5th Circuit - No Private Cause of Action Under HIPAA

Posted 11:45 AM by Michael Fox

Becoming the first circuit court to address the issue, the 5th Circuit of Appeals finds there is no private cause of action under HIPAA. Acara v. Banks (5th Cir. 11/13/06) [pdf]. The fact that enforcement powers are given to the Secretary of Health and Human Services strongly militates against a finding that Congress intended a private cause of action. Although it is the first circuit, the court notes it is in agreement with every district court to consider the issue.

The issue arose under an interesting fact pattern -- plaintiff was suing a doctor who allegedly disclosed her private medical information during the course of a deposition. According to papers filed in the district court case, Dr. Banks had treated Ms. Acara. When she sued an insurance company, he was deposed and it was his testimony in that deposition that led to the claim dismissed in the 5th Circuit's ruling.

Getting medical testimony can often be difficult; a contrary ruling in Acara would have upped the level of difficulty dramatically.

Labels: HIPAA

Comments: Post a Comment

Tuesday, March 15, 2005

Employee Blog, HIPAA Violations = A Huge Black Eye for Kaiser Permanente

Posted 10:03 AM by Michael Fox

Although there have been lots of articles recently about blogging and work, that subject seemed covered well by others, for e.g. check out this article in George's Employment Blog, but this note in beSpacific, Medical Record Privacy Breach Controversy Involving Blog, caught my eye. And so did the original story detailing a dispute between one of the larger healthcare providers, Kaiser Permanente and one of its former employees over who posted private healthcare information on the web. The self styled, Diva of the Disgruntled, claims they did and she just pointed out the mistake after complaining to appropriate officials. But from the article, 140 Kaiser patients' private data put online on the SiliconValley.com website, it sounds as if the ex-employee is going to have some serious explaining to do, even if she is right that KP goofed first.

All those HIPAA penalties, including criminal ones, you have been hearing (and forgetting) about -- may come into action here. And somehow, I don't think her self description is apt to play too well to a jury if it should come to that.

Labels: HIPAA

Comments:

You're very right about the impression people will get from Diva of Disgruntled.

I added the "Diva of Disgruntled" tagline to my blog many months ago. I was discussing my problems with Kaiser with a friend, and I was miserable because people who try to complain about what corporations have done to them are always labeled "disgruntled". I finally decided that instead of letting people who didn't understand the situation label me, I would just own the label myself. If disgruntled means unhappy with what has occured, I can't deny being disgruntled.

When the current problems started, I could have easily edited my blog - removed the Diva of Disgruntled tagline, and edited out everything I've done that might give a bad impression. However, if I started trying to hide and destroy the evidence, that would make me guilty of the same things I have accused Kaiser of.

So instead, I've left everything as is, and I just have to hope that people will look at the timeline carefully and will ask me questions if they are confused by anything.

I will say that the press has not shown a willingness to make retractions when they get something factually wrong, and that Kaiser has a vested interest in trying to confuse people so I will look more like someone who was disgruntled at the point when I lost my job - they are hoping people will just assume I stole patient data because as long as people are focused on me, it deflects attention from what Kaiser did.

One thing that has confused me here is that Kaiser has continued to push their story despite the fact their lawyers have seen my evidence. As an
"Employer's lawyer", I'm curious as to whether lawyers have a duty to instruct their clients not to use their PR dept. to promulgate a lie once the facts are on the table.

Ps. I also used to sign my blog entries "Be the Swirl" because Cliff Dodd, the CIO of Kaiser used to dismiss problems as Swirl. I stopped doing that because now I get mostly non-Kaiser visitors reading my blog, and they wouldn't get it.

# posted by

Anonymous : 11:00 AM