A costly HIPAA violation
CASE
After a major car accident, two providers disclose a patient's health information to his employer.
Ms. C was working the weekend shiftin the emergency department of the medical center where she had been employed for the last three years as a nurse practitioner. Ordinarily, she would have been unhappy about having the weekend shiftduring the summer, but in this case, she did not mind because her close friend, Mrs. D, the director of the emergency department, would also be working that weekend. Their schedules did not often align, and both women were happy on the rare instances when they were scheduled to work together.
On Saturday evening, an ambulance brought in a new patient, Mr. P, who had been involved in a one-car accident. Mr. P needed treatment for a concussion, bruised ribs, possible fractures, and contusions. The patient was conscious and confided to Ms. C during the examination that he had been drinking and had then fallen asleep at the wheel while driving home, crashing into a tree. Ms. C noted this in the patient's file, as she was recording his injuries and treatment plan.
While Mr. P was undergoing x-ray imaging, Ms. C and Mrs. D spoke for a few minutes.
"Did you know that your patient is a police officer?" Mrs. D asked.
"No," Ms. C replied. "How do you know?"
"I saw the intake forms," Mrs. D said. "My neighbor is a captain on the force. I'm going to give him a quick call and see whether he knows this guy."
Ms. C nodded and asked Mrs. D to keep her posted.
An hour later, Mrs. D waved Ms. C over. "I called my neighbor, the cop," she said, "and you won't believe this! He's actually the supervising officer of our patient! So, he's coming down here to see how he's doing. I'll let you know when he gets here."
Ms. C nodded and went back to treating patients. She did not mention the conversation to Mr. P, nor did she ask him whether he wanted anyone notified.
Sometime later, the supervising officer arrived in the emergency department. Mrs. D asked Ms. C to bring over Mr. P's file and told the supervising officer that he was welcome to go in and visit Mr. P after he looked at the patient's file. After the supervising officer reviewed the file, Ms. C led him to Mr. P's room.
The rest of the weekend passed uneventfully for Ms. C, but that was not the case for Mr. P. After reading his file and determining that he had been drinking and driving, his supervising officer reported him to the police force and disciplinary action was taken. Mr. P was temporarily suspended from his job, and when he finally was allowed to return, he had been demoted to a lower position with a lower salary.
Mr. P retained an attorney who told him that what had happened was a violation of the federal Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. "Your health care practitioners improperly divulged protected health information to your employer," the attorney said. "We have to file a complaint with the
A complaint was filed, an investigation was launched, and the conclusion of the government investigators was that Mrs. D and Ms. C had impermissibly disclosed Mr. P's protected health information.
Mr. P's attorney filed a civil suit seeking both compensatory and punitive damages from the medical center, Mrs. D, and Ms. C. The defendants replied by filing a motion to dismiss, claiming that their conduct was not sufficiently outrageous to justify punitive damages.
Legal background
Compensatory damages are designed to compensate the injured party for lost wages, costs, and damages to reputation. Compensatory damages existed in this case, as Mr. P was demoted, and his pay was reduced as a result of the impermissible disclosure of his protected health information. Punitive damages, however, are not designed to make the injured party whole, but rather to punish the wrong-doer, and deter such behavior in the future.
In the state where this action took place, the law states that punitive damages "may be awarded for conduct that is outrageous, because of the defendant's evil motive or his reckless indifference to the rights of others."
The court noted that the patient never asked for anyone to be notified, never consented to having his chart shown to his supervisor, never agreed to having his supervisor come to his hospital room, and never agreed to have his clinician (Ms. C) discuss his health with his supervising officer. Further, the court noted that the supervising officer was not there with a subpoena or due to an official investigation.
The court refused to dismiss the request for punitive damages, holding that if the jury ultimately found that the defendants' actions were not merely negligent, but intentional, then punitive damages, on top of compensatory damages, could be awarded.
The case was then remanded for a jury trial, but a settlement was reached between the parties before the case could go to trial.
Protecting yourself
A patient's privacy is of paramount importance. Increasingly, privacy violations are being taken very seriously, particularly since 2003, when the U.S.
Mrs. D should not have divulged information about a patient to her neighbor, regardless of whether she thought the two might know each other. Ms. C should not have brought the supervising officer to Mr. P's room without getting Mr. P's consent, and she should not have discussed her patient's health status with Mr. P's supervising officer, regardless of their relationship. Furthermore, Mrs. D and Ms. C should never have shown a patient's health records to someone else without Mr. P's express consent.
In this case, the patient never consented to the disclosures of any of his private medical information, nor was a subpoena or official legal document presented to compel hospital personnel to disclose the information or to allow access to the patient's chart. The clinicians made those poor choices on their own.
Patient records are private and confidential and should be treated as such. Divulging patient information can result in damage not just to a patient's reputation, but to a practitioner's as well. n
The patient was conscious and confided to Ms. C during the examination that he had been drinking.
Cases presented are based on actual occurrences. Names of participants and details have been changed. Cases are informational only; no specific legal advice is intended. Persons pictured are not the actual individuals mentioned in the article.
Mrs. D told the supervising officer that he was welcome to go in and visit Mr. P after he looked at the patient's file.
BY
Advisor News
Annuity News
Health/Employee Benefits News
Life Insurance News