Ms. C was working the weekend shift in the emergency department of the medical center where she had been employed for the last three years as a nurse practitioner. Ordinarily, she would have been unhappy about having the weekend shift during the summer, but in this case, she did not mind because her close friend, Mrs. D, the director of the emergency department, would also be working that weekend. Their schedules did not often align, and both women were happy on the rare instances when they were scheduled to work together.
On Saturday evening, an ambulance brought in a new patient, Mr. P, who had been involved in a one-car accident. Mr. P needed treatment for a concussion, bruised ribs, possible fractures, and contusions. The patient was conscious and confided to Ms. C during the examination that he had been drinking and had then fallen asleep at the wheel while driving home, crashing into a tree. Ms. C noted this in the patient’s file, as she was recording his injuries and treatment plan.
While Mr. P was undergoing x-ray imaging, Ms. C and Mrs. D spoke for a few minutes.
“Did you know that your patient is a police officer?” Mrs. D asked.
“No,” Ms. C replied. “How do you know?”
“I saw the intake forms,” Mrs. D said. “My neighbor is a captain on the force. I’m going to give him a quick call and see whether he knows this guy.”
Ms. C nodded and asked Mrs. D to keep her posted.
An hour later, Mrs. D waved Ms. C over. “I called my neighbor, the cop,” she said, “and you won’t believe this! He’s actually the supervising officer of our patient! So, he’s coming down here to see how he’s doing. I’ll let you know when he gets here.”
Ms. C nodded and went back to treating patients. She did not mention the conversation to Mr. P, nor did she ask him whether he wanted anyone notified.
Sometime later, the supervising officer arrived in the emergency department. Mrs. D asked Ms. C to bring over Mr. P’s file and told the supervising officer that he was welcome to go in and visit Mr. P after he looked at the patient’s file. After the supervising officer reviewed the file, Ms. C led him to Mr. P’s room.
The rest of the weekend passed uneventfully for Ms. C, but that was not the case for Mr. P. After reading his file and determining that he had been drinking and driving, his supervising officer reported him to the police force and disciplinary action was taken. Mr. P was temporarily suspended from his job, and when he finally was allowed to return, he had been demoted to a lower position with a lower salary.
Mr. P retained an attorney who told him that what had happened was a violation of the federal Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. “Your health care practitioners improperly divulged protected health information to your employer,” the attorney said. “We have to file a complaint with the U.S. Department of Health and Human Services, which enforces the HIPAA Privacy Rule, and they will determine if there was a violation. Once that happens, we can file a civil suit against the hospital, emergency department director, and nurse practitioner.”
A complaint was filed, an investigation was launched, and the conclusion of the government investigators was that Mrs. D and Ms. C had impermissibly disclosed Mr. P’s protected health information.
Mr. P’s attorney filed a civil suit seeking both compensatory and punitive damages from the medical center, Mrs. D, and Ms. C. The defendants replied by filing a motion to dismiss, claiming that their conduct was not sufficiently outrageous to justify punitive damages.