Go to archive
Vol. 2008-4-b | April, 2008

HIPAA – Medical Records

{¶ 13} “[I]n Ohio, an independent tort exists for the unauthorized, unprivileged disclosure to a third party of nonpublic medical information that a physician or hospital has learned within a physician-patient relationship.” Biddle v. Warren Gen. Hosp., 86 Ohio St.3d 395, 1999-Ohio-115, syllabus. An unauthorized disclosure under Biddle is “the tort of breach of confidence.” Id., 403. The only way to avoid liability for an unauthorized disclosure is for the hospital or other medical provider to obtain the patient’s consent. Id., 406.

{¶ 14} One of the first cases in Ohio to deal with the issue of an unauthorized disclosure by a physician is Hammonds v. Aetna Cas. & Sur. Co. (N.D. Ohio, 1965), 243 F.Supp. 793. Hammonds explains the purpose of physician-patient confidentiality as follows:

{¶ 15} “A patient should be entitled to freely disclose his symptoms and condition to his doctor in order to receive proper treatment without fear that those facts may become public property. Only thus can the purpose of the relationship be fulfilled.” Id., 799, quoting Hague v. Williams, 37 N.J. 328, 181 A.2d 345, 349 (1962).

{¶ 16} As is evident in Biddle v. Warren General Hospital, 86 Ohio St.3d 395, 399, 1999-Ohio-115, a physician’s breach of a patient’s confidence in the form of an unauthorized disclosure of that patient’s medical information is an independent tort separate and distinct from the tort of invading one’s privacy.

{¶ 17} Hammonds v. Aetna Cas. & Sur. Co. (N.D. Ohio, 1965), 243 F.Supp. 793, provides that an unauthorized patient disclosure by a physician or hospital constitutes a breach of their fiduciary duty.

{¶ 18} “A claim of breach of a fiduciary duty is basically a claim of negligence, albeit involving a higher standard of care. And in negligence actions, we have long held that `one seeking recovery must show the existence of a duty on the part of the one sued not to subject the former to the injury complained of, a failure to observe such duty, and an injury resulting proximately therefrom.'”

{¶ 19} Strock v. Pressnell (1988), 38 Ohio St.3d 207, 216, quoting Stamper v. Parr-Ruckman Home Town Motor Sales (1971), 25 Ohio St.2d 1, 3. {¶ 23} The tortious conduct of an unprivileged disclosure occurs the moment the nonpublic medical information is disclosed to an unauthorized third-party. The tortious conduct of the Clinic does not depend on what the duties of the third party are or what the third party subsequently does with that information. Any duties the third party may have had do not transform it into an “authorized” party. The key is whether the receiving party is “authorized” to receive the record.

{¶ 24} Moreover, the Clinic is mistaken when it claims that no one at Nestle read plaintiff’s records. To the contrary, the human resources person at Nestle returned these records to plaintiff because he had read enough of plaintiff’s records to know that they did not have anything to do with plaintiff’s employment and therefore returned the records to plaintiff.

{¶ 27} In 1996, Congress enacted HIPAA. One of HIPAA’s purposes is to protect the privacy of an individual’s personal health information (“PHI”). 42 U.S.C.A. §1320d-2(d)(2)(A); see Smith v. Am. Home Prods. Corp. Wyeth-Ayerst Pharm., (2003), 372 N.J. Super. 105, 855 A.2d 608. Under HIPAA, “covered entities,” including (1) health plans; (2) health care clearinghouses; and (3) health care providers, are required to follow specific regulations (45 CFR §§160-164) relating to the collection, use, or disclosure of an individual’s personal health information. Generally, a covered entity may not disclose health information of persons without their consent. 45 CFR §164.508(a); see 45 C.F.R. §160.103; §164.501.6 Herman v. Kratche,, 2006-Ohio-5938. (CA8 CUY Decided 11/08/2006)

AUTHOR / EDITOR: J. NORMAN STARK is an Attorney-at-Law, a Registered Architect, (AIA, NCARB) Registered Landscape Architect, Interior Designer, Planner and Senior Appraiser (ASA), admitted to practice law before the Bar of Ohio, the US District Courts, Ohio and Illinois (Central Dist.), the US Court of Appeals, and the United States Supreme Court. He is a Mediator, Arbitrator and Litigator with experience in Business, Construction Law, and Public Works, and with additional experience in Real Estate, Construction Attorney (Legal Project and Crisis Management), and as an Expert Witness (Forensic Architect). His office is in Cleveland, Ohio.