesday because she had given her log-in information to a worker whose Internet privileges had been taken away.

Nelson said hospital officials told her the other employee allegedly signed in under Nelson's name and sent an e-mail to media outlets Tuesday, saying Hinckley was in the hospital.

Nelson admits giving out her log-in information.

"It's really upsetting to me," she said. "You put all you can into a company you hope you'll retire from, and overnight it's shattered. They wouldn't even show me the e-mail. They just fired me."

Nelson plans to appeal her termination.

LDS Hospital spokesman Jess Gomez said he could not discuss specific personnel issues. He did say, however, that all new Intermountain Healthcare employees go through orientation, in which they learn about the company's password policy and patient privacy measures mandated by the Health Insurance Portability and Accountability Act (HIPAA).

“It's something we take very, very seriously," Gomez said "All of our employees have passwords and access codes in order to access medical information for patients in which they are a direct provider of care. Our policy is that employees safeguard their passwords and access codes so we can ensure privacy and confidentiality for our patients. A violation of that policy can result in termination."

Nelson said she knew the policy but says that workers sharing log-ins isn't uncommon.

HIPAA went into effect in 2003. Part of the act sets standards for patients' privacy. Doctors, nurses or other health-care employees who give out information about a patient without the patient's consent would be violating the law.

Violations can draw fines and jail time.

"That would be a very clear violation of HIPAA standards," said Douglas Springmeyer, an assistant attorney general who worked on a guide explaining the complex guidelines.

HIPAA privacy rules are enforced by the Office of Civil Rights in the federal department of Health and Human Services.

Anyone who believes their privacy rights were violated would need to go to that department's Web site (http://www.hhs.gov/ocr/hipaa/) and file a complaint to the Denver regional office.

The office would conduct an investigation and decide if sanctions were appropriate.

chamilton@sltrib.com