Health Law Pointers - Volume XVII, No. 1

A 2015 Winter HIPAA Challenge


Our Western New York community has endured a difficult winter and our roads and parking areas are dangerous places.  What do you do if a patient rushes into your reception area, upset, and says “my car was just damaged by a hit and run driver.  Did anyone see anything?”


Let’s assume that:


  • Your receptionist and others have a clear view of the parking area in front of your entrance
  • An office worker saw the “entire thing.”
  • The damaged car was parked
  • No one was in the damaged car
  • There are no personal injuries, only property damage
  • No one observed the license plate number
  • There are no surveillance cameras on the premises
  • The owner of the damaged car is a patient of the practice; and
  • The office worker recognized the driver of the hit and run vehicle as a practice patient who had just left the office!






            Are you allowed to tell your enraged patient that an office worker observed the accident, and provide that patient with the name, address and telephone number of the hit and run driver?


Short Answer:


            NO.  Despite your wishes to be a good citizen, disclosing the name of a patient of the practice without that patient’s consent is a HIPAA violation.  The office worker only knows the name and contact information of the hit and run driver due to that person’s status as a patient of the practice.


Is HIPAA a Complete Barrier to Justice?

            NO.  You have two possible solutions:


            First:  HIPAA allows a medical practice to disclose PHI which the practice believes in good faith is evidence of criminal conduct on the premises,


            The PROBLEM is that this hit and run did not involve “criminal conduct.” Under New York law, leaving the scene of an accident when there are no personal injuries (but only property damage) is merely an “infraction” under the Vehicular and Traffic Law.  It is not a crime under the New York Penal Law. Therefore, this HIPAA exception does not apply. (If, however, the “victim” patient was injured, this would be a crime and disclosure would be permitted under the criminal conduct exception).


            Second: HIPAA also allows for limited disclosure of PHI in response to a law enforcement officials request for information for the purpose of identifying or locating a “suspect.”


            A possible SOLUTION to our problem, therefore, is to ask the accident victim to file a police report and have a law enforcement official thereafter contact the practice to see if anyone could provide information on the accident.


            A Third Option?


            A practice representative could contact the hit and run driver and ask him/her to voluntarily contact the victim or a law enforcement official and report the accident, or authorize the practice to do. However, most medical practices would be understandably uncomfortable if assigned this role, and in any case disclosing the name of the accident victim may itself present a HIPAA problem.


An Act of Contrition

Last month, a meteorologist at the National Weather Service in Mount Holly, New Jersey apologized on Twitter for erroneously predicting that a major, crippling snowstorm of “historic” proportions would ravage the New York metropolitan area.  His precise language:  “You made a lot of tough decisions expecting us to get it right, and we didn’t.”


What is going on?  Is it realistic to expect a meteorologist to apologize for a force of nature?  Should the public fairly expect an industry notoriously dependent on computer models to track fickle storms and “get it right?”  Whatever your thought, this widely publicized confession does raise an interesting question:  should professionals apologize for their acts and omissions?


Medical professionals have wrestled with this question for some time.  The traditional response, echoed by risk managers nation-wide, is that any expression of regret or act of contrition is tantamount to an admission against interest with unwanted liability exposure, and should be avoided.  However, this overlooks the special, deeply personal relationship that many physicians enjoy with their patients, and various studies on the subject have reported surprising results; that physicians who communicate directly with patients and/or their families early on, and assume personal responsibility, experience a reduced incidence of malpractice claims. 


A key study performed by Dr. Lucius Leape of the Harvard School of Public Health, confirms there is value in a properly communicated apology.  According to Dr. Leape, patients want their physician to acknowledge the mistake, explain how it happened, apologize and take responsibility for the act or omission, and commit to seeking safeguards to assure that the mistake or error doesn’t happen again.  As may be expected, more harm than good emerges if the physician is perceived as evasive in his statements, dishonest or dismissive of the patient or family’s feelings.


The American Medical Association agrees, noting that physicians have an ethical obligation to disclose patient errors that have a harmful effect.  The Joint Commission, a hospital oversight body, comes to a similar conclusion, mandating an apology when the error takes place in a hospital.


At last count, there are over 35 jurisdictions (but not including New York) where apologies are protected under law.  These so-called “apology laws” vary in scope but may insulate from liability both communications of sympathy and admissions of fault…or may not!  Thus, a physician’s location will dictate, in those states where protection exists, whether admissions of negligence or personal responsibility will be exempt from, or admissible in, civil litigation.


The power of an apology carries many benefits, but its real importance may lie in its ability to effect reconciliation.  Thus, not only may an apology defuse anger but ultimately strengthen the professional relationship by demonstrating respect for the patient.   If effective, the apology should encourage future communications with the patient.


There are many excuses why an apology is not commonly offered.  Some worry that apologizing means admitting to a mistake even in instances where the professional has not done anything wrong.  Others are uncomfortable in looking less qualified or disappointing the patient in a highly competitive environment.


Apologies are generally conceded to offer emotional and spiritual benefits and allow the “penitent” to show his or her kindness and thoughtfulness.  It is a good gesture. As adults, we are told to “’fess up” to our mistakes and accept responsibility for our actions, and even young children are taught to say “I’m sorry.”


The cost of an apology is negligible but the repercussions of a complaint could be enormous.  Many commentators seem to agree that effective communication is essential in establishing and managing a good working relationship with patients.  If so, then “doing the right thing” makes a lot of sense.

Newsletter Sign Up