A patient made a completely baseless complaint about me to the state medical board. The complaint was rapidly dismissed by the board after it requested and reviewed the relevant parts of her records. But the patient told many people about her complaint, so there is gossip in our small town that can be harmful to my practice. I don’t want to give new life to this, but I would at least like to clear things up. Is the material that was released to the board still under full HIPAA protection? Does it matter that I am no longer her doctor?
A: HIPAA permits a doctor to disclose PHI to a medical board making an inquiry that impinges on the public health. The board may also even override a patient’s objections to a PHI release. However, such releases of PHI are strictly limited to the board’s inquiry into the complaint.
Your obligations to maintain the privacy of a patient continue even after they leave your practice, whether that is amicably or not. Taking both factors into account, you should therefore start from the premise that, as far as your role as the physician, the obligation to maintain privacy outside the actual ruling of the now-resolved case still applies under both HIPAA and state confidentiality laws, which are not infrequently stricter than HIPAA.
This would be so even if the board has a policy of maintaining a publicly accessible fi le of its actions or of posting its decisions on an open website. The board is not a fiduciary for the patient, but you are. This applies in malpractice actions as well, by the way. That a plaintiff put their medical record into evidence as part of putting their care in issue is a limited waiver of their privacy, not a general release of their PHI. The likelihood that—because you feel so ill-used by this patient—you will say more than the precisely limited material in the case and so create a privacy breach is just too high. This individual is likely even angrier at you now that she lost and would be only too pleased to have another go at you when comments that you made inevitably get back to her by the same small town grapevine, and while her original claim was false, that you released PHI without authorization would not be.
Just tell people that the matter was resolved in your favor…and stop there. Your inclination to not re-incite this is the right one. Savor your victory, and don’t risk a sanction on which you will actually lose.
This article was written by Dr. Medlaw, a physician and medical malpractice attorney.
