By Christopher C. Taintor, Esq.
- Medical Privacy: A Balance of Competing Interests
In today’s world, privacy and safety, two values important to all of us, are increasingly in tension. One need only read the news to see examples, the most recent of which is the battle between the Federal Government and Apple over access to a terrorist’s cell phone. We all want the government to protect us from random violence. At the same time, though, we are reluctant to let the government know our secrets.
This tension is reflected in the laws that govern the confidentiality of medical information. Arguably, in fact, the tension is greatest there. On the one hand, it is important for anyone seeking out health care to feel confident in the privacy of the information they share with doctors, counselors, and other professionals. Medical privacy is fundamental, and not just because it give us comfort. Studies tell us that when patients don’t feel assured of confidentiality, they don’t tell their doctors everything they should, and the result of that reticence is that doctors are less able to provide quality care. On the other hand, though, the very fact that we share private information with our doctors means that the government sometimes views medical records as fertile sources of intelligence, a trove of information that can be used to prevent crime.
For better or worse, courts, and increasingly government agencies, have resolved this tension by imposing on health care providers a duty of disclosure that generally does not apply to others. Although there are exceptions to the rule, under Maine law an ordinary citizen who learns that an acquaintance poses a danger to another person, or to the public generally, typically has no duty to warn anyone of that danger. Bryan R. v. Watchtower Bible and Tract Society of New York, Inc., 783 A.2d 839 (Me. 1999). There is a developing body of law, however, which imposes just such a duty on health care professionals. The result, ironically, is that the information people expect to be the most private is actually the most vulnerable to disclosure.
The seminal case pitting medical privacy against public safety is Tarasoff v. Regents of University of California, 551 P.2d 334 (Cal. 1976), where the California Supreme Court ruled that a psychotherapist may have a duty to warn third parties about a specific threat of harm to a foreseeable victim. In the forty years since Tarasoff was decided, nearly every state has adopted some variant of the rule, either by statute or by judicial decision.
2. The “Health or Safety” Exception to Maine’s Medical Privacy Law
Although the Maine Supreme Judicial Court has never squarely addressed the issue, it has mentioned Tarasoff as a widely-recognized exception to the “no duty to protect” rule. Importantly, moreover, Maine’s statute governing the confidentiality of health care records allows the disclosure of otherwise private information when a practitioner or facility “in good faith believes” that disclosure should be made “to avert a serious threat to health or safety.” 22 M.R.S.A. §1711-C(6)(D). Although the Maine statute as originally enacted was quite vague, the Legislature recently added some clarity by amending it so that it now incorporates by reference the standards set out in the federal Privacy Rule (HIPAA). To satisfy that standard, the disclosure must be made in the good faith belief that it is “necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public,” and it must be made “to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat.” 45 C.F.R. §164.512(j).
Not surprisingly, health care practitioners feel some angst when they have to weigh patient privacy against public safety. Practitioners, especially therapists, ask with increasing frequency whether they have a duty to share information about patients who might be expected to harm others, and how that duty can be reconciled with their ethical obligations. In fact, though, the standards established in both Maine law and HIPAA actually give providers considerable discretion. In 2013, in the aftermath of the Newtown and Aurora tragedies, the Director of the Department of Health and Human Services Office of Civil Rights, which is responsible for enforcing HIPAA, took the remarkable step of sending an open letter addressed to “Our Nation’s Health Care Providers,” giving assurances that the law does not bar disclosure of otherwise confidential information “when necessary to . . . warn or report that persons may be at risk of harm because of a patient.” Furthermore, he explained, “the provider is presumed to have had a good faith belief when his or her belief is based upon the provider’s actual knowledge (i.e., based on the provider’s own interaction with the patient) or in reliance on a credible representation by a person with apparent knowledge or authority (i.e., based on a credible report from a family member of the patient or other person). In short, a therapist or other professional is not obligated to accurately predict whether his or her patient is likely to harm someone. It is enough to have a “good faith belief” that disclosure is “necessary.” Furthermore, as long as a clinician does not disclose private medical information with “malice,” Maine law provides immunity from civil liability for malpractice or invasion of privacy.
From a risk management standpoint, the good faith standard and the qualified immunity defense combine to tip the legal scales in favor of disclosure. A therapist who thinks her patient might pose a “serious and imminent threat” to another, or to the public, may be better off reporting that concern than keeping it to herself. After all, if the therapist makes the report and the patient later sues for negligence or invasion of privacy, the clinician will have done what she could to avoid serious harm and will have a viable immunity defense. If, on the other hand, she is silent and the risk she feared materializes (i.e., the angry patient becomes violent and hurts someone), the adverse legal and professional may be much greater.
Violence, of course, is not the only risk that might be predicted based on information shared in a health care encounter. Doctors and other health care professionals may be put on notice of other risky behaviors – patients who continue to drive after they have become physically or mentally impaired, or who have unprotected sex after they have been diagnosed with sexually-transmittable diseases – and many wonder what they can and should say in those circumstances. If a doctor diagnoses a patient with a communicable disease and has good reason to think the patient will knowingly infect a partner, does he have an obligation to speak up? Around the country there are not only judicial decisions but state statutes imposing affirmative duties to disclose in these circumstances. See, e.g., Iowa Admin. Code §641-11.18(141A) (requiring physicians to notify their patients’ known sexual or needle-sharing partners if they believe in good faith that patient, “despite strong encouragement,” will not disclose HIV status); Mich. C.L.A. §333.5131 (same); Md. Code, Health – General §18-337 (same). Although Maine does not have a law requiring doctors to notify those whom their patients foreseeably might harm, it is conceivable that the dangers posed by these patients could be sufficiently “serious” and “imminent” to justify disclosure in at least some circumstances (there are special confidentiality protections for patients who are diagnosed as HIV-positive). And if the doctor is at liberty to disclose, it is a short step to saying that he has an affirmative duty to reach out and protect his patient’s partner.
3. Exceptions to the Exception
Not every health care professional practicing in Maine is regulated by Maine law and HIPAA. For some, the barriers to disclosure are higher.
Information acquired by an alcohol or drug abuse treatment facility, for example, has heightened protection under federal law. Alcohol and drug treatment facilities may communicate with law enforcement officers concerning “a patient’s commission of a crime on the premises of the program or against program personnel or to a threat to commit such a crime.”
42 C.F.R. 2.12(c)(5). Otherwise, disclosure of treatment records is permissible only pursuant to a court order, where “necessary in connection with investigation or prosecution of an extremely serious crime, such as one which directly threatens loss of life or serious bodily injury, including homicide, rape, kidnaping, armed robbery, assault with a deadly weapon, or child abuse and neglect.” 42 C.F.R. 2.63. Under Maine law, the records of “Employee Assistance Programs” – programs created “to assist employees with family, legal, financial, mental health, and alcohol and other drug-related problems that may affect their ability to perform their jobs and their well-being” – are entitled to this same heightened degree of confidentiality. Code Me. R. tit. 14-118 Ch. 6, § V(C)(2)(a).
A different standard also applies to information acquired in the course of treating students. Under the Family Educational Rights and Privacy Act (FERPA), student health and counseling records can be disclosed only in a “health or safety emergency,” where necessary “to protect the health or safety of the student or other individuals.” The disclosure can be made to law enforcement personnel, public health officials, and trained medical personnel. 34 C.F.R. §99.31(a)(10) & §99.36
4. Conclusion
There is plenty of room for debate around the issue of medical privacy. Physicians believe that when patients lose confidence that their personal information will be kept private, that loss of trust undercuts the physician-patient relationship, which “could lead to negative, and possibly expensive, health consequences in other areas.” Molnar & Eby, Medical Fitness To Drive & A Voluntary Reporting Law at 29-30 (AAA Foundation for Traffic Safety 2008). And in a variety of contexts, it has been found that being assured of confidentiality makes people more willing to seek medical treatment. Ford CA, et al. Influence of Physician Confidentiality Assurances on Adolescents’ Willingness to Disclose Information and Seek Future Health Care: A Randomized Controlled Trial. JAMA. 1997; 278(12):1029-1034 (finding that adolescents are more willing to communicate with and seek health care from physicians who assure confidentiality). Gradually but surely, however, those assurances of confidentiality have been giving way to society’s desire for protection. As we become ever more attuned to the risks around us, both patients and health care professionals would do well to be conscious of the shrinking scope of medical privacy.