When you file a personal injury lawsuit, your health and personal information come under scrutiny.
But how much of your privacy is really at stake?
The Health Insurance Portability and Accountability Act (HIPAA) is designed to protect your personal health information. However, when your health is central to a legal dispute, these protections have limitations.
Let's explore how HIPAA impacts your privacy in the context of a personal injury lawsuit.
What is HIPAA?
The Health Insurance Portability and Accountability Act (HIPAA) was enacted in 1996 with the primary goal of enhancing the efficiency of the healthcare system by standardizing healthcare transactions.
To address the privacy concerns associated with this increased efficiency, the “HIPAA Privacy Rule” was developed. This rule establishes national standards for the protection of certain health information and applies to entities like health plans, healthcare clearinghouses, and healthcare providers that conduct certain transactions electronically.
The U.S. Department of Health and Human Services (HHS) is responsible for enforcing these standards, ensuring that covered entities comply with the rules.
Got a big cup of coffee and plenty of time? Dive into the full HIPAA regulations found in 45 CFR Parts 160, 162, and 164.
How does HIPAA protect my rights?
HIPAA is designed to strike a balance between protecting patient privacy and allowing the flow of health information necessary to ensure high-quality healthcare.
Here’s how HIPAA protects your rights:
- Covered entities: HIPAA applies to health plans, health care clearinghouses, and health care providers who electronically transmit health information. These entities are required to safeguard your protected health information (PHI) and are restricted in how they use and disclose your information.
- Enforcement: The HHS Office for Civil Rights (OCR) enforces HIPAA compliance, conducting investigations and reviews in response to complaints. Non-compliance can result in significant civil and criminal penalties.
- Your rights: Under HIPAA, you have the right to access your health records, request corrections to your records, and receive a notice of privacy practices that outlines how your information may be used and shared.
Find out how to request medical records for a personal injury claim, including what to do if you don’t receive your records.
HIPAA and personal injury claims
Under HIPAA, your medical records generally cannot be released without your consent. However, there are specific circumstances where your health information may be disclosed as part of a personal injury lawsuit.
When you file a personal injury claim, the defendant (the party you are suing) may request access to your medical records as part of the discovery process. Discovery is a pre-trial procedure where each side can request evidence from the other to build their case. HIPAA allows for the disclosure of your health information in legal proceedings, but this disclosure is not automatic, nor is it unlimited.
Understanding the limitations on medical record disclosures in personal injury cases
Even though HIPAA permits certain disclosures during legal proceedings, there are important limitations designed to protect your privacy. For example, if the defendant requests medical records that are unrelated to the incident in question, your attorney can object to these requests.
If your injury claim involves a broken leg from a car accident, the defendant may request your medical records to verify the injury. However, they do not have the right to access unrelated medical information, such as records of mental health treatment, a past surgery with no bearing on your current case, or medical records from years before the accident unless directly relevant. In some instances, even if records must be disclosed, sensitive information within them can be redacted to protect your privacy further.
When your attorney objects to such requests, they must provide a legal justification for doing so. The court will then decide whether the requested information is relevant and must be disclosed. If the court finds that the records are unrelated to the case, it may limit or deny the defendant's access to those records.
Additionally, even when records are disclosed, the court may issue a protective order to restrict how the records can be used or who can view them.
In some instances, you may actually want your medical records to be released. For example, sharing your medical history with your attorney or your chosen medical experts can strengthen your case by providing evidence of the injury's impact on your life. What’s more, releasing your records to the defendant could sometimes expedite settlement negotiations by clearly demonstrating the extent of your injuries and the resulting damages.
Let’s clarify some of the issues surrounding medical record disclosures in personal injury lawsuits with a hypothetical example.
Tom is rear-ended while driving his daughter home from school, resulting in whiplash and a mild concussion.
He files a personal injury lawsuit against the driver who hit him. During the discovery process, the defendant’s attorney requests Tom’s entire medical history, including records of past surgeries and mental health treatment that have no connection to the accident.
Tom’s attorney quickly identifies this request as overly broad and irrelevant. He argues that the defendant is only entitled to access medical records directly related to the injuries Tom sustained in the car accident. To formalize this objection, Tom’s attorney files a motion with the court, clearly outlining why the request for unrelated medical records should be denied. The court reviews the objection and agrees with Tom’s attorney, ruling that only the records pertaining to his whiplash and concussion need to be disclosed.
However, the process doesn’t end there. Tom is presented with a request to sign a release form that authorizes the disclosure of these specific medical records. His attorney carefully reviews the release form to ensure it only covers the relevant records.
Later in the case, Tom’s attorney suggests that they voluntarily disclose additional records that highlight the severity of Tom’s injuries, particularly the long-term impact of his concussion on his daily life. These records include detailed reports from Tom’s neurologist and physical therapist, which help to demonstrate the extent of his damages. By strategically releasing this information, Tom strengthens his case and increases the likelihood of a favorable settlement.
Can I sue for a HIPAA violation?
HIPAA does not grant individuals the right to sue directly for HIPAA violations. Instead, enforcement of HIPAA is handled by the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR).
If you believe your HIPAA rights have been violated, you can file a complaint using the OCR online complaint portal. Doing so may cause OSR to investigate the matter and impose penalties on the offending party.
However, even though you cannot sue for a HIPAA violation directly, a breach of your health information could potentially give rise to other legal claims, such as invasion of privacy, negligence, or breach of contract, depending on the circumstances. If you believe your medical information has been improperly disclosed, it’s important to consult with an attorney who can advise you on your legal options.