A recent Connecticut Appellate Court decision highlights the importance of health care provider attention to subpoenas involving patient information. In January 2018, our office published a summary of a then-recent Connecticut Supreme Court case, establishing the right of patients to sue physicians for breaching confidentiality. See Byrne v. Avery Center for Obstetrics and Gynecology, P.C., 327 Conn. 540 (2018). The Connecticut Appellate Court has now upheld the damages award for the patient against the health care provider.
In this case, the patient instructed her health care provider not to release any of her information to her ex-boyfriend. The ex-boyfriend later filed paternity actions in two states and issued a subpoena to the provider for the patient’s medical records. The subpoena instructed the provider to send a custodian of records to the probate court with the records; however, the provider mailed the records to the court. The court clerk inserted the records in the public court file, which allowed the ex-boyfriend access to the records. According to the patient, after her ex-boyfriend viewed the records, he began to harass and threaten her, leading to emotional distress.
Since early 2018, the case has continued through the judicial system for various procedural and evidentiary reasons. Despite claims that the disclosure was caused by the mishandling of the records by the court clerk who put them into the public file and claims that the plaintiff’s emotional distress was caused by the ex-boyfriend who harassed her, the Appellate Court upheld the jury verdict awarding the plaintiff over $800,000 in damages.
This case continues to be a stark reminder that all health care providers must review seemingly formal requests for patient information very carefully. Such requests generally take two forms: court orders and subpoenas. A court order is directly issued by the court. A health care provider may disclose patient health information (PHI) in response to an order of the court, provided that it discloses only the PHI expressly authorized by the order.
A subpoena, on the other hand, is often issued by an attorney in a matter as a way of requesting information from outside parties. A subpoena, while it appears official, is not akin to a court order. Absent an authorization from the patient allowing release of the requested PHI, it is prudent for the health care provider to seek a protective order from the court (i) prohibiting the parties from using or disclosing the PHI for any purpose other than the litigation or proceeding for which such information was requested and (ii) requiring that the PHI (including all copies made) be returned to the health care provider or destroyed at the end of the litigation or proceeding.
This case illustrates that releasing PHI based on a subpoena absent patient authorization or a court order may not only result in an investigation and potential penalties under HIPAA, but it could also lead to a viable cause of action by a patient.
To minimize risk of improperly disclosing PHI in connection with a subpoena, health care providers should take the following steps:
- Develop an internal process which requires all subpoenas to be provided to a department or small group of individuals. Ensure that a back-up is always in place so that the system does not break down in the event of the absence of an employee.
- Recognize that time is often of the essence. While this may be difficult because health care providers are busy, subpoenas often require a very quick response. Getting a subpoena to the designated department or individuals quickly is essential.
- Do not ignore a subpoena, even if you are concerned that you missed a deadline. Courts can issue warrants and sanctions.
- Ensure that those charged with reviewing subpoenas have the proper training and have either in-house or outside resources available to assist quickly when questions arise.
For more information on this bulletin, please contact:
Stephanie Sprague Sobkowiak at 203.772.7782 or ssobkowiak@harrisbeachmurtha.com
Julia Boisvert at 860.240.6018 or jboisvert@harrisbeachmurtha.com
