HIPAA payouts rare, but complaints can be more costly
It’s not just fines or damages to affected patients from a HIPAA violation that can hurt medical practices, advises an attorney.
It’s unlikely a patient will be able to recover financial damages from a physician in court due to an unauthorized disclosure of their medical records. However, their complaints can result in unpleasant consequences for the practice.
Most information about the Healthcare Insurance Portability and Accountability Act (HIPAA) and patients’ rights to manage who has access to their personal health information (PHI) emphasize the importance of covered entities remaining compliant with the law and the possible penalties that could result from non-compliance. Although those are important factors, patients may not understand where and how they fit into the picture. Karin Zaner, director and attorney at Kane, Russell, Coleman & Logan PC, in Dallas, Texas, says patients often think they will be entitled to financial compensation via a lawsuit, but that is actually an unlikely outcome.
Her office fields regularly calls from patients who claim doctors’ offices have allowed unauthorized access to their medical records. Zaner primarily represents physicians, but feels it is important that everyone involved understands the provisions of HIPAA, including patients, staff members and clinicians themselves.
It is unlikely that patients will be able to recover financial damages, according to Zaner. “Damages must be tied to the [unauthorized] disclosure itself,” she says. For example, if a physician’s office disclosed a person’s HIV-positive status, and then the person lost his job as a direct result of the disclosure, there is a possibility the patient could show causation and be able to recover damages. In the hypothetical scenario of the school staff learning about the patient’s hepatitis C status, the patient doesn’t’ suffer financial loss.