Patient Sues Clinician for Privacy Violation After Practice Responds to Subpoena

The healthcare practitioner should have contacted the practice's attorney to better understand what their duty was in response to the subpoena
The healthcare practitioner should have contacted the practice's attorney to better understand what their duty was in response to the subpoena

Patient privacy is an extremely important, yet poorly understood, issue. When the Health Information Portability and Accountability Act of 1996 (HIPAA) went into effect, it created privacy rules governing the protection of identifiable health information by health plans and health care providers. Patients who believe their health information was improperly revealed or wasn't properly protected may file a complaint with the Health and Human Services Department (HHS), which will investigate and penalize the offender if warranted. But do patients have a right to sue healthcare providers for privacy violations? HIPAA does not create the right for an individual to sue, only to file a complaint with the government. However, some states have begun to look at whether a common law cause of action may exist when a healthcare provider reveals private health information. This month's case deals with this very scenario and was decided earlier this year in the state of Connecticut.

The patient, Ms. B, had been seeing a physician, Dr. A, who was part of an obstetrics and gynecology practice. The practice provided its patients, including Ms. B, with notice of its privacy policy regarding protected health information and agreed, based on this policy and the law, that it would not disclose the patient's health information without her authorization. During the time that Ms. B was going to the practice, she was having a relationship with Mr. M. This relationship led to a pregnancy, and Dr. A provided medical care for Ms. B during and after the pregnancy. When Ms. B's relationship with Mr. M ended, she contacted Dr. A's practice and instructed the practice not to release any of her medical records to Mr. M. A few months later, Ms. B moved to another state and stopped using Dr. A as her healthcare provider.

Some time after Ms. B left the state, Mr. M filed a paternity action against Ms. B, and as part of the case, Dr. A's practice received a subpoena instructing the “custodian of its records” to appear before the issuing attorney in court and to produce “all medical records” pertaining to Ms. B. Rather than contact Ms. B, or send an employee to court to respond to the subpoena, or even contact its own attorney, Dr. A's practice simply put Ms. B's entire medical file in an envelope and mailed it to court.