Employer Liability for Employee's Intentional Violation of Patient Confidentiality

By Michael L. Smith, R.R.T., J.D.

(May 3, 2013) – A patient in New York is suing a clinic because an employee of the clinic intentionally disclosed the patient’s confidential health information. These cases still happen occasionally despite all the training provided to healthcare providers on the confidentiality of health information. The employee was fired as soon as the employer learned of the disclosure. The patient still sued the clinic even though the employee was fired.

The patient was seeking treatment from the clinic for a sexually transmitted disease. The clinic employee recognized the patient and then accessed the patient’s records without authorization to see why the patient was in the clinic. The employee then sent the patient’s confidential health information to her sister-in-law, who was the patient’s girlfriend. According to the court documents, the employee sent six text messages disclosing the patient’s confidential health information. Family loyalty aside, this is not a permitted disclosure of the patient’s health information.

The New York case is important to hospitals and other healthcare entities because it may expand their liability for the intentional acts of their employees. The attorney for the patient is asking the courts to make the employer strictly liable for intentional breach of patient confidentiality by the employee.

Generally, an employer is only liable for the negligent acts of its employees that are committed within the scope of the employee’s employment. An employer is generally not liable for the intentional conduct of an employee that is outside the scope of the employee’s employment. However, like most things legal, there is an exception to the exception. An employer may be held liable for intentional conduct of an employee if the employer knew the employee had a propensity to commit the intentional act, or if the intentional act was furthering the employer’s purposes.

A patient that has their confidential information wrongfully disclosed can sue the individual that made the disclosure, but that individual usually does not have any money or other assets to satisfy a judgment. Insurance policies do not cover intentional conduct, so there is no third party available to compensate the patient for the intentional actions of the employee either. Patients file suit against employers in these matters because the employer is more likely to have the ability to pay the patient. If the patient’s lawsuit in New York is successful, there will be a dramatic increase in the number of these type cases actually filed in the courts.

The clinic employee in New York had no justifiable reason to disclose the patient’s confidential information. All states have mandatory reporting requirements for communicable diseases including notifications to potentially infected individuals. Those laws cover sexually transmitted diseases and would be the proper means for the clinic, not the employee, to notify the appropriate individuals about the patient’s condition.

In addition to being fired, the employee will probably be disciplined by the licensing board. Most licensing boards revoke licenses when practitioners intentionally disclose confidential health information in violation federal and state laws. All healthcare providers need to adhere to their obligations to maintain the confidentiality of patient health information.

Michael L. Smith, RRT, JD, is board certified in health law by The Florida Bar and practices at The Health Law Firm in Altamonte Springs, Fla. This article is for general information only and is not a substitute for formal legal advice.

This article was originally published in Advance for Respiratory Care and Sleep Medicine.