On the Fourth of July, New York Giant Jason Pierre-Paul suffered an unfortunate fireworks accident that led to the amputation of his right index finger. While this accident will undoubtedly have personal and professional consequences for Pierre-Paul, is there also a HIPAA violation in the mix?
On July 9, ESPN’s Adam Schefter tweeted a photo of Pierre-Paul’s medical records, confirming the amputation and prompting a slew of responses about privacy, ethics, and HIPAA laws.
But did Adam Schefter really commit a HIPAA violation?
The answer is probably not, as only health care providers, health plans, health care clearinghouses, and their business associates are considered covered entities that must comply with the HIPAA laws. Schefter is none of those, unless he conspired with a health care provider to obtain the records illegally. Was it ethical to tweet the photo of the records? That’s another story…
What about the source who provided the records?
This is the bigger problem. Hospitals are required to provide HIPAA training to their employees. If one assumes that Schefter’s source was an employee of the hospital where the services were performed, there is a violation. The HIPAA Privacy Rule applies to all protected health information, which is identifiable to an individual. A person who knowingly and criminally commits a HIPAA violation faces a minimum penalty of a $50,000.00 fine and up to one year in jail, and a maximum of up to a $250,000.00 fine and up to ten years in jail, if the violation was committed for commercial advantage, personal gain, or malicious harm. In this very public case, the hospital could feel a lot of heat from the widespread distribution on social media of Pierre-Paul’s medical records.
What should I do if I am the victim of a HIPAA violation?
First and foremost, contact the person or entity you believe wrongfully disclosed your protected health information and ask them to retrieve it promptly. You can then file a complaint with the U.S. Department of Health and Human Services by completing the required form within 180 days of the alleged violation.
If you are involved in a HIPAA violation or related civil suit, contact an experienced attorney at Greenspun Shapiro PC to see how we can help! You can schedule a meeting with one of our Fairfax attorneys by calling 703-352-0100 or by emailing us using the contact form.