The Vermont Supreme Court issued a landmark ruling, regarding HIPAA lawsuits, that could potentially change the way individuals hold their healthcare providers accountable for breaches of PHI (Protected Health Information).
Maybe you heard about this case but don’t understand the ruling or its significance. In this piece, we break down everything you need to know about this recent development in HIPAA lawsuits.
The Case
To best understand the ruling, we must take a closer look at the case. A Vermont woman visited the emergency room to receive treatment for a laceration on her arm. During treatment, the patient’s nurse noticed that she seemed intoxicated and decided to test her blood alcohol level. The nurse found that the patient had a BAC of 0.215 – more than twice the legal limit.
Knowing the patient drove herself to the emergency room and planned to drive home, the nurse contacted local authorities who arrested the woman in the ER waiting room after her procedure. The patient believed the nurse violated her privacy rights under HIPAA and filed a lawsuit against the hospital.
Was This a HIPAA Violation?
The court ultimately ruled that the patient had the right to sue the hospital for this disclosure of PHI. However, this situation does not constitute a breach. Healthcare professionals can disclose a patient’s PHI if they believe the patient poses a threat to themselves or the general public.
In this case, the nurse reported the woman because she believed she would drive home while severely intoxicated. Therefore, the nurse had the right to disclose the patient’s health information to law enforcement.
The Ruling
Unsurprisingly, the court upheld the nurse’s right to report the patient to law enforcement. As mentioned previously, this disclosure is permitted under HIPAA because the nurse believed the woman posed a threat to the general public.
That part of the case is straight forward, however, another factor complicates the proceedings. Under HIPAA, individuals have no right to private cause for action. This means that patients are not permitted to sue healthcare providers for privacy violations.
Instead, patients file a complaint with the Office of Civil Rights (OCR) or their state attorney general. The state/federal government investigates incidents and levies fines and penalties against any entities in violation of HIPAA.
What is so unique about this case is that the Vermont Supreme Court upheld the patient’s right to sue her healthcare provider for violating her privacy. And again, while the nurse’s disclosure did not technically violate HIPAA, it did break the understood right to confidentiality between patients and providers.
What Happens Next?
The possibility of HIPAA lawsuits brought forth by patients and breach victims could change HIPAA enforcement. The case was ultimately unsuccessful; the court ruled in favor of the nurse. However, the court also legitimized private cause for action in HIPAA lawsuits, which could set a precedent for HIPAA related legal action. Therefore, it could be possible for individuals to sue covered entities and cite this case.
Consider all the groups that qualify as covered entities: healthcare providers, employers who sponsor group health plans, health insurance agents and brokers, and all of these groups’ business associates. This case could impact more individuals and entities than this one patient and hospital.
As always, if you have any questions or need assistance, please contact JorgensenHR at (661) 600-2070, email info@jorgensenhr.com or visit www.jorgensenhr.com. Our mission is to provide the Best HR solutions for your business.
Source: Total HIPAA
Recent Comments