Hospital fulfills subpoena, gets hit with privacy suit
Patient privacy is no doubt paramount in any physician practice. But when a subpoena suddenly is thrust into the physician-patient relationship, doctors may find themselves caught between the law and their privacy obligations.
The Cleveland Clinic in Ohio found itself in such a predicament when it agreed to turn over a patient’s records in response to a grand jury subpoena in a criminal investigation.
The U.S. District Court for the Northern District of Ohio, in a Feb. 1 ruling, said that more stringent state privacy standards superseded the hospital’s obligations to comply with the subpoena and related disclosure requirements under the Health Insurance Portability and Accountability Act. The ruling allows a patient to sue the hospital for invading his privacy.
The Cleveland Clinic declined to comment for this article.
The subpoena request was prompted by a criminal investigation of James Turk, a private investigator and former police officer who was indicted in June 2007 for carrying a concealed weapon and having it despite an alleged drug and alcohol dependency, according to court records.
Turk denied wrongdoing, and a jury acquitted him of some of the weapon charges in November 2008, while other claims were dropped.
As part of the criminal proceedings, the Cuyahoga County Court of Common Pleas, on behalf of the police department, issued a grand jury subpoena to Cleveland Clinic for Turk’s medical records. The request included information about any treatment for drug or alcohol abuse as well as any mental health counseling Turk had received.
The hospital complied with the subpoena and turned over the information to a police officer involved in the case. That prompted Turk to file suit against the Cleveland Clinic in 2009, claiming the hospital invaded his privacy and negligently disclosed his private medical information without proper authorization.
Turk alleged primarily that the release of his confidential records violated the state’s physician-patient privilege statute, which, with limited exception, protects medical information from public disclosure without patient consent.
But the Cleveland Clinic argued in court documents that the case should be dismissed because the clinic was responding to a grand jury subpoena.
Because such proceedings are conducted in secret and any information shared is kept confidential, the hospital said its production of Turk’s records did not constitute a public disclosure that violated the physician-patient privilege.
The Cleveland Clinic also contended that the records were necessary to further the state’s interest in fighting criminal activity.
Furthermore, the hospital pointed to a specific exception under HIPAA authorizing the disclosure of a patient’s medical records in response to a grand jury subpoena.
No exception
But the court was not persuaded, saying Ohio’s privilege statute contained no such exception. The court refused to dismiss the case, which could go to trial. The case likely will proceed in federal court because it involved a mix of state and federal issues related to Turk’s arrest.
U.S. District Court Judge Kathleen M. O’Malley noted that the state law did include limited exemptions allowing law enforcement in certain circumstances to obtain private patient information as a part of criminal investigations. That could be allowed, for example, if the case was against a physician or to get test results to determine the presence of drugs or alcohol in a patient’s blood.
The privilege statute also permits disclosure if:
* The patient or a guardian gives consent.
* The lawsuit is filed by the patient.
* The action involves court-ordered treatment.
Otherwise, it was up to the Legislature, not the courts, to create any additional exceptions to the privilege protections, O’Malley said, adding that the Ohio Supreme Court has repeatedly refused to do so.
As for HIPAA, the court recognized that the federal privacy statute does explicitly authorize the release of patients’ medical records in response to a grand jury subpoena, as well as other law enforcement requests.
But it also noted that the federal law does not preempt more stringent state standards. Because Ohio’s privacy protections — which did not allow for grand jury disclosures — were broader than those mandated by HIPAA, the state law prevailed, the district court found.
The judge added that both the state’s interest in investigating criminal activity and patients’ interests in medical records privacy were worthy of protection. But “if the right of confidentiality is to mean anything, an individual must be able to direct the disclosure of his or her own private information,” the court said, citing earlier Ohio court precedent.
Because Turk was given no notice of the grand jury subpoena, however, he had no chance to object or respond in any way to the records request, the judge noted. Nor was there any attempt to narrowly tailor the inquiry to the scope of the criminal charges.
The court concluded that the state’s interests were not enough to outweigh Turk’s privacy rights.
“While it may be more efficient for a grand jury to be permitted to obtain an individual’s medical records … giving law enforcement unbridled access to medical records could discourage patients from seeking medical treatment,” O’Malley wrote.
Legal experts said the case is an important wake-up call for physicians who may think they are doing the right thing when law enforcement comes knocking, and they warn that doctors should take note of the interplay between state and federal law.
“HIPAA sets a floor, not a ceiling, and this case is a classic example of that principle,” said Peter Leininger, a health care lawyer in Fulbright & Jaworski LLP’s Washington, D.C., office. “You’ve got to check state law, too. Simply complying with HIPAA is not always going to be enough.”
State and federal privacy laws vary as to what types of medical information can be disclosed and when, said D.C.-based health privacy lawyer Marion K. Goldberg. But such statutes generally strive to find a balance between impeding a lawsuit and protecting patient privacy.
State law may specify, for example, that certain sensitive information related to drug or sexual abuse or HIV status generally remain privileged, said Goldberg, a partner with Winston & Strawn LLP. But if there is an ongoing crime, such as domestic violence, or an impending danger, documents that are otherwise off limits may be accessible.
State laws also may have different definitions as to what constitutes medical information, Goldberg said. She noted, for example, that the Ohio court found no privacy violation when the Cleveland Clinic gave police only the names of Turk’s doctors, before the subpoena for more detailed information was issued. The court said state law did not consider names to be privileged medical information.
However, disclosing even names “may be enough to create an issue under HIPAA,” Goldberg said. “Suppose the name of the doctor they gave out was a psychiatrist … or a subspecialist in drug and alcohol abuse. Wouldn’t that tell us something?”
If doctors are faced with a disclosure request, “as a caution, you have to look at the type of record being subpoenaed and what state and federal laws are regarding that type of record. Then you have to comply,” Goldberg said.
What doctors cannot do is ignore it, experts warned. Violating a subpoena or court order carries penalties, they said, ranging from contempt of court to fines, even jail time.
On the other hand, state law may permit patients to sue over improper disclosures, Goldberg said. While HIPAA precludes such private actions, it does allow patients to complain to the government, which can impose financial penalties for privacy breaches, she added.
But physicians also have the right to contest a records request on behalf of their patients or to ask a judge for further clarification, experts said.
There are ways to work with the courts or parties involved to alleviate confidentiality concerns, while providing the information sought, Leininger said. For example, state law may prohibit certain disclosures under a broad subpoena, but allow for a more limited, protective court order.
Nevertheless, when in doubt, consult a lawyer, Goldberg said, “because you can get caught, and that’s really the lesson in this.”
Source