Under HIPAA, physicians are permitted to disclose “protected health information” to their attorneys for purposes of their own healthcare operations. This allows physicians sued by patients for malpractice to provide their attorneys with the information needed to prepare and present a defense. Ordinarily, subpoenas or orders are a part of a court ordered deposition or trial at which the patients or their attorneys are present, so the need to protect health information is lessened.

HIPAA does not allow treating physicians in one practice to disclose “protected health information” to attorneys for a treating physician in another practice unless a subpoena or an order of a court permits that disclosure. Instead, HIPAA allows members of a group practice to transmit protected health information concerning a patient to business associates of that practice. This means that attorneys representing the other physicians in the group practice can receive information related to the practice’s healthcare operations, including information relating to representing the practice in malpractice lawsuits. A subpoena or court order is not required for this disclosure. Thus, when a physician is being sued for malpractice, HIPAA permits the practice’s attorney to meet with other physicians in that same practice and obtain protected health information related to the plaintiff.

While HIPAA may permit the disclosure of protected health information in this circumstance, state law is another matter altogether. For example, the Tennessee Supreme Court found that an implied covenant of confidentiality exists between the treating physician and his or her patient. Like HIPAA, this implied covenant of confidentiality absolutely prohibits an attorney for a treating physician from meeting with another treating physician unless the patient or the patient’s attorney is present. Like HIPAA, the court assumes that the patient’s interests are protected when the patient is present.

This in turn begs the question – does the implied covenant of confidentiality prohibit a physician employed in a group practice from meeting with the attorneys representing another employee of the practice who has been sued for malpractice without the patient being present? In Tennessee, this issue was recently addressed in Hall v. Crenshaw, W2013-00662-COA-R9-CV (Tenn. Ct. App. July 18, 2014). The court of appeals in Hall held that the implied covenant of confidentiality does not prohibit a physician in a group practice from meeting with attorneys representing another employee physician of the practice. The court of appeals reasoned that a corporation can only function through its agents and employees. Under state law, all knowledge of the corporation’s employees is imputed to the corporation. As a result, the court held that the corporation already possessed this information, meaning the corporation, through its employees, is able to discuss a patient’s medical record and history with the attorneys representing the corporation and its employees.