The Vermont Supreme Court issued a ruling permitting a patient to take legal action against a hospital and nurse for privacy violation, irrespective of Vermont law and the HIPAA law that do not allow private cause of action for violation of privacy.
The legal suit alleges negligence in the sharing of private data gathered from the patient whilst getting treatment in the hospital’s emergency room. The hospital staff was treating a laceration on a woman’s arm in the ER. The ER nurse informed the police that the patient drove to the hospital while drunk, and was planning to drive home right after being treated.
The nurse noticed the patient’s breath had alcohol smell. The nurse made use of the alco-sensor to determine the patient’s blood alcohol level, which was 0.215. Under Vermont law, the woman’s blood alcohol level was more than twice the allowed limit when driving. The hospital’s police officer arrested the patient after being informed, nonetheless no charges were made.
The female patient later on filed a case against the hospital as well as the nurse for privacy violation since she revealed her health information to law enforcement.
As per the HIPAA Privacy Rule, there are limited uses and disclosures of protected health information (PHI) such as in treatment, medical procedures and billing, still there are exceptions. One is in case a disclosure could lead to a potential serious risk to an individual’s safety and health. The Privacy Rule permits such a disclosure if a person to whom the information is disclosed can prevent or reduce danger to the patient and the public.
With consideration of the scenarios of the lawsuit, the Supreme Court eventually agreed that the disclosure was acceptable and proper. The disclosure was considered to have been done to ease off a threat to the patient or the public. The Court ruling was based on no reasonable evidence to claim the disclosure was for some other reason. The plaintiff was unable to prove that the privacy information disclosure was done for another reason, like for arresting and charging the patient.
The ruling is absolutely sensible; yet, what is strange is allowing the case to stand even if state and HIPAA regulations don’t permit a private cause of action. Patients could not sue healthcare companies over privacy violations according to HIPAA laws and Vermont laws. The case standing was based upon a common-law private right of action for damages.
Even if the lawsuit didn’t do well, other people may cite the case when filing a lawsuit against their healthcare providers over the violation of their privacy.