Recent Cases Involving Patient Privacy—How Far Does the Duty Go for Employees?

On May 24, 2006, the Illinois Supreme Court granted an appeal for a defendant hospital’s petition for leave. A decision in this case concerns the extent of an employer’s liability for an employee’s off-site and off-duty breach of a patient’s privacy.

The case alleged that plaintiff was a patient at a particular medical group. Blood samples and/or records were sent to a hospital and examined by a phlebotomist. The phlebotomist revealed the results of those records at a public tavern to the plaintiff’s twin sister. The hospital admitted the phlebotomist had revealed one fact about the plaintiff, discovered from her medical records, to the plaintiff’s sister at a tavern, but also alleged that when the phlebotomist revealed the information, she was not acting within the scope of her employment with hospital. Although HIPAA does not provide a private cause of action, in Illinois a common-law right-of privacy cause of action existed for the doctor’s violation of plaintiff’s right to privacy.

The court held that the question whether the phlebotomist was acting in the scope of her employment with the hospital was a question for the jury. The court went on to note, however, that the defendant hospital and employee had a duty not to disclose confidential information, without limitation as to time or place.

The court reasoned that the “hospital’s training of its employees did not limit the duty of the employee to maintain confidentiality of patients’ medical information only during working hours. Rather, that duty, imposed by the hospital in its execution of its duties, was, according to its own training, to extend to all times and to all places. In effect, for purposes of patient confidentiality, [the phlebotomist] was on duty 24 hours a day, 7 days a week.” Thus, the defendant had a continuing off-shift duty to maintain the confidentiality of patient records. This duty derived not only from the hospital’s rules of employment, but also from the patient’s right to privacy.

The court further included employees of lawyers, therapists, and other employers who maintain confidential information, as examples of other workers who have a constant duty to keep confidentiality.

View PDF