The Kentucky Court of Appeals recently held that a hospital acted lawfully in terminating  the employment of a nurse for violating the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The nurse had been within earshot of other patients and medical personnel when she told her colleagues to wear gloves because a particular patient had Hepatitis C. The court’s decision makes clear that medical providers must handle HIPAA-related information with extreme care and that probable (not actual) disclosure may be enough to constitute a HIPAA violation—or at least serve as a basis for discharging an employee who makes an alleged disclosure. Hereford v. Norton Healthcare, Inc. d/b/a Norton Audubon Hospital and Phyllis Vissman, No. 2015-CA-001958-MR (Ky. Ct. App. July 21, 2017).

Background

Dianna Hereford is a registered nurse who worked for Norton Audubon Hospital in Louisville, Kentucky. On May 7, 2013, Hereford was assisting an echocardiogram technician and physician in performing a transesophageal echocardiogram on a patient with Hepatitis C. In preparing for the procedure, Hereford informed her colleagues that they should wear gloves because of the patient’s infectious disease. The patient filed a complaint with the hospital alleging that confidential health information had been improperly disclosed as Hereford’s voice was loud enough to be heard by other patients and/or medical personnel who were allegedly nearby. The hospital initially placed Hereford on administrative leave and then terminated her employment for unnecessarily disclosing confidential health information in violation of HIPAA.

The Lawsuit

Hereford sued, arguing that the termination of her employment had been in violation of public policy because the termination had occurred in spite of her complying with HIPAA regulations (or, at most, engaging in “incidental disclosure,” which is not actionable under HIPAA). Hereford also asserted that the hospital and one of its employees had defamed her by informing others that she had been dismissed for violating HIPAA regulations. In support of her claims, Hereford submitted an unemployment insurance referee’s finding (which was not binding on the court) that she did not violate HIPAA and an affidavit from a hospital employee stating that she was two beds away from Hereford at the time of the incident and did not hear Hereford mention Hepatitis C.

The trial court dismissed Hereford’s claims, holding that the circumstances did not implicate a public policy concern that would alter the at-will employment relationship. The court also held that Hereford’s disclosure was unnecessary because, as a matter of law, “a physician should not require being told that a patient has an infectious disease as a reminder to wear personal protective equipment such as gloves.” As such, the trial court also held that Hereford’s action violated HIPAA. Therefore, the trial court dismissed the defamation claim because truth is an absolute defense to defamation and it was true that Hereford was terminated for a HIPAA violation.

The Appeal

On appeal, the Kentucky Court of Appeals upheld the lower court’s dismissal of Hereford’s claims. The Court of Appeals held that the hospital did not terminate Hereford’s employment for her engaging in conduct that fell within the public policy exception to the at-will employment doctrine. Namely, Hereford did not refuse to do anything that would violate the law, nor did she exercise a statutorily-conferred right. The Court of Appeals also held that Hereford’s defamatory claim was rightly dismissed as the evidence showed that the hospital’s representation about terminating her employment for violating HIPAA was true. In reaching this conclusion, the court reasoned that, under HIPAA regulations, “a medical provider must use the minimum amount of protected health information to accomplish the necessary purpose.” According to the court, because Hereford’s statement was not the minimum amount necessary to accomplish the warning to “wear gloves,” she violated HIPAA.

Employer Takeaways

Employers should be vigilant in training and retraining employees on how to properly handle HIPAA-related information in various contexts and situations. Here, the nurse may have been trying to be helpful by informing her colleagues to wear gloves, but she went too far when she verbally and publicly broadcast the patient’s condition within earshot of others. Even if no one actually heard Hereford, the patient believed a violation had occurred and the conduct itself yielded unnecessary risks.

Employers should also avoid disclosing the reasons for an employee’s termination of employment except under certain limited circumstances in consultation with counsel. While here the court found that a HIPAA violation had occurred, another court might have held that it was too close to call. The hospital in this case could have mitigated its risks further by informing others (who presumably needed to know) that the employee had been dismissed for an “alleged” HIPAA-related violation or a patient’s complaint that she had violated HIPAA. Either of these statements would have been true and would not have required a court to determine whether in fact a HIPAA violation had occurred in order for the truth defense to apply.