HIPAA settlement highlights need for caution when speaking with media

On November 26, 2018, the U.S. Department of Health and Human Services (HHS) announced that it reached a settlement with a Connecticut physician group practice for compromising the privacy of a patient’s protected health information (PHI) by speaking to the media. The physician practice, Allergy Associates of Hartford, agreed to pay $125,000 and adopt a corrective action plan.

The patient contacted a local television station to discuss a dispute between the patient and Allergy Associates. The station’s reporter then requested a comment from an Allergy Associates physician, and the physician impermissibly disclosed the patient’s protected health information to the reporter. HHS found that the physician disregarded the directive of the practice’s privacy officer not to speak with the reporter or to respond with “no comment.” HHS also highlighted that Allergy Associates failed to take any disciplinary action or other corrective action following this incident.

This settlement announcement should serve as a reminder to all HIPAA covered entities that extreme caution must be taken when speaking with the media regarding a patient. When a patient goes public with a complaint, the natural instinct is to respond and defend the organization by sharing its side of the story. Clients often ask, “how much can we say to the media?” The best advice is consistent with the recommendation of the Allergy Associates privacy officer: simply say “no comment.”

It is also appropriate to state that the organization cannot comment, because it values the privacy rights of its patients and complies with HIPAA and other applicable privacy laws. If the organization decides to comment further, we recommend that it do so only via a prepared, written statement that has been vetted by the privacy officer and legal counsel.