The 4th of July brings with it celebration, patriotism, and more than two-hundred emergency room visits each year related to fireworks. Jason Pierre-Paul, a star NFL defense end for the New York Giants, was one such victim this year. He had reportedly obtained a truckload of fireworks for the national holiday and injured his hand while lighting them off. The media initially reported that Pierre-Paul suffered a serious injury, which was then downplayed to be burns on his palm and three fingers. ESPN NFL reporter Adam Schefter then tweeted a picture of Pierre-Paul's medical records on Twitter, revealing that he had his right index finger amputated. Even though Mr. Schefter posted a truthful tweet, his disclosure, as explained below, constitutes a clear violation of the Health Insurance Portability and Accountability Act (HIPAA).
HIPAA requires all covered entities (e.g. a health plan, healthcare clearinghouse, and a health care provider who transmits any health information in electronic format (as defined under 45 C.F.R. § 164.104)) and business associates (45 C.F.R. § 160.103) to take precautions when handling or disclosing a patient's personal health information (PHI). Unfortunately, a hospital employee at the Broward Health North Medical Center Intensive Care Unit either skipped the HIPAA orientation or exercised a severe lack in judgment. Working on the night Pierre-Paul sought medical treatment, the Broward employee told a friend, who tweeted about the incident on Twitter. Once out, the news media went into a full frenzy, speculating about the “career-threatening” injuries suffered by the NFL star.
Pierre-Paul is currently an unsigned free agent. The Giants placed the franchise tag on him and had a multi-year deal worth $60 million on the table before the incident; but, given the timing of the event and the “judgment” shown, the team rescinded Pierre-Paul's long-term offer. Worse yet, the Giants only found out about the injury after the incident had been leaked by the media. When Giants officials sought to visit Pierre-Paul in the hospital, he avoided them. It is yet to be determined how the injury itself will affect Pierre-Paul's career, his once-lucrative contract, or his professional reputation. What is certain is that the hospital employee violated Pierre-Paul's privacy rights protected under HIPAA.
HIPAA includes fines for PHI leaks (up to $50,000 per person per event) and criminal charges for individuals and covered entities who “knowingly” disclose PHI. Unfortunately, however, as the Pierre-Paul saga reveals, there is often more at stake. Pierre-Paul not only lost an index finger, he also lost the potential for a $60 million long-term contract and had his judgment called into question by future teams who may consider signing him as a free agent. Even worse, the rumor mill continues to churn spurred by rampant speculation derived more from fiction than fact.
Besides the statutory fines and depending on the resulting damage to his career, Pierre-Paul may also have a state law negligence claim for breach of the HIPAA standard of care. As one example, the UCLA health system had to pay $1 million for leaks involving Britney Spears and Tom Cruise and one of its hospital employee was sentenced to jail. Another example is Byrne v. Avery Center for Obstetrics and Gynecology (http://www.law360.com/articles/599662/state-law-negligence-claims-may-be-coming-under-hipaa).
Regardless, any health care employer, provider, or business associate needs to know what HIPAA covers, what disclosures can be made without violating a patient's rights, and how to properly disclose PHI so as not to trigger exposure or malpractice insurance claims. HIPAA violations can occur easily in this social media age. Everything is convenient (almost too convenient) and people love to gossip. The lesson learned in the Pierre-Paul matter is a health care employer and business associate must not gossip about a patient's health information; otherwise, you could face an adverse employment action, significant fines, civil damages, and potential jail time.