A Subpoena, an Estranged Spouse, and a Misdirected Fax
On a Friday afternoon a nurse on an obstetrics unit is handed three problems in fifteen minutes. First, a process server delivers a subpoena duces tecum from a lawyer representing a patient's estranged husband in a divorce and custody case; it demands the patient's entire chart, including prenatal and postpartum notes, is signed by the attorney rather than a judge, and arrives with no patient authorization. Second, the estranged husband telephones the nurses' station, identifies himself as the father and the policyholder, and demands "everything" about the delivery. Third, a 17-year-old patient who was tested and treated for chlamydia two weeks ago asks that nothing from that visit be sent to her parents, who carry her on their insurance. Later that afternoon, a fax containing another patient's HIV test results goes to a car dealership because a digit in the health department's fax number was transposed.
1. How should the nurse respond to the subpoena and to the husband's telephone call?
Read the worked answer
Neither request is a lawful command to disclose, and the nurse should not pull, copy, or hand over anything.
The subpoena. A subpoena duces tecum signed by an attorney is a discovery demand, not a court order. Under HIPAA, a covered entity may respond to a subpoena without patient authorization only when it receives satisfactory assurances that the requesting party has given the patient notice and made reasonable efforts to secure a qualified protective order, or when a court order accompanies it. Neither is present. The correct step is to route the document, untouched, to health information management and legal counsel, note the date and time of receipt, and let them determine whether the requirements are met. In a custody case, counsel will also want to check whether any protective order or statutory restriction applies to the records. The nurse should not edit the chart, remove pages, or add commentary.
The husband. Paying the insurance premium creates no right of access. A spouse has no automatic right to a patient's records simply by being married; authorization from the patient - or a legally recognized representative if she lacks capacity - is required. Being the father of the baby may give him rights regarding the child's records, but that is a separate question from the mother's chart and depends on custody and legal parentage, so it goes to risk management. On the phone: do not confirm or deny that the patient is or was in the facility, do not discuss the delivery, take his name and number, and tell him the request will be referred to the appropriate office.
2. Can the 17-year-old control the release of her STI records, and what should be done about the insurance explanation of benefits?
Read the worked answer
Kentucky's minor-consent statute, KRS 214.185, permits a minor to consent to certain categories of care, including diagnosis and treatment of sexually transmitted infections. Where the minor lawfully consented to the service, she also controls the confidentiality of the record of that service. Releasing those records to her parents over her objection would undermine the statute and would be a poor clinical and legal decision. The nurse should honor her request, explain that the protection attaches to the STI-related portion of the record, and route any parental request to health information management rather than answering it at the desk.
The harder problem is the insurance. An explanation of benefits mailed to the policyholder can disclose the visit even if the clinical record stays sealed, and that is a frequent inadvertent breach. The right move is to refer the case to billing and legal counsel before anything is mailed. Many facilities can suppress or redirect the EOB, bill the patient directly, or use a confidential-communications accommodation, and many state and federal rules require that a provider honor a reasonable request for confidential communication. The nurse should document the patient's request, the referral, and what she was told, so the record shows the facility had notice and acted.
Finally, do not lecture, do not require her to involve a parent, and do not imply that her request is unusual. The visit was lawful, and the confidentiality is part of the care.
3. What are the facility's obligations after the fax with the HIV results reaches the car dealership?
Read the worked answer
This is presumed to be a breach of unsecured protected health information until a risk assessment shows a low probability that the information was compromised. HIV status is about as sensitive as health information gets, and the fact that the recipient is an unrelated business rather than another provider weighs heavily toward notification.
The sequence: notify the privacy officer immediately; ask the dealership, in writing, to confirm that the fax was not read further and to destroy it; document everything - the time sent, the number dialed, the number intended, the content, who was notified, and what each party said. Then conduct the four-factor risk assessment: the nature and extent of the information (HIV test results plus identifiers), the unauthorized recipient, whether the information was actually acquired or viewed, and the extent of mitigation.
If notification is required, the affected patient must be notified without unreasonable delay and no later than 60 days after discovery, in plain language, with a description of what happened, what information was involved, steps taken to mitigate, and contacts for further information. If the breach affects 500 or more individuals, HHS must be notified at the same time and the media notified. Even a single-individual breach is logged and reported to HHS annually. Kentucky's HIV confidentiality statute, KRS 214.181, adds its own restrictions on redisclosure, so counsel should review any statement made to the patient.
Finally, the cause: a hand-dialed number and no verification protocol. Corrective action should include a fax cover sheet requirement, banned pre-programmed numbers, read-back verification, and staff training, and the corrective action should be documented as part of the breach file.