Chapter 2: HIPAA for Mental Health Practitioners
Part 4: How HIPAA Violations Can Be Considered a Form of Negligence
In 2014, a court case opened the door to suing healthcare providers over HIPAA violations. This is a big deal because, prior to the lawsuit, it was unclear whether adhering to HIPAA could be considered a professional duty and whether failing to uphold HIPAA could be considered a professional liability violation.
Here's what happened, according to HealthITSecurity :
- A patient of Westport, Connecticut-based Avery Center for Obstetrics and Gynecology instructed the Center not to disclose her medical information to the father of her child.
- Avery received a court subpoena to disclose the patient's health information.
- Avery complied with the court, handing over the record. It did not notify the patient or ask for legal guidance before doing so.
- The patient sued Avery for negligence, claiming that it had a duty to maintain her confidentiality.
- The Connecticut Supreme Court ruled in favor of the patient, effectively introducing the possibility of negligence suits against healthcare practitioners who violate HIPAA.
Before this ruling, individuals could not file such a lawsuit. The closest they could get to suing over HIPAA violations would be to file an invasion of privacy suit. But this latest ruling views HIPAA violations as a form of negligence.
A Connecticut judge ruled that HIPAA violations can be a form of negligence, which greenlights malpractice suits over confidentiality breaches.
This development is especially troubling for mental health practitioners like social workers who are often subpoenaed to disclose confidential information about their charges.
And that's not all. According to The Healthcare Blog , Walgreens was successfully sued over a HIPAA violation in 2013 — to the tune of $1.44 million, no less. A Walgreens pharmacist looked up her husband's ex-girlfriend's medical file under the suspicion that the ex had passed along an STD to him. Once uncovering the information, she told her husband, who then texted the ex-girlfriend. Naturally, the ex sued Walgreens, claiming it failed to properly supervise and educate its employee about HIPAA regulations.
In this case, the judge determined that under Missouri law, HIPAA could be used to establish a legal duty of care, which informed the ruling against Walgreens. Such a lawsuit could also establish precedence for future lawsuits over HIPAA violations that happen via text, social media, and other kinds of electronic communications.
For both cases, Malpractice Insurance (also called Professional Liability or Errors & Omissions) could cover the cost of defending your practice against these claims because both judges determined that HIPAA is a standard of care and violations of it are a form of negligence. Professional Liability Insurance can cover the legal costs associated with professional negligence claims, but we'll go over that in more detail in the next chapter.
This brings us to the next hot topic: how social media and HIPAA intersect and collide for social workers, psychologists, and therapists.
Next: Chapter 3: An Introduction to Social Media Standards for Mental Health Professionals