An Illinois appellate court recently held that a patient's medical privacy rights were violated after the attorneys who secured him a $4.2 million verdict released details of his condition and medical history in the media after the trial concluded.
Background Facts
The Plaintiff, Doe, was a former corporate attorney who retained a law firm to represent him as part of a medical malpractice suit against a hospital and its medical staff. Doe attempted suicide after he was admitted into the hospital's emergency room for a pill overdose. Doe sued the hospital for malpractice and obtained a $4.2 million verdict.
As part of the litigation, the hospital had secured access to Doe's protected health information and requested a qualified protective order under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) 42 U.S.C. §1320d (2012).
After the trial was concluded, Plaintiff's attorneys issued a press release regarding the trial. In the press release, the firm provided details regarding Doe's diagnoses, his attempted suicide, injuries and the further impact of his injuries moving forward. One of the Doe's lawyers also commented on the details of the case in the Chicago Daily Law Bulletin. Doe's real name was included in both the press release and the Law Bulletin article.
Doe filed a new suit claiming that his firm violated his medical privacy rights under state and federal law when it disclosed his medical and identifying information without first obtaining his informed consent to do so. Doe claims that he was damaged by these wrongful disclosures.
The law firm filed a motion to dismiss arguing that the state law and HIPAA did not apply to them because it did not have a "therapeutic relationship" with Doe. It also asserted that the information that was disclosed in the press release was already made public during the malpractice trial. Further, it contended that Doe waived his right to keep his records confidential when he put his medical condition at issue during the trial.
The trial court agreed with the defendant-firm that a therapeutic relationship had to present for the law to apply. In addition, the trial court also agreed that because the trial was public, Doe waived his right to confidentiality. Doe claims that by submitting his confidential medical records as evidence in the trial did not authorize the firm to later re-release the information in a press release and interview with a publication. Doe claims later disclosure was still a violation of the law even without the presence of a therapeutic relationship. Doe's claim was dismissed with prejudice and he appealed.
On appeal, the court sided with Doe and ruled that the defendant lawyers violated the Mental Health and Developmental Disabilities Confidentiality Act when it released private information about Doe's mental health obtained under the Health Insurance Portability and Accountability Act of 1996.
Medical Record Privacy
One purpose of HIPAA is "to protect the confidentiality of records and communications of people who receive mental health services." House v. Swedish American Hospital, 206 Ill.App. 3d 437, 442 (1990). It requires that all medical records and communications be kept confidential.
Under Illinois law, the Mental Health and Developmental Disabilities Confidentiality Act (the Act) defines a record as, "any record kept by a therapist or by an agency in the course of providing mental health or developmental disabilities service to a recipient concerning the recipient and the services provided." 740 ILCS 110/3(a) (West 2014). A therapist as a "psychiatrist, physician, psychologist, social worker, or nurse providing mental health or developmental disabilities." Id. Finally, a confidential communication is defined as, "Any communication made by a recipient or other person to a therapist or in the presence of other persons during to in connection with providing mental health or developmental disability services to a recipient." Id.
The records and information disclosed by defendant in the press release and interview qualify as protected records under the Act. As his attorneys, the defendant was privy to Doe's private information for purposes of the malpractice action, and sharing this information in an alternate forum was outside the scope of their representation. It disclosed Doe's diagnosis, reasons for a hospital stay and gave other details about his condition. The fact that the firm was not the party actually providing Doe with mental health services does not waive its liability in improperly disclosing it. "Illinois has permitted a claim under the Act even where the defendant was not a provider of mental health services." Johnson v. Lincoln Christian College, 150 Ill.App. 3d 733, 743-44 (1986). Further, the defendant's action of revealing Doe's personal medical information to the Law Bulletin and in a press release was in violation of the Act. "No person or agency to whom any information is disclosed under this Section may redisclose such information unless the person who consented to the disclosure specifically consents to such redisclosure." 740 ILCS 110/5(d) (West 2014).
The defendant also argued that Doe waived confidentiality by testifying in detail at the medical malpractice trial about his condition. The appellate rejected this argument because Doe's complaint provides that the information disclosed at trial was subject to a qualified protective order under HIPAA. Qualified protective orders generally, "restrict how health information is used, prohibiting the parties from using or disclosing the information for any purpose other than the litigation or proceeding for which such information is requested and requiring the return to the covered entity or the destruction of the information." Haage v. Zavala, 2020 IL App.(2d) 190499 ¶ 9 quoting 45 C.F.R. §164.51€(1)(v)(A),(B) (2018). The defendant's disclosure of Doe's medical details after trial in interviews and a press release to the media were in violation of both federal and state law.
Based on these considerations, the appellate panel found that Doe sufficiently alleged that the defendant violated the Act by re-releasing and discussing Doe's private medical information with outside media entities without his consent. Therefore, Doe successfully brought a valid claim against the defendant and the judgment of the lower court is reversed and remanded for further proceedings.
Moving Forward
Defense attorneys engaged in defending clients in medical malpractice cases should take close note of this decision. Law firms attempting to publicize wins on this front should be cognizant of the dangers of releasing private medical information of the client even after initial consent during public litigation. This case makes it clear that the client's consent to release such information during trial does not waive all rights to privacy in other forums. Re-releasing the client's medical information for the purpose of publicity is outside the scope of original consent and can result in liability for the firm as well as individual lawyers involved in the case.