Friday, May 17, 2019

SCOVT recognizes a common-law private right of action for damages resulting from the unjustified disclosure to a third party of information obtained by medical personnel during treatment , and affirms summary judgment that threat of imminent and serious harm to plaintiff and the public, under HIPAA, justified medical provider’s disclosure to third persons of information obtained during treatment.

Elizabeth Lawson v. Patricia Halpern-Reiss and Central Vermont Medical Center, 2019 VT 38 [filed 5/17/2018]

EATON, J. In this appeal, we are asked to recognize a common-law private right of action for damages resulting from the unjustified disclosure to a third party of information obtained by medical personnel during treatment. Plaintiff alleges in her lawsuit that she incurred damages as the result of an emergency room nurse informing a police officer that she was intoxicated, had driven to the hospital, and was intending to drive home. The trial court granted defendant Central Vermont Medical Center (CVMC) summary judgment based on its determination that nothing in the record supported an inference that the nurse’s disclosure of the information was for any reason other than her good-faith concern for plaintiff’s and the public’s safety.

In this opinion, we recognize a common-law private right of action for damages based on a medical provider’s unjustified disclosure to third persons of information obtained during treatment. Like the trial court, however, we conclude that CVMC was entitled to judgment as a matter of law because, viewing the material facts most favorably to plaintiff and applying the relevant law we adopt today, we conclude that no reasonable factfinder could determine that the disclosure was for any purpose other than to mitigate the threat of imminent and serious harm to plaintiff and the public. Accordingly, we affirm the trial court’s judgment.

HIPAA regulations permit “disclosures to avert a serious threat to health or safety.” 45 C.F.R. § 164.512(j). In relevant part, the regulation permits a “covered entity” to disclose “protected health information” as long as two conditions are met: the covered entity has a good-faith belief that the disclosure is “necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public,” and the disclosure is “to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat.” Id. § 164.512(j)(1)(i). The regulation further provides that a covered entity disclosing information pursuant to this exception is “presumed to have acted in good faith with regard to a belief described in” the exception. Id. § 164.512(j)(4).

The presumption of good faith in HIPAA, § 164.512(j)(4), which we adopt for purposes of analyzing the common-law tort we recognize in this decision, shifts the burden to plaintiff to make some showing that the nurse’s disclosure that plaintiff had driven to the hospital and was blatantly intoxicated was not made in good faith. Plaintiff failed to satisfy her burden

No comments:

Post a Comment