HIPAA-Protected Patient Information Disclosure to Law Enforcement

A nurse being investigated for prescription fraud objects to the release of her medication records.

Issue of the Case

When a pharmacy releases the prescription medication records of a patient covering a 10-year period of time to a local law enforcement officer, does that violate the Health Insurance Portability and Accountability Act (HIPAA) or a fiduciary duty that the pharmacy has to maintain such records as confidential? Further, should the pharmacy be held liable for intentional infliction of emotional distress in conjunction with the release of patient-specific information?

The Facts of the Case

This case arose in a Southwestern state where the patient was licensed as a registered nurse. She had experienced a variety of health challenges and been prescribed various federal legend medications for disorders. One legitimate prescription for Soma was issued by a physician with whom she was having a romantic affair, which she subsequently ended. Later, when she sought a refill of the prescription, the pharmacist called the physician to verify only to be told that he had no knowledge of the prescription or the patient.

This was reported to the local police department and a police officer was assigned to investigate the matter. As part of the investigation, the officer requested the patient’s medication records from the location of the national pharmacy chain where the refill had been requested. Those records were released to him.

The officer confronted the patient and interrogated her about possible prescription fraud. His investigatory activities led to the patient being terminated from her position as a nurse. The officer engaged in a variety of improprieties as part of pursuing the investigation and he ultimately was removed from the case. In fact, the police department issued a “To Whom It May Concern” letter stating that the “original allegations of prescription fraud…are unfounded.” It continued by stating that the “officer made some errors of judgment and incorrectly disclosed information during his investigation....”

Suffering a variety of consequences such as “loss of her employment, damage to her reputation, and emotional distress resulting in loss of sleep, weight loss, loss of appetite, nightmares, anxiety, and depression,” she filed a lawsuit in federal court against a variety of parties, including the pharmacy chain. With regard to the pharmacy, 3 legal theories were advanced on which the plaintiff hoped to recover—violation of the federal HIPAA statute, breach of a fiduciary duty owed to patients to hold their medication-related information confidential and protect their privacy, and intentional infliction of emotional distress.

The defendant pharmacy chain moved to have the claims dismissed.

The Court's Ruling

All claims against the pharmacy chain were dismissed by the court.

The Court's Reasoning

Turning first to the HIPAA-based allegation, although the plaintiff alleged that she had an “absolute right to have her medical records and prescription history protected and never disclosed” to any third party, the court pointed to several relevant provisions in the federal regulations implementing the statute. One regulation specified that “A covered entity may disclose protected health information for a law enforcement purpose to a law enforcement official. . . .” Another regulation directed that “A covered entity may disclose to a law enforcement official protected health information that the covered entity believes in good faith constitutes evidence of criminal conduct that occurred on the premises of the covered entity.” Based on those provisions, the first allegation was dismissed.

With regard to the allegation that the pharmacy had a “fiduciary duty to protect the privacy and confidential medical records” of patients at the pharmacy, the court first pointed to a provision in state statutes directing that a pharmacy keep prescription records “open for inspection at all times by... officers of the law in performance of their duties.” A slightly different statutory provision requires that health care providers disclose medical records “without the patient’s written authorization as otherwise required by law….” A final statute provides immunity for disclosure of medical records in good faith and establishes a presumption of good faith. The court found that the staff at the pharmacy chain acted in good faith so this second claim was dismissed.

The last claim was for intentional infliction of emotional distress. To support such a claim, the plaintiff must allege that the defendant intentionally caused severe emotional distress by extreme and outrageous conduct. An earlier court opinion had stated that “The element of extreme and outrageous conduct requires that the plaintiff prove defendant’s conduct exceeded all bounds usually tolerated by decent society and caused mental distress of a very serious kind.” This court did not find the action of the staff in the pharmacy to rise to that level, so the third argument was also dismissed.

Dr. Fink is professor of pharmacy law and policy at the University of Kentucky College of Pharmacy, Lexington.