Protections Governing Theft and Publication of Medical Records

Carlton Fields

As instances of medical data breaches increase, U.S. courts are interpreting the scope of liability stemming from them. In California, the court in Sutter Health et al. v. The Superior Court of Sacramento County (Atkins) held that patients can only recover damages if they can prove that their protected medical information was actually viewed by an unauthorized person. Meanwhile, in Travelers Indem. Co. of Am. v. Portal Healthcare Solutions LLC, a Virginia federal court found that insurers must defend class actions alleging that their insureds posted confidential records online if their policies cover publication of the information, regardless of whether the records were actually viewed.

California: Were stolen medical records viewed by unauthorized persons?
The California Confidentiality of Medical Information Act (CMIA) provides for nominal damages of $1,000 per patient against health care providers who negligently allow the unauthorized disclosure of their patients’ medical information. In October 2011, a thief broke into a Sutter Health office and stole a desktop computer containing more than four million patients’ password protected, but unencrypted, medical records. Sutter Health announced the breach in November 2011. Certain patients’ individual lawsuits for nominal damages under the CMIA soon followed, and were ultimately coordinated in a class action, exposing Sutter Health to a potential $4 billion liability. Though the trial court denied Sutter Health’s demurrer, the appellate court found that, while the CMIA prohibits unauthorized disclosure of medical information, the records at issue were not “disclosed” to the thief as it was not done voluntarily. However, the CMIA imposes “broader duties” by requiring that such information be kept confidential. Specifically, health care providers must preserve the confidentiality of such records, but no breach of that confidentiality occurs, according to the Sutter Health Court, unless “an unauthorized person views the medical information.” Therefore, the fact that a thief possessed protected medical information, absent the allegation that the information was indeed viewed, does not give rise to a cause of action for nominal damages under the CMIA. The court emphasized that the CMIA is not named the “Possession of Medical Information Act.”

Virginia: “The act or process of making known something that was previously unknown.”
Conversely, under Virginia law, confidential medical information is published and disclosed when it is posted online, even unintentionally, and even when there is no evidence a third party viewed that information. Indeed, even in suits where the only evidence was that patients viewed their own information online by searching for their names and finding their medical records, “publication” and “disclosure” had occurred, obligating an insurer’s defense of the underlying action. The definition of publication does not hinge on third-party access.

Travelers insured Portal Healthcare Solutions, a business specializing in the electronic safekeeping of medical records, from claims arising from the records’ publication. After the medical records of Glen Falls Hospital patients were mistakenly posted online, a class action was filed against Portal for failing to safeguard them. Travelers then sought a declaratory judgment that it had no duty to defend Portal, its insured, against such claims, arguing that Portal’s actions did not constitute “publication” or “disclosure” of confidential information, both coverage prerequisites. The Eastern District of Virginia relied on Black’s Law Dictionary’s definition of “disclosure” as “[t]he act or process of making known something that was previously unknown; a revelation of facts.” Unlike the Sutter Health court’s interpretation, the Travelers court found that this definition allows for involuntary disclosure, and moreover, found disclosure occurred even if the information was not made “known” to any third-party. Because the underlying class action therefore contained enough allegations to constitute publication and disclosure of protected confidential information within the meaning of the subject policies, Travelers was directed to defend Portal.


DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Carlton Fields | Attorney Advertising

Written by:

Carlton Fields

Carlton Fields on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.