Q&A: When legal documents include patient records

Q: I'm involved in a lawsuit about a disagreement with a previous employer. During the discovery phase of the lawsuit, my former employer sent 940 pages of documents to his lawyer in support of his case. I noticed these documents included copies of medical records for almost 150 patients. These protected health information records were sent to the lawyer's office, then subsequently distributed without any kind of authorizations from the patients. I feel that this is a serious violation of HIPAA and a violation of the patients' rights to privacy. Do I have an obligation to report this violation to the hospital, state medical board, or office of public rights? What is my best course of action to avoid any future liability from this disclosure?

A: HIPAA laws carve out certain exceptions for documents turned over as part of the litigation process. Without knowing more about the specifics of your case, it is difficult to determine whether there may have been a breach of confidentiality or a violation of the law. Since you are represented by counsel, you should have your lawyer explore these questions and, if there has been a violation, whether disclosure to government authorities under state or federal law is required. As for your future liability, you should obtain assurance from your attorney that these records will not be further disseminated without appropriate HIPAA-compliant safeguards, and you, as well, should ensure that there is no further dissemination.