Did That ESPN Reporter’s Tweet Violate HIPAA?July 10, 2015 – In The News
Michael Kline and Elizabeth Litten were quoted in The LexBlog Network article “Did That ESPN Reporter’s Tweet Violate HIPAA?” Full text from the July 10, 2015, issue, can be found here.
A recent tweet by an ESPN reporter that contained a picture of an NFL player’s medical record quickly became a trending topic, with many warning that ESPN could have violated the Health Insurance Portability and Accountability Act (HIPAA).
But ESPN did not violate HIPAA, as the act does not apply to media personnel who obtain medical records of others.
Even though the collective bargaining agreement that NFL players sign may dictate that players are to release their injury-relevant information to the league, attorneys say that it would be hard to believe that the agreement would allow leaking of that information to the press.
“This release is not the kind of release that would be covered by any sort of employment agreement; even if it ultimately had to go to the media, there’s likely a whole process involved,” said Michael Kline. “It’s not just you were lucky enough to get a handle and access to the medical records, this is preliminary information. The media is not a direct or intended beneficiary of the collective bargaining agreement.”
ESPN has already verified the information came from a legitimate source, and the hospital treating the player announced an investigation into the leaked record.
“One thing to bear in mind is that just because you’re famous, doesn’t mean you lose your HIPAA rights,” said Elizabeth Litten. “There’s not a “public figure exception” to HIPAA. Most hospitals tend to be very careful in trying to train employees about HIPAA, especially when a high-profile patient comes in the doors.”
According to Kline, there could be other privacy laws at work in this instance as well.
“Everybody always focuses on HIPAA—that’s the big one, it’s the federal law—but the state privacy laws can be even more restrictive,” he said. “And it shows how complicated this can become, now that you’re talking about how one state regulates privacy versus another. All these kinds of potential areas are not enough to say what’s violated without understanding the circumstances, and what applicable laws there are.”