Courts Interpret Boundaries Of HIPAA Privacy Rule

As various federal and state courts have begun interpreting HIPAA’s privacy rule, psychiatrists may find it interesting to see the issues in these cases being decided by the courts. When reading the following survey of cases utilizing various provisions of the HIPAA statute and the privacy rule promulgated under HIPAA, readers should keep in mind that trial court decisions may be appealed, and even on appeal, different courts can decide the same issue differently.

The first group of cases present uncomplicated issues and straightforward legal analyses, with holdings consistent with psychiatrists’ practices prior to the privacy rule:

• Gunn v. Sound Shore Medical Center of Westchester, 772 N.Y.S.2d 714 (March)

In this New York case, the plaintiff was allegedly injured by a treadmill at a cardiac rehabilitation facility, which was owned by the defendant hospital. The plaintiff sought the names and addresses of the other patients who were at the facility at the time of the incident. The trial court ordered the hospital to disclose the patients’ names, and the hospital appealed. The appellate court reversed the trial court’s decision, stating “since disclosure of the patients’ names will, in effect, reveal that they were undergoing treatment for cardiac-related conditions, such discovery is prohibited under [New York’s physician-patient privilege law].”

While not raised as an issue by the hospital, the court said that “the passage of HIPAA lends support to the conclusion that disclosure of the identity of the other patients at the center would breach the physician-patient privilege and thus should not be permitted.”

• Campos v. Payne, 766 N.Y.S.2d 535 (October 2003)

New York law was modified, effective September 1, 2003, to require subpoenas for medical records to be accompanied by a written patient authorization. The court in this case held that the state law was more stringent than the privacy rule, so providers must comply with state law.

• Hutton v. City of Martinez, 219 F.R.D. 164 (Northern District of California, October 2003)

The defendant was a police officer who shot the plaintiff in the back. The plaintiff, claiming he was shot because the defendant was physically unable to pursue the plaintiff on foot, attempted to obtain evidence of the defendant’s physical condition from the defendant’s workers’ compensation carrier. The workers’ compensation carrier, even though explicitly excluded from the definition of a “covered entity” under HIPAA, nonetheless relied on HIPAA to refuse to produce the records related to the defendant’s work-related back injury. The court found the medical records to be directly relevant and held that “HIPAA does not preclude production of the medical records and workers’ compensation files in response to either a discovery request, subpoena, or this court’s order, under an adequate protective order.”

This case may illustrate that the privacy rule is a minimum floor of standards by which all entities with confidential medical information—even those not technically required to comply with HIPAA—will be judged.

The following are cases with a more far-reaching impact, particularly in terms of discovery of the patient’s medical records in litigation, with holdings also consistent with the way psychiatrists handle requests for information from attorneys:

• Campos v. Payne, 766 N.Y.S.2d 535 (October 2003)

While deciding the subpoena issue discussed above, the Campos v. Payne court also noted the resulting “alteration of New York jurisprudence that followed the common-law principle that if one claimed a personal injury, the party’s entire medical and physical history was put into issue. When one brought litigation, it was considered to be a waiver of any privacy rights in this regard.”

Likewise, a federal court in Law v. Zuckerman (discussion of ex parte communications below) addressed in a footnote that the mere act of filing a medical malpractice lawsuit does not automatically waive privilege. The court stated “it can be plausibly argued that patient consent is inferred by the filing of suit by plaintiffs. This court does not believe inferred consent satisfies the intended purpose of HIPAA.”

• Law v. Zuckerman, 2004 WL 438327 (Maryland District Court, February 2004)

In this medical malpractice case, the federal trial court addressed whether defense counsel’s ex parte discussions with a treating physician—which is allowed under Maryland state law—violates HIPAA. (“Ex parte” refers to proceedings brought by one person in the absence of another.) Initially the court ruled such ex parte communication did not violate HIPAA. The court then reconsidered and reasoned that HIPAA would govern unless state law was “more stringent,” which is defined to include giving patients more control over their medical records. The court found that state law was not “more stringent” than HIPAA, so ex parte communications are governed by HIPAA instead of state law. Accordingly, the court found that unless the patient consents, physicians need a court order or HIPAA-compliant trial or deposition subpoena with satisfactory assurances that the patient has been notified and given the opportunity to object or reasonable efforts have been made to obtain a qualified protective order. ▪

Donna Vanderpool, J.D., M.B.A., is the assistant vice president of risk management at Professional Risk Management Services Inc., manager of the Psychiatrists’ Program, the APA-endorsed Psychiatrists’ Professional Liability Insurance Program.