What to do when an employer violates the HIPAA law?
My husband recently had a physical for the fire dept he is in; his hearing came into question. He wore hearing aids prior to being hired and it has never been an issue until this. He is very self-conscious of this and wanted no one to know, but today, another firefighter came up to him and asked, "So, you can't get on the part-time side because of your ears?" Obviously, the supervisors have been spreading the word of my husband's medical history. What can be done?
Your husband could sue his employer for invasion of privacy. One aspect of invasion of privacy is the public disclosure of private facts which occurred here when his confidential medical records were disclosed to other employees.
In addition to a cause of action (claim) for invasion of privacy, the lawsuit should also include a separate cause of action for negligent infliction of emotional distress. Your husband's employer owed your husband a duty of care to maintain the confidentiality of his medical records. Disclosing the information breached the duty of care and was the actual and proximate cause of your husband's emotional distress. Actual cause means but for the disclosure of the medical records, would your husband have suffered emotional distress? If the answer is no, then actual cause has been established. Proximate cause means despite the disclosure of the medical records was there any unforeseeable intervening event which would relieve the employer of liability for negligence? The answer appears to be no, which means that proximate cause has been established. Therefore, the employer is liable for negligence (negligent infliction of emotional distress in this case).
Intentional infliction of emotional distress as opposed to negligent infliction of emotional distress would be more difficult to prove in this case because the employer would have had to have committed an extreme and outrageous act (disclosing the medical records) intended to cause and which did cause emotional distress. Establishing the requisite intent on the part of the employer would be difficult. That is why it would be advisable to pursue negligent infliction of emotional distress instead of intentional infliction of emotional distress in the lawsuit.