Protections Governing Theft and Publication of Medical Records
As instances of medical data breaches increase, U.S. courts are interpreting the scope of liability stemming from them. In California, the court in Sutter Health et al. v. The Superior Court of Sacramento County (Atkins) held that patients can only recover damages if they can prove that their protected medical information was actually viewed by an unauthorized person. Meanwhile, in Travelers Indem. Co. of Am. v. Portal Healthcare Solutions LLC, a Virginia federal court found that insurers must defend class actions alleging that their insureds posted confidential records online if their policies cover publication of the information, regardless of whether the records were actually viewed.
California: Were stolen medical records viewed by unauthorized persons?
The California Confidentiality of Medical Information Act (CMIA) provides for nominal damages of $1,000 per patient against health care providers who negligently allow the unauthorized disclosure of their patients’ medical information. In October 2011, a thief broke into a Sutter Health office and stole a desktop computer containing more than four million patients’ password protected, but unencrypted, medical records. Sutter Health announced the breach in November 2011. Certain patients’ individual lawsuits for nominal damages under the CMIA soon followed, and were ultimately coordinated in a class action, exposing Sutter Health to a potential $4 billion liability. Though the trial court denied Sutter Health’s demurrer, the appellate court found that, while the CMIA prohibits unauthorized disclosure of medical information, the records at issue were not “disclosed” to the thief as it was not done voluntarily. However, the CMIA imposes “broader duties” by requiring that such information be kept confidential. Specifically, health care providers must preserve the confidentiality of such records, but no breach of that confidentiality occurs, according to the Sutter Health Court, unless “an unauthorized person views the medical information.” Therefore, the fact that a thief possessed protected medical information, absent the allegation that the information was indeed viewed, does not give rise to a cause of action for nominal damages under the CMIA. The court emphasized that the CMIA is not named the “Possession of Medical Information Act.”
Virginia: “The act or process of making known something that was previously unknown.”
Conversely, under Virginia law, confidential medical information is published and disclosed when it is posted online, even unintentionally, and even when there is no evidence a third party viewed that information. Indeed, even in suits where the only evidence was that patients viewed their own information online by searching for their names and finding their medical records, “publication” and “disclosure” had occurred, obligating an insurer’s defense of the underlying action. The definition of publication does not hinge on third-party access.
Travelers insured Portal Healthcare Solutions, a business specializing in the electronic safekeeping of medical records, from claims arising from the records’ publication. After the medical records of Glen Falls Hospital patients were mistakenly posted online, a class action was filed against Portal for failing to safeguard them. Travelers then sought a declaratory judgment that it had no duty to defend Portal, its insured, against such claims, arguing that Portal’s actions did not constitute “publication” or “disclosure” of confidential information, both coverage prerequisites. The Eastern District of Virginia relied on Black’s Law Dictionary’s definition of “disclosure” as “[t]he act or process of making known something that was previously unknown; a revelation of facts.” Unlike the Sutter Health court’s interpretation, the Travelers court found that this definition allows for involuntary disclosure, and moreover, found disclosure occurred even if the information was not made “known” to any third-party. Because the underlying class action therefore contained enough allegations to constitute publication and disclosure of protected confidential information within the meaning of the subject policies, Travelers was directed to defend Portal.