Doctor concerned with health care law

Breaking news and expert analysis on legal and compliance issues

[Back To Home][Back To Archives]

From Health Law Daily, March 25, 2014

Hospital to pay $4.1 million for unauthorized disclosure of medical information

By Harold M. Bishop, JD

San Jose Mercury News (Mercury News) reports that Stanford Hospital & Clinics (SHC) and Los Angeles-based Multi-Specialty Collection Services LLC (MSCS) are expected to pay $4.125 million to settle a class action claim brought under the Confidentiality of Medical Information Act (CMIA), a California privacy law, for permitting the medical information of 20,000 emergency room (ER) patients to be posted online for nearly a year. The CMIA prohibits health care providers from disclosing patient records without written consent.

The lawsuit. An ER patient, Shana Springer, brought a $20 million class action against SHC and its outside collection and billing vendor, MSCS, in September 2011. According to Mercury News, Springer’s lawsuit alleged that medical record numbers, hospital account numbers, billing charges, ER admission and discharge dates, and the psychiatric diagnosis of a Santa Clara man were disclosed without permission.

SHC’s response. When first learning of the lawsuit, SHC flatly put the blame on MSCS, stating that its vendor “…caused some confidential information about patients who visited [SHC]’s emergency room to be posted on a website.” SHC further claimed that it “…acted appropriately and did not violate the law as claimed in the lawsuit.”

In addition, according to SHC, it “…properly sent the data to MSCS in an encrypted format to protect its confidentiality. SHC’s investigation of this regrettable incident has determined that MSCS then prepared an electronic spreadsheet from that data that had the names, addresses and diagnosis codes of almost 20,000 patients. Unfortunately, MSCS improperly sent the spreadsheet it had created to a third person who was not authorized to have that information and who improperly posted it on a website, apparently to get assistance in generating a graph from MSCS’s spreadsheet.” 

SHC also acted very quickly to address the allegations. As soon as the improper disclosure was brought to its attention, SHC took the following action: (1) demanded that the spreadsheet be taken down from the website and backup servers; (2) quickly notified the affected patients of the breach and offered to provide free identity protection services to all the patients, even though the information disclosed on the website is not the type used for identity theft; (3) investigated this matter; (4) terminated its relationship with MSCS; and (5) reported the breach to law enforcement authorities.  

The parties to the settlement seem to concur that, to date, there is no evidence of that anyone saw this information on the website and improperly used it for fraudulent or other improper purpose.

Settlement terms. Mercury News reports that under the tentative settlement the class action patients would receive a little more than $100 each and SHC would have to fund a program for two years that trains medical professionals to protect patient records. The program reportedly could cost SHC up to $1 million.

Statutory damages not triggered. It is important to note that, under the CMIA, the class members could receive statutory damages of $1,000 per person. However, an October 2013 court decision held that negligence plus disclosure was not sufficient to trigger the statutory damages of $1,000. Therefore, had the class plaintiffs taken their case to trial, it was not at all certain that they would have received the statutory amount, especially in light of no evidence of misuse of the information. (Regents of the University of California v Superior Court of Los Angeles County, No. B249148 (Cal. Ct. App. October 15, 2013)).

MainStory: TopStory NewsStory GeneralNews ConfidentialityNews EHRNews HITNews HIPAANews

Health Law Daily

Introducing Wolters Kluwer Health Law Daily — a daily reporting service created by attorneys, for attorneys — providing same-day coverage of breaking news, court decisions, legislation, and regulatory activity.

A complete daily report of the news that affects your world

  • View full summaries of federal and state court decisions.
  • Access full text of legislative and regulatory developments.
  • Customize your daily email by topic and/or jurisdiction.
  • Search archives for stories of interest.

Not just news — the right news

  • Get expert analysis written by subject matter specialists—created by attorneys for attorneys.
  • Track law firms and organizations in the headlines with our new “Who’s in the News” feature.
  • Promote your firm with our new reprint policy.

24/7 access for a 24/7 world

  • Forward information with special copyright permissions, encouraging collaboration between counsel and colleagues.
  • Save time with mobile apps for your BlackBerry, iPhone, iPad, Android, or Kindle.
  • Access all links from any mobile device without being prompted for user name and password.