Health Law: Breach of Confidentiality and Liability for Improper Disclosure of PHI

Running head: HEALTH LAW
HEALTH LAW
Name of the Student
Name of the University
Author Note

1HEALTH LAW
MCQ
1. C
2. B
3. D
4. C
5. C
6. C
7. C
8. C
9. D
10. B
Question 1
The Charm City Hospital (CCH) received the subpoena for 450patient records due to a
doctor, Dr. Wyst who worked with the hospital 10 years ago. There has been certain
malpractices that has been proved against the doctor and there has been a breach of data security
as well, done by a volunteer of Neonatal Intensive Care Unit of the same hospital. The IT
department of the hospital has failed to consult the legal counsel or any other department for the
interpretation of the subpoena or for other legal assistance. It has been reluctant toward the
subpoena and has not taken any necessary steps against the volunteer who disclosed the
hospital’s confidential information about patients, which is a criminal offence.
Under the Law of Contract, when a patient shares his/her personal and medical details
with a hospital or other medical concern, such medical concern becomes bound to preserve and

2HEALTH LAW
protect such information and treat it with utmost confidentiality. In case such data is divulged or
misused, it would about to a severe breach of contract and the victim would be liable to sue such
medical concern for damages.
Under Law of Torts, in case an employee of the hospital leaks confidential information
pertaining to the patients’ identity, address, email id, medical history and etcetera, the hospital
would be held liable under the principle of Vicarious Liability. The principle of vicarious
liability would direct the employer to carry the burden of liability of tort committed by its
employee. The theory of ‘Respondeat Superior’ would be applicable in such case and the
superior in position would be held responsible for the wrongful act of its subordinate1. While,
when an employee or a department of a hospital fails to carry out its duties that authorizes it to
adhere to subpoenas and legal proceedings,it lead to Corporate Negligence.In such case, the
hospital would be held liable for such misconduct or omission of duty by its employees2.
In the United States of America, medical information are guarded and regulated by The
Health Insurance Portability and Accountability Act (HIPAA)3. It is applicable to medical care
provides, pharmacies, data processors and other entities associated with handling of medical data
and information. While, The Standards for Privacy of Individually Identifiable Health
Information (HIPAA Privacy Rule) is applied to the gathering and utilization of Protected
Health Information (PHI)4. The standards for the protection of medical data is laid down in The
Security Standards for the Protection of Electronic Protected Health Information (HIPAA
1Singh, MadhavMadhusudan, Rajiv K. Agarwal, and Pranav Choudhary. "VICARIOUS LIABILITY IN HEALTHCARE: A
MEDICO LEGAL VIEW." INTERNATIONAL JOURNAL OF SCIENTIFIC RESEARCH 7.1 (2018).
2Rancourt, Stephen J. "Hacking, Theft, and Corporate Negligence: Making the Case for Mandatory Encryption of
Personal Information." Tex. Wesleyan L. Rev. 18 (2011): 183.
3'Summary Of The HIPAA Privacy Rule' (HHS.gov, 2018)
<https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html> accessed 13 October 2018.
4'Standards For Privacy Of Individually Identifiable Health Information' (ASPE, 2018)
<https://aspe.hhs.gov/standards-privacy-individually-identifiable-health-information> accessed 13 October 2018.