During World War II, it was not uncommon to hear the phrase “loose lips sink ships”. The phrase was created by the War Advertising Council and was used on posters issued by the US Office of War Information to alert citizens to beware unguarded talk.
The phrase is applicable even today when it comes to maintaining the security of health related information. Usually the Health Insurance Portability and Accountability Act (HIPAA) violations we read about in the press come from security breaches in information systems and involve hundreds to thousands of patients. But HIPAA violations can also involve individual patients seen in your office and your laboratory and care needs to be taken to educate all employees and enforce the HIPAA regulations in your facility.
A recent article in the New York Post presented an unfortunate example of how loose lips can cause patient angst and lead to litigation. A patient presented at a pharmacy with a prescription and wanted total discretion with the matter. Therefore, he gave specific instructions to the pharmacy that he would pay cash for the drug and did not want his insurance used. Several days after he received his prescription, his wife called the pharmacy to check on one of her prescriptions. The individual in the pharmacy speaking with the wife chatted about the prescription her husband had recently filled. Apparently, the wife was unaware of the husband’s prescription and became upset with the revelation.
When confronted with this, the husband contends that the pharmacy violated his privacy under HIPAA because his health care information had been communicated to a third party and the pharmacy had no right to release this information. He contends that he is suffering from “severe mental injury and emotional harm.”
It is interesting that when individuals file legal action in federal court with the HIPAA regulations as the basis for the litigation, the individuals generally lose due to HIPAA not granting individuals the right for a private cause of action. However, many states have privacy laws to protect patients and it is in state court that individuals will be more successful with legal action.
How legal action will be resolved in this case remains unclear but the message is clear: all of us in health care need to be aware of the HIPAA regulations and be vigilant to safeguard our patients’ privacy and health information.