Balancing HIPAA and Public Safety

Balancing HIPAA and Public Safety

By Ron Hedges, JD


Imagine that you are a nurse in the emergency department of a hospital. You are on duty one evening when an injured person arrives. You soon learn that this person drove to the hospital and you are certain she is drunk. After being treated for her injury the patient plans to drive home. You advise a police officer of your concern, which leads to the patient’s arrest. This exact scenario actually resulted in a lawsuit against both the hospital and the nurse. At issue was whether an individual may sue for damages based on a healthcare provider’s “unjustified disclosure to third persons of information obtained during treatment.” In Lawson v. Halpern-Reiss, 2019 VT 38 (2019)1, the Vermont Supreme Court affirmed a judgment in favor of the defendant hospital, which in this case was Central Vermont Medical Center (CVMC) in Berlin, VT, although the court recognized a private right of action for unjustified disclosure.

The plaintiff in Lawson drove to CVMC after lacerating her arm, arriving at 2:12 a.m. The charge nurse (who had been named as a defendant but was later dismissed by the parties), “detected a heavy odor of alcohol on plaintiff’s breath,” and concluded that the plaintiff had been drinking. At 2:40 a.m., an alcohol sensor test was administered, revealing that the plaintiff had a blood alcohol concentration of .215, which is more than two-and-a-half times the limit for legal intoxication in Vermont. At 3:05 a.m., after being treated for the laceration, the plaintiff was discharged from the hospital.

A police officer was on duty in the emergency room pursuant to a contract between CVMC and the Berlin Police Department. Shortly before plaintiff was discharged, the charge nurse approached the officer and informed him that plaintiff was blatantly intoxicated, that she drove to the hospital, and that she was about to drive herself home. After receiving this information from the charge nurse and communicating with plaintiff, the officer arrested the injured woman on suspicion of driving while intoxicated. The resulting criminal charge was later dismissed by the prosecutor.

The plaintiff sued the charge nurse and the hospital, alleging that the plaintiff sustained damages because of, among other things, “the nurse’s negligent disclosure of information obtained during plaintiff’s medical treatment.” A trial court granted summary judgment in favor of the defendants. Summary judgment may be awarded if a court concludes that there is no genuine issue of material fact to be decided by a jury and if the moving party is entitled to a judgment as a matter of law. The Vermont Supreme Court described the trial court’s reasoning as follows:

“ … the court relied on a HIPAA regulation permitting the disclosure of information based on the presumed good-faith belief that the disclosure was necessary to prevent a serious and imminent threat to the health or safety of a person or the public. In the court’s view, there was no record basis for any reasonable inference that plaintiff’s disclosure to an onsite police officer was for law enforcement purposes or any reason other than a good-faith concern for plaintiff’s and the public’s safety. Having found no negligence, the court granted CVMC summary judgment on both counts set forth in plaintiff’s complaint.”

The Vermont Supreme Court affirmed the entry of summary judgment. First, it recognized that “neither Vermont law nor HIPAA provides a private right of action to obtain damages incurred as the result of a medical provider’s disclosure of information obtained during treatment.” However, relying in part on a decision of the Connecticut Supreme Court in Byrne v. Avery Center for Obstetrics and Gynecology2, 102 A.3d 32 (Conn. 2014), the Vermont Supreme Court held that HIPAA does not prohibit a state from recognizing a claim under the common law—it’s judge-made law—in a lawsuit for breach of a duty of confidentiality owed by healthcare providers to their patients.

The court then joined “the consensus of jurisdictions recognizing a common-law private right of action for damages arising from a medical provider’s unauthorized disclosure of information obtained during treatment.” In doing so, the court held that HIPAA and its implementing regulations should “inform the standard of care and establish the framework for exceptions to medical care providers’ duty of confidentiality.”

The Vermont Supreme Court then reviewed the record from the trial court, noting that the “point of contention” between the parties was whether the record demonstrated that the charge nurse had a “good faith belief that all the information provided to the officer was necessary to prevent a serious and imminent threat to the health or safety of plaintiff or the general public.” It concluded that the record “unequivocally” showed that the charge nurse had no other motive in doing so and, accordingly, affirmed the trial court.

Case Implications

What does this mean for healthcare providers? In a sense, nothing new when compared with the Connecticut Supreme Court’s decision in Byrne, as noted above. The plaintiff in Byrne was a party to a Connecticut paternity action arising out of a personal relationship with an individual. She had instructed the Avery Center not to release her medical records to the individual. As a result, the individual filed paternity actions against the plaintiff and sought records related to gynecological and obstetrical care and treatment rendered to the plaintiff by the Avery Center. When the healthcare center was subpoenaed in the paternity action for the production of Byrne’s medical records, it did not notify her of the request and instead mailed a copy of Byrne’s records to the court in which the action was pending. The individual saw the records and allegedly harassed and threatened Avery thereafter.

Byrne filed a civil action against Avery Center because of its compliance with the subpoena and disclosure of the records. She alleged that, among other things, that Avery Center was negligent in failing to use “proper and reasonable care in protecting her medical file.” Her allegation was rooted on the common law of negligence and negligent infliction of emotional distress rather than on HIPAA itself because HIPAA could not be enforced by her directly. The trial court granted summary judgment in favor of Avery Center, reasoning that Byrne’s negligence and negligent infliction claims were preempted by HIPAA. The Connecticut Supreme Court reversed that ruling, holding that, “to the extent that Connecticut’s common law provides a remedy for a healthcare provider’s breach of its duty of confidentiality in the course of complying with a subpoena, HIPAA does not preempt the plaintiff’s state common-law causes of action for negligence or negligent infliction of emotional distress.”

Healthcare providers should be aware that, depending on the laws of the state where they are, the wrongful disclosure of information obtained during medical treatment—for example, the results of tests or the content of records that contain protected health information—might give rise to a claim for damages resulting from that disclosure. To avoid wrongful disclosures, healthcare providers should have procedures in place—based on, at a minimum, exceptions to nondisclosure set forth in HIPAA and the regulations implementing it—to respond when circumstances arise that make disclosure appropriate.


1. Elizabeth Lawson v. Patricia Halpern-Reiss and Central Vermont Medical Center.

2. Emily Byrne v. Avery Center for Obstetrics and Gynecology, P.C.


Ron Hedges ( was a US Magistrate Judge in the District of New Jersey from 1986 to 2007, and is a writer, lecturer, and consultant on topics related to electronic information. He is also a senior counsel with Dentons US LLP.

Editor’s note: The views expressed in this column are those of the author alone and should not be interpreted otherwise or as advice.

Leave a comment

1 Comment

  1. Thank you, for the update on the status of the services of researching for the the proper way to look at the ways of using HIPAA in the right way to show students, just how important this is in the real world.

Send a Comment

Your email address will not be published. Required fields are marked *