The Vermont Supreme Court released a ruling allowing a patient to sue a hospital and an employee for privacy violation, in spite of Vermont law and the fact that HIPAA does not have a private cause of action for personal privacy violations.
The lawsuit alleges there is negligence in disclosing personal information obtained from the patient while receiving treatment in the emergency room. A woman was treated for a laceration on her arm in the ER room. The ER nurse notified law enforcement and told them that the patient who was drunk drove to the hospital, and planned to drive home after the treatment.
The nurse noticed alcohol odor from the patient’s breath. The nurse used the alco-sensor to measure the patient’s blood alcohol content, which was 0.215. According to Vermont law, her blood alcohol level was over two 2.5 times the legal limit for driving. A police officer of the hospital arrested the patient after being notified, though charges were dropped later.
The female patient later sued the hospital and the nurse for privacy violation because she disclosed her health data to law enforcement.
According to the HIPAA Privacy Rule, the uses and disclosures of protected health information (PHI) are limited to treatment, medical operations and payment, yet there are exceptions. One exception is when a disclosure results to a perceived critical threat to a person’s health or security. The Privacy Rule allows such a disclosure when it is made to an individual who could stop or reduce a danger to the patient or the general public.
With the circumstances of the case, the Supreme Court ultimately concluded that the disclosure was reasonable and appropriate. The disclosure was deemed to have been done to abate an impending threat to the patient and the general public. The Court rules that there was no reasonable factfinder to say the disclosure was for another reason. The plaintiff was unsuccessful in proving that the disclosure was made for another purpose, such as to arrest and charge the patient.
The ruling is completely sensible; however, what is unusual is the giving the case a standing even when state and HIPAA laws don’t allow a private cause of action. Patients cannot sue healthcare providers over violations as per HIPAA laws and Vermont laws. The case was given standing based on a common-law private right of action for damages.
Though the lawsuit did not succeed, other patients may cite it when filing a lawsuit alleging the violation of their privacy by their healthcare providers.