What Can I Do After an Improper Disclosure of Medical Records?

Protecting patients’ privacy rights is an essential aspect of public health. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) protects patient privacy. Under this federal law, patients have the right to their medical records. This includes the right to “inspect, review, and receive a copy of their medical records.”

Patients have remedies under federal law for improper disclosure of their medical records. However, this does not include the patient’s right to sue for compensation.

This article outlines improper disclosure of medical records and patient privacy rights. It also looks at medical records and exemptions to privacy rules. You’ll also learn about possible legal remedies for improper disclosure of medical records. You can also talk to a healthcare attorney near you to discuss possible legal remedies in your state.

What Is an Improper Disclosure of Medical Records?

Here’s an example: a doctor faxes a patient’s HIV status to the patient’s employer. They should have faxed it to their new health care provider.

Although unintentional, this constitutes an improper disclosure of medical records. The provider sent the patient’s medical status to the wrong party. Improper disclosure includes unintentional acts, security breaches, and improper maintenance of patient records.

HIPAA and Medical Records

HIPAA is a federal law that establishes data privacy protections. It also provides security safeguards for a person’s identifiable health information. Health data includes more than a patient’s essential health information. It consists of a patient’s Social Security number or date of birth. This data—protected health information—is often part of a person’s medical records.

Covered Entities Under HIPAA

HIPAA requires health care providers, health insurance companies, and other “covered entities” to get patient consent before sharing their medical information. A covered entity is a health provider, health plan, or health clearinghouse. Health providers include:

• Mental health practitioners
• Dentists
• Nursing homes
• Pharmacies

Health plans include health insurance companies, HMOs, and government programs like Medicaid. HIPAA applies to covered entities and their business associates. HIPAA privacy rules apply to business associates and their subcontractors.

Covered entities need a patient’s written authorization to share confidential information. This includes life insurance companies or business associates. If a patient has a personal representative, that person must provide written authorization.

Medical Records

Medical records are part of patient care. Medical records are updated regularly. This includes medical history and laboratory test results. As technology has advanced, so has record-keeping. Today, most medical records are in electronic form.

Only the patient and their personal representative can access their health care information. Often providers need a written request. They may request copies of their medical records. Providers have up to 30 days to provide documents.

Exceptions to HIPAA

There are exceptions to HIPAA’s Privacy Rule. These limited exceptions generally apply when a patient is either absent or unconscious.

The provider may share patient information with a family member, representative, or friend. They may do so if they believe it is in the patient’s best interest. They may also share information with someone paying for your treatment. This exception only applies when the patient is absent or cannot consent.

For example, say a patient has emergency surgery and is unconscious after the surgery. The surgeon can update the spouse in this scenario. The provider can only provide information about the procedure.

Another example is if a patient asks their friend to pick up their medication. The pharmacist may only give the friend medication-related information.

Physicians may share medical records with another provider if necessary for treatment. There are three requirements both covered entities must meet. First, they must have (or have had) a relationship with the patient. Second, the disclosure concerns the relationship between the patient and the providers. Finally, they can only share minimal information necessary to provide health care services.

Improper Disclosure of Medical Records

Improper disclosure of medical records is distinct from the exceptions listed above. Here are a few examples of improper disclosure of medical records:

• An insurance company sends a patient’s explanation of benefits (EOB) to an unauthorized family member.
• A pharmacy tech puts a patient’s Medicaid card in another patient’s bag.
• Hospital employees discuss a patient’s STI results in front of other patients.

These examples include a covered entity, a patient, and protected information. Each example also consists of improper disclosure of medical records.

Take Action After an Improper Disclosure

There are several remedies for improper disclosure of a patient’s health information. These do not include suing a covered entity under federal law. HIPAA does not have a private cause of action for improper disclosure. This means patients can’t file a lawsuit under HIPAA.

However, patients can file complaints with the Department of Health and Human Services. You have a few options for improper disclosure of your medical records. These options include the following:

• Filing a complaint with the HHS Office for Civil Rights (OCR). The OCR is like a law enforcement arm of the HHS. It investigates complaints against covered entities.
• Filing a complaint with a professional board, such as the state Board of Medicine or the Board of Nursing

Just because you can’t sue your provider for sharing your private health information without your consent doesn’t mean you don’t have options. A local healthcare attorney can review what happened, explain your options and possible legal remedies, and recommend next steps. 

State-Level Remedies for Medical Privacy Violations

Patients may have a cause of action for medical privacy violations under state law. State law remedies include the right to sue for invasion of privacy. It also includes a breach of doctor-patient confidentiality.

State attorneys general can sue for damages for HIPAA violations. Patients can file a complaint with their state’s attorney general.

Get Legal Help With a HIPAA Violation

Learning that your private health information has been shared without your consent can be deeply unsettling and upsetting. While you generally can’t sue your provider for an improper disclosure, you still have options. An experienced attorney can review the disclosure and recommend options to protect your rights. They can help you file a complaint and pursue other remedies under your state’s laws.