MADISON — An appeals court upheld the dismissal of patient’s privacy lawsuit, concluding that although two Gundersen Health System employees were not authorized to view a patient’s records, they did not violate the law because they did not disclose information to others.
The District 3 Court of Appeals opinion Tuesday upholds Trempealeau County Circuit Judge John Damon’s decision and defines the term “release” under state statutes that otherwise restricts access to confidential patient health care records without a patient’s consent or a legitimate reason.
Daniel Wall of Ettrick sued Gundersen, Marion Pahl of Galesville and Jacquelyn Schimke of Mindoro in 2014 after an audit trail of who accessed his records showed the two employees had done so without his consent.
Pahl and Schimke failed to follow Gundersen’s policies and procedures for gaining Wall’s consent to access the files, according to the 17-page appeals opinion.
Pahl later admitted in an affidavit that she had no business reason for viewing Wall’s records. Wall’s attorney, Lee Fehr, said she did so to learn where his client lived and other personal information.
A third employee also accessed Wall’s records without his authorization, but the employee is a Winona, Minn., resident and could not be included in the suit due to her Minnesota residency, Fehr said.
Fehr would not say why Wall sought an audit trail of his records but said every patient has the right and should do so.
Before suing, Wall asked Gundersen why Pahl and Schimke accessed his confidential medical records. Gundersen responded it had “completed its investigation into whether Pahl and Schimke were authorized to view the records and why” but did not disclose the findings to Wall.
In his suit, Wall alleged that Gundersen violated state law in blocking Wall from investigating reasons why and what authority Pahl and Schimke had in accessing his records. He also alleged that Gundersen had violated federal regulations by failing to tell him why the employees accessed his records.
Wall’s suit alleged that Pahl’s and Schimke’s accessing his records without consent or a business purposed violated state statues, and he sought punitive damages.
After Damon dismissed the suit, Wall argued on appeal that the unauthorized access constituted a “release” of records without consent under state statutes.
“Why should health care employees get to snoop on patient records if they have no business reason? If a nurse, who also was a landlord, learned that a former patient who wanted to rent from her had AIDS, she could reject him as a tenant with information the rest of the public didn’t have,” Fehr said.
Pahl and Schimke argued that Wall’s suit should be dismissed because he did not allege that his records were disclosed to someone outside of GLHS.
The District 3 Court of Appeal agreed.
State law on patient confidentiality was changed in recent years to more closely follow the 1996 federal Health Insurance Portability and Accountability Act, and distinguishes between “use” and “disclosure” of protected information.
While use refers to handling of the information, release refers to disclosing the information outside the entity that keeps the records.
If the court adopted Wall’s interpretation of the statutes, health care organizations would be unreasonably burdened with having to install systems that verified an employee’s access as permissible each time a record was looked up, according to the opinion.
“We cannot fathom that the (L)egislature intended to impose that type of burden (when it enacted the statute),” appellate Judge Lisa Stark wrote.
Defining release to only include disseminating information outside the health care organization does not give employees unlimited access to patient records. Employees do not have “carte blanche access to records for immoral reasons; instead, HIPPA governs internal use of protection information and sets civil and criminal penalties,” Stark wrote.
Fehr said he would like the Wisconsin Supreme Court to define what constitutes “release” of patient records, but his client may not want to fund that cause. He urged area legislators concerned about patient privacy to redefine release in state law as any employee accessing confidential records without consent or a business reason.
The appeals court also found that Gundersen’s not disclosing to Wall why three employees accessed his records did not violate state law.
Gundersen Health System declined to comment on the decision.
“Gundersen Health System has a policy to not comment on the specifics of litigation or investigation involving current or former employees,” said Gundersen senior vice president Kathy Klock.
State law on patient confidentiality distinguishes between “use” and “disclosure” of protected information. While use refers to handling of the information, release refers to disclosing the information outside the entity that keeps the records.