In a ruling that sends a strong message about the importance of EMS personnel respect for patient privacy, the Wisconsin Court of Appeals upheld a jury’s verdict that an emergency medical technician invaded a patient’s privacy by revealing confidential information about a patient the EMT treated and transported, allegedly about the patient’s overdose. The court upheld an award against the volunteer EMT for $3,000 in compensatory damages, and $30,460 in attorneys’ fees. The case was brought under Wisconsin law, and not the recently enforced HIPAA federal privacy regulations (which do not have a private right of action). This case really underscores the importance of having in place strong patient confidentiality laws, even if your EMS organization is not a covered entity under HIPAA. Here the volunteer EMT was sued individually, as was the EMT’s volunteer fire department and its insurance company. (Pachowitz v. Ledoux, 2003 WL 21221823 (Wis. App. 5/28/03)
Here’s what happened according to the court ruling issued May 28th:
The Facts
The defendant EMT and three other members of the volunteer department responded to an emergency 911 call at the plaintiff’s residence regarding an overdose or possible overdose. Upon arriving at the residence, the ambulance crew discovered the patient unresponsive and with poor vital signs. After treating the patient and transporting her to the hospital, the EMT returned home and later spoke to a friend, to discuss the fact that she had assisted in transporting the patient to the hospital emergency room for a possible overdose.
Prior to the emergency call, the EMT had never met the plaintiff. However, about two weeks prior to the incident, the EMT was socializing with a group of people including the friend she spoke to about the call to the plaintiff’s home, when the her friend and another woman spoke about the plaintiff and her medical condition. During this conversation, the EMT learned that her friend worked with the plaintiff at an area hospital. The EMT gained the impression that her friend and the plaintiff were very close friends.
The EMT testified that she placed the telephone call to her friend after the ambulance call because she was concerned about the plaintiff and thought her friend could possibly be of assistance to the plaintiff. Following the EMT’s telephone call, her friend drove to the hospital where she revealed information about the ambulance call to the plaintiff’s home and discussed the plaintiff’s situation with other hospital staff.
The Lawsuit
The plaintiff filed the lawsuit against the defendants alleging that the EMT had defamed her and violated her privacy by publicizing information concerning her medical condition and making untrue statements indicating that she had attempted suicide. The plaintiff also alleged that she had been and was continuing to undergo medical care due to bodily illness and that she had suffered a “reaction to medication” when she was taken to the hospital by the volunteer fire department ambulance. (Note: the patient died in a fire shortly after the lawsuit was filed, and the family took her place in the lawsuit).
The defendants argued that the EMT’s communication to her friend was not made within the “scope of her employment” with the volunteer fire department. Because of this conflict, the volunteer EMT was the represented by separate counsel. Attorneys for the fire department and EMT also argued on the appeal that an invasion of privacy occurs only when someone tells “the public or a sufficient number of persons” to effectively cause the public dissemination of private information.
The Ruling
Telling just one person—in this case a friend of the EMT who then told others—can be enough to invade someone’s privacy, the appeals court ruled. The appeals court agreed with the jury that although the EMT told only one person about the overdose, that person turned around and told about 10 more people, including co-workers of the patient.
The appeals court upheld the jury’s verdict that the fire department and its insurer had to pay the plaintiff’s estate $3,000 for the invasion of privacy and attorney fees of $30,460, plus court costs, which amounted to about $4,000 in filing fees and other mandatory filing costs. But the appeals court disagreed with the trial court’s ruling that the defendants should pay double the court costs and reversed that portion of the trial court decision. But the compensatory damages award and attorneys’ fees award were upheld.
Key Lessons to Take Away From This Case
State Invasion of Privacy Laws Are Powerful Weapons! State law claims for invasion of privacy and defamation can be potent litigation weapons for plaintiffs harmed by improper release of their medical information—and some respect even more so than the federal privacy regulations under HIPAA, especially when it comes to damage awards. Virtually every state has laws that allow for claims to be brought like this one, regardless of whether you are covered under the federal privacy regulations or not. And You don’t have to be a paid employee or even a member of the ambulance service to subject yourself and your organization to a potential lawsuit under state law. So even if you are not a covered entity under HIPAA, you can still get burned big time in state court under state laws and common law claims. Many state EMS laws have strict confidentiality provisions as well, and an ambulance service license or EMT or medic certification can be placed in jeopardy if these laws and regulations are violated. Also, paying the plaintiff’s attorneys fees, as in this case, can be the biggest portion of the award and can add up to many thousands of dollars.
“Good Intentions” Are Not A Defense When Leaking Confidential Patient Information! Good intentions or not, confidential patient information learned while “on the job” should never be shared with those outside the organization who do not have a “need to know” the information for patient care or billing purposes. Here, there was evidence that the EMT defendant shared the information with her friend because she thought the her friend, who apparently knew the patient, could be of some help. Instead, her “friend” blabbed the information to other hospital staff members where the plaintiff had also worked. In other words, loose lips sank the ship. Lesson: When working or volunteering on the ambulance, what you here there, what you see there, when you leave there, let it stay there! Also, good intentions are not a defense when it comes to invasion of privacy or defamation claims brought under state laws.
You May Be Out on the Limb By Yourself! You can get sued individually in these right to privacy cases brought under state law. In this case, the plaintiffs even sought to bring in the defendant EMT’s homeowner’s insurance to see if there would be coverage. (The EMT’s homeowners insurance company was later dismissed). As an individual EMT or medic, violating patient privacy rules could put you at odds with your very own service, which may be forced to distance itself from you, claiming that your conduct was outside the scope of your duties, as was argued here. (Which means your company may claim they can’t then be liable for your actions!) This may mean you’ll have to go out and hire your own attorney to defend you, which is not cheap!
Patient Confidentiality Policies and Enforcement of Those Policies Are a “Must Do” Now Item! Now more than ever, with HIPAA and the heightened sensitivity to patient privacy, your EMS organization must have all the right policies and procedures in place to safeguard patient information, even if you are not a “covered entity” under HIPAA. (See this month’s LawBytes column on Merginet for a thorough discussion on the subject of covered entities. Go to: www.merginet.com/emsnewsfiles/503_17.shtml) The lesson here is that there are more laws than HIPAA out there to protect patient privacy, and many state laws may vary, but HIPAA is the first law to bring a standard level of patient privacy protection to all 50 states.
Expect an Attack on Several Fronts If You Violate Patient Privacy. If your organization is involved in an invasion of privacy lawsuit, you can expect a multiple count state court lawsuit as well as a potential action by the federal government under HIPAA. In fact, the federal government has recently posted on its HIPAA web site, a “complaint form” that makes it very easy for someone to file a complaint with the government if they feel their privacy rights have been violated. (Go to www.hhs.gov/ocr/privacyhowtofile.htm for information on how to fill out the easy-to-complete HIPAA complaint form!) These complaints won’t always come from patients and family members, but could also come from neighboring ambulance services who are not happy with another service who does not comply with the privacy regulations, or a disgruntled current or former volunteer or employee.
A little blabbing may well be too much! In this case, the court found that just one improper disclosure of confidential information was enough to trigger liability. That person who received the information from the defendant EMT then went on to tell others! The importance of keeping the pie hole shut after a call in all cases is very evident in this case.
Prevention and Training are The Key! Every EMS organization must actively work to prevent leaks and “loose lips” about patient care wherever and whenever possible. This requires a strong commitment from the top leadership, good patient privacy policies, and an active and ongoing education program that emphasizes the absolute critical importance of patient privacy.(Full text of the case can be found at: biotech.law.lsu.edu/cases/privacy/Pachowitz.htm).
Copyright, 2003, Page, Wolfberg & Wirth, LLC, www.pwwemslaw.com.
