R. K. was admitted to St. Mary's Medical Center as a psychiatric patient in March 2010. He was in the midst of divorce proceedings at the time. (The nature of his illness was not disclosed in this decision.) During the hospitalization, hospital employees improperly accessed his records. They disclosed to R. K.'s estranged wife and her divorce attorney that R. K. was a patient at St. Mary's and also disclosed certain psychological information to them.
R. K. found out that his confidential medical information had been improperly disclosed and asked St. Mary's for an audit of his records. The audit confirmed that inappropriate access and disclosure had been made. R. K. brought suit in which he made claims for negligence, outrageous conduct, intentional infliction of emotional distress, negligent infliction of emotional distress, negligent entrustment, breach of confidentiality, and invasion of privacy. The suit sought damages and punitive damages.
The trial court dismissed the action holding that the Health Insurance Portability and Accountability Act (HIPAA), 42 U.S.C. §1320d preempted R. K.'s state law claims. This appeal was taken to the Supreme Court of West Virginia.
Does HIPAA preempt all state law claims concerning the privacy of medical information?
R. K. conceded, and the court found, that HIPAA does not provide a private cause of action for a violation thereof. See Doe v. Board of Trustees of University of Illinois, 429 F. Supp. 2d 930 (N.D. Ill. 2006); Slue v. New York University Medical Center, 409 F. Supp. 2d 349 (S.D.N.Y. 2006). However, R. K. also argued that he did not plead a claim for violation of HIPAA; he only sought relief for state law causes of action. St. Mary's argued that R. K.‘s pleadings were immaterial and that HIPAA should be applied to preempt R. K.‘s claims. The court put this issue aside and focused on the issue of preemption.
The court reviewed the statute and noted several important points. HIPAA has a specific preemption clause that preempts state law if state law is contrary to it. 45 C.F.R. §160.203(b). “Contrary” means, for the purpose of the statute, that a covered entity would find it impossible to comply with both the state and federal requirements. 45 C.F.R. 160.202. Additionally, state law is not preempted if it is more stringent than HIPAA in the protection of the confidentiality of medical information. 45 C.F.R. §160.203(b). The court also noted that other courts have found that HIPAA does not necessarily preempt state law. See, e.g., Yath v. Fairview Clinics, N.P., 767 N.W.2d 34 (Minn. Ct. App. 2009); Fanean v. Rite Aid Corporation of Delaware, Inc., 984 A.2d 812 (Del. Super. Ct. 2009).
After carefully reviewing the statute, the court ruled that state law in this case was not contrary to HIPAA in that the hospital could comply with both state law and HIPAA. The relevant state law was actually complementary in enhancing HIPAA's protections. Accordingly, the court reversed the decision of the trial court and held that R. K.'s claims were not preempted by HIPAA.
This case reinforces the need to be duly diligent to prevent the unauthorized disclosure of medical information. Although all medical information is confidential, the disclosure of records pertaining to psychiatric disorders or substance abuse may cause a higher degree of outrage on the part of the patient and lead to greater liability. There is greater sensitivity for such information and the potential for harm if this information is improperly disclosed can be significant. This is not new: The protections for substance abuse information, for example, are stringent and predate HIPAA. See 42 C.F.R. Part 2.
Health care entities should take no solace in the fact that HIPAA does not provide a private cause of action. It does provide for civil penalties for violations. Additionally, states invariably will have a statutory or common law remedy for plaintiffs in this position.
While the details of this disclosure were not revealed, every effort must be made to ensure that all employees and physicians understand how the disclosure of medical information can be made. Health care professionals need to have policies on disclosure that include all mechanisms by which disclosure may be sought: by authorization, by requests from family or other parties involving a deceased patient, by subpoena, and by court order. Employees must know how to respond to any form of request for medical information. This should not be confined to the employees who work in health information management—it must include everyone who has access to health information.
R. K. v. St. Mary's Medical Center, Inc.,
No. 11-0924
(W.Va. November 15, 2012)
John C. West, J.D., M.H.A., is a senior health care consultant with AIG. This column constitutes general advice not legal advice. Readers should consult with legal counsel for legal concerns. For questions or comments, contact the author at .