Confidential Health Information

Employer liability for employee's intentional misuse of protected health information
 
 
By Michael L. Smith, R.R.T., J.D.
 

A patient in New York sued a medical practice because a nurse working at the practice intentionally disclosed the patient's protected health information to the patient's girlfriend without authorization. The court in New York ruled the medical practice was not liable for the intentional wrongful conduct of the employee.

A patient in Indiana sued a pharmacy because a pharmacist intentionally reviewed the protected health information of her husband's former girlfriend, and then disclosed that information to her husband without the former girlfriend's authorization. The jury in that case awarded the former girlfriend $1.4 million.

In both cases, the healthcare providers disclosed protected health information concerning sexually transmitted diseases. In both cases, the employers had trained their employees in the confidentiality of protected health information. The million dollar mistake appears to be that the action taken by the pharmacy in Indiana after it received the patient's complaint was inadequate because the pharmacist was able to repeat the offense. Employers should reexamine their policies and procedures and specifically their disciplinary guidelines for intentional misconduct in order to avoid a judgment comparable to the Indiana case.

The question of an employer's liability for the actions of its employees usually turns on whether the employee was acting within the scope of their employment. Employers are vicariously liable for the negligent actions of their employees committed within the scope of their employment under the doctrine of respondent superior. For example, a restaurant could be held liable for the injuries to one of its patrons caused by a server dropping hot food on the patron. Employers are generally not liable for the intentional acts of their employees unless those acts further the legitimate interests of the employer. A restaurant would probably not be vicariously liable to a patron if the server intentionally attacked a patron due to some personal animosity. Of course, the second patron may be able to pursue other theories of liability against the restaurant particularly if the server had attacked patrons previously.

In the New York case, the court declined to hold the medical practice liable for the deliberate actions of the employee that were not reasonably foreseeable to the employer, and outside the scope of the nurse's employment. According to the facts alleged in the case, the nurse recognized the patient as the boyfriend of her sister-in-law and immediately sent a text message to the sister-in-law about the patient's condition. While practitioners are required to report sexually transmitted diseases to authorities, the nurse was reporting this patient's information for personal reasons and not to comply with any legal requirement. The patient complained to the medical practice and the nurse was terminated immediately.

In the Indiana case, the pharmacist suspected that her husband contracted the sexually transmitted disease from his girlfriend. The pharmacist accessed the patient's protected health information and then reported the information to her husband. The patient learned of the incident, and then complained to the pharmacy. After the patient complained to the pharmacy, the pharmacist accessed the records again. In the lawsuit, the patient claimed the pharmacy was negligent in failing to properly train the pharmacist, and that the pharmacy was negligent in continuing to employ the pharmacist after the wrongful conduct was reported to the pharmacy.

Healthcare employees take notice, employers will almost certainly terminate any employee who intentionally discloses protected health information for their own personal interests. The employer's risk to retain the errant employee is simply too great to retain the employee. An employee that has intentionally disclosed protected health information has violated federal and state laws, as well as, the professional obligations of their practice. An employee who will intentionally violate those laws and their professional obligations is highly likely to repeat that conduct despite any remedial action short of termination taken by the employer. An employer cannot afford to keep those rogue employees because the risk to the employer is tremendous.

Michael L. Smith, JD, RRT is board certified in health law by The Florida Bar and practices at The Health Law Firm in Altamonte Springs, Fla. This article is for general information only and is not a substitute for formal legal advice.

This article was originally published in Advance for Respiratory Care and Sleep Medicine.