One frequent question I am asked has to do with the wrongful disclosure of medical records, or, using the language of the federal law known as HIPAA: protected health information. Most people have heard of the Health Insurance Portability and Accountability Act of 1996, but just as many are shocked to learn that that HIPAA does not really provide much of a remedy if your medical information is given out without your consent.
HIPAA does provide that a complaint can be made through the Office of Civil Rights, part of the U.S. Department of Health and Human Services. The OCR has the authority to investigate HIPAA violation complaints, and engage in enforcement actions such as requiring training and fining violators. To find your nearest OCR office and learn how to file a complaint, check out this link.
If you are not satisfied with the HIPAA process, in Missouri you may still have a civil cause of action against a health care provider for unlawfully disclosing your records or other protected information. This is based on the physician-patient privilege established by Missouri statute and the resulting health care provider’s fiduciary duty to maintain the privacy of your information.
In the 1993 case of Brandt v. Medical Defense Associates, the Missouri Supreme Court held that a physician has a fiduciary duty of confidentiality not to disclose any medical information received in connection with the treatment of the patient. A later appellate court ruled this covered the situation in which a health care provider sent medical records to the patient’s opposing party in a child custody lawsuit. The records had been requested by a subpoena, but the hospital sent the records prior to the scheduled deposition. This resulted in the hospital paying the patient over $35,000 for releasing the records improperly. Here is the full opinion in Fierstien v. DePaul Medical Center: Fierstein v. DePaul Medical Center.
So, in summary, federal law does not provide a private right of action, but Missouri state law may allow for a remedy if your private medical information has been improperly released. HIPAA will likely remain relevant to the state law claim as a guide, or standard, for health care providers to follow.