Protecting Patient Data

United General Hospital Patient Privacy Case Study:

United General Hospital is located in the suburbs of Des Moines, Iowa and serves the community’s population as an alternative to traveling to Des Moines for hospital care. Because United General Hospital serves a small community, it also houses a number of primary care physicians. This gives the physicians much-needed access to hospital facilities and hospital staff. It is common for an intern or nurse to assist primary care physicians in the event that a physician’s assistant is not available. The hospital also provides the opportunity for the physicians’ assistants, nurses, and interns to experience a hospital environment, as time permits.

Dr. Moore is a primary care physician located in the hospital, and the mother of one of his patients, Winnie Noble, was admitted after a drug dealer broke into her house, stabbed her, and left her lying on the floor of her kitchen. Fortunately, Winnie’s daughter, Pam, arrived and called the ambulance. Since Dr. Moore was available when Winnie arrived, the hospital paged him to the emergency room (ER). Because Winnie did not remember the attack, Dr. Moore took x-rays of her ribs, a blood workup, and a computed tomography (CT) scan to gauge the extent of her injuries. The hospital admitted Winnie for observation. Pam and her boyfriend, Pete, came to visit Winnie. Fortunately, Pete had just started as an intern at the hospital, had access to the hospital, and could escort Pam to her mother’s room for extended visits.

A couple weeks after Winnie’s attack, she returned for an antigen test to detect a possible human immunodeficiency virus (HIV) infection she may have received from her attackers. Pete found that the hospital had tested Winnie for HIV and was curious about the results. He opened his iPad, connected to the hospital’s wireless network, accessed Dr. Moore’s patient records, and reviewed Winnie’s diagnosis. Pete found that Winnie had contracted the HIV virus from the attack.

Pete immediately logged on to Twitter and sent a tweet to Pam saying how sad he was and that, if there was anything he could do to help her mom as she learned more about contracting the HIV virus, he was available. Pete and Pam’s Twitter followers picked up the tweet, and Winnie’s HIV diagnosis went viral. Both Winnie and Pam were swamped with people calling to either offer their support or ask them not to attend social functions.

Both Pam and Winnie were incensed about the disregard for patient confidentiality and privacy. They demanded to know how an intern could access Winnie’s records and make her diagnosis public. Winnie subsequently sued United General Hospital, Dr. Moore, and Pete for invasion of privacy, violation of patient record protection under Health Insurance Portability and Accountability Act (HIPAA), and emotional and physical distress. Winnie is seeking punitive damages and requesting that the Department of Justice and the Center for Medicare and Medicaid Services also investigate the security policy of the hospital for violations of federal patient privacy regulations. The investigation is ongoing.