Clinic Found Not Liable for Employee's Disclosure of Patient Health Information

A New York medical clinic was sued for breach of confidentiality and other torts after an employee disclosed a patient's confidential health information to the employee's family member, including the fact that the patient was seeking treatment for a sexually transmitted disease. The District Court for the Western District of New York dismissed the case, holding that in this situation the clinic could not be held vicariously liable for the employee's actions. In reaching its conclusion, the court noted that the employee was acting outside the scope of her employment when she disclosed the information. The court reasoned, in part, that because the employee undertook conduct for personal reasons, the employee's conduct can not be attributed to her employer.  

TIP: Although this case was dismissed, it serves as a reminder that companies dealing with personal information should routine train employees on best practices and procedures. Companies are well served to also have clear policies in place that outline the scope of what can and cannot be done with personally identifiable information, in particular sensitive data like confidential health information.