[ Wednesday, March 24, 2004 ]
Class Action Privacy Lawsuit:
In California, the California Consumer Health Care Council has filed a class action lawsuit
against Kaiser alleging that Kaiser has violated medical record privacy by providing medical information on patients to attorneys and others when the patient has sued or threatened to sue Kaiser, or when Kaiser has determined whether a suit is likely to be coming. The information, it seems, is used by Kaiser to investigate the claim or complaint and begin planning legal defenses to the lawsuit.
As is usually the case, the press driver in this case is not the lawsuit, but the press release issued by the CCHCC. The upon a quick review of the pleadings, it looks like the major claim is not under HIPAA, but under California's medical record privacy statute. Under HIPAA, the action described is likely authorized: HIPAA allows a covered entity (like Kaiser in this case) to use and disclose PHI without authorization for treatment, payment, or health care operations. This disclosure wouldn't be treatment or payment, but would fit within hte definition of health care operations in the minds of most HIPAAcrats. The definition of health care operations includes "reviewing the competence or qualifications of health care profesionals, evaluating practitioner and provider performance, . . . conducting or arranging for medical review, legal services, and auditing functions, . . . and . . . business management and general administrative activities of the entity. . . " It would seem that these activities fit within the definition, making them OK under HIPAA. However, there might be an argument that the stricter California statute does not allow them.
If that's the case, the California statute is preposterous. Surely a hospital or physician group targeted for a lawsuit by an individual has the right to review the individual's medical record and seek guidance and assistance from attorneys, health care providers, and others to determine the validity of the claim and the appropriate ways to defend itself.
Jeff [12:02 PM]
Blogger: HIPAA Blog - Edit your Template