Medicare Compliance & Reimbursement

Disclosure of PHI to attorneys to obtain legal options not a violation of HIPAA, says court.

Qui tam suits can inflict more than monetary damage to covered entities and the last thing any healthcare provider — physician or facility — can afford is being embroiled in frivolous suits. However, don’t expect that disclosure of protected health information without express consent will attract HIPAA violation penalties when an employee or former employee “whistleblower” furnishes PHI to her attorney.

In Howard ex rel. United States v. Arkansas Children’s Hospital, two former employees of the Arkansas Children’s Hospital (ACH) claimed their employment was terminated in retaliation for raising questions about ACH’s billing practices, reports Providence, R.I.-based attorney Steven Richard in a recent blog post for the law firm Nixon Peabody.

The former employees disclosed large amounts of PHI to their attorney in anticipation of bringing a whistleblower lawsuit against ACH, Richard explained. The plaintiffs obtained the PHI during their employment and retained the information after their termination. The plaintiffs sued the ACH for wrongful termination, as well as for retaliatory discrimination in violation of the False Claims Act’s whistleblower protection provision.

ACH countered that the former employees’ disclosure of PHI to their attorney violated HIPAA, Richard said. But the U.S. District Court for the Eastern District of Arkansas disagreed, ruling that the plaintiffs did not violate HIPAA and instead fell within HIPAA’s whistleblower exception.

To show that the plaintiffs qualified as whistleblowers under the HIPAA regulations, they had to prove the following four factors:

1. ACH is indeed a covered entity;

2. The plaintiffs acquired the PHI in the course of their duties with ACH when they were workforce members or business associates;

3. The plaintiffs believed that ACH behaved unlawfully, violated professional or clinical standards, or was endangering patient safety; and

4. The plaintiffs made the PHI disclosure to legal counsel for the purposes of determining their legal options regarding their concerns.