The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) recently announced a no-fault settlement, including a $125,000 penalty and a two year corrective action plan for Allergy Associates of Hartford, P.C. The settlement was reached after a physician at Allergy Associates disclosed protected health information (PHI) about a patient to a local television station. 

The prohibited disclosure arose from a dispute around an allegation between Allergy Associates and a patient.  Allergy Associates had allegedly turned away the patient because she arrived at the medical offices with a service animal. The patient then contacted a local television station with details of the dispute.  Journalists from the local television station then reached out to the physicians at Allergy Associates for comment.  In response to the request for comment, the physician impermissibly disclosed PHI to the reporter.

OCR found that the physician displayed a reckless disregard for the patient’s privacy rights and a willful disregard of Allergy Associates’ Privacy Officer’s instructions, who instructed all of the physicians to either not respond to the press inquiry or to respond with “no comment.”  OCR also found that Allergy Associates failed to take any disciplinary action following the physician’s impermissible disclosure to the media. 

This settlement is reminder to all covered entities that, even when a patient complains about a medical practice, the practice may not respond by disclosing PHI.  While defending a public patient complaint against a practice may seem logical, or even helpful, there is no exception under HIPAA for such a disclosure.  In response to press inquiries, all covered entities need to carefully consider the HIPAA privacy rules to avoid any prohibited disclosures of PHI and the hefty penalties that can follow.