Legal battle highlights patient rights, internal data safety

© ipuwadol - stock.adobe.com

As a general rule, patients have a right to choose their treating physician. Depending on the insurance plan, they may choose from a list of participating providers or select to pay more by going out of network.

In Texas and in other states, physicians also have a duty to notify patients when “retir[ing], terminat[ing] employment, or otherwise leav[ing] a medical practice.” Physicians or their medical practices shall do the following according to the Texas Administrative Code §165.5:

(b) Method of Notification.
(1) Except as provided for in subsection (f) of this section, when a physician retires, terminates employment, or otherwise leaves a medical practice, he or she shall provide notice to patients of when the physician intends to terminate the practice, retire or relocate, and will no longer be available to patients, and offer patients the opportunity to obtain a copy of their medical records or have their records transferred.
(2) Notifications shall be accomplished by:
(A) either:
(i) posting such notice on the physician’s or practice website; or
(ii) publishing notice in the newspaper of greatest general circulation in each county in which the physician practices or practiced and in a local newspaper that serves the immediate practice area; and
(B) placing written notice in the physician’s office; and
(C) notifying patients seen in the last two years of the physician’s discontinuance of practice by either:
(i) sending a letter to each patient; or
(ii) sending an email to each patient, in a manner that is compliant with state and federal law.

This TAC section goes on to prohibit interference, including withholding “information from a departing physician that is necessary for the notification of patients.”

A previous practice cannot interfere with a patient’s right to leave the practice. This does not mean that a physician has other legal obligations which are outside the scope of the aforementioned state statute. A recent example is a case that was filed in Connecticut - Kourounis, MD, Kay et al. v. Novo Women's Health P.C., case number NNH-CV24-6146583-S (New Haven Judicial District of the Connecticut Superior Court) (hereinafter “Novo case”).

In this case, the previous practice alleged a variety of actions, which are not protected for a variety of reasons, including because the departing physician did not take the medical records, billing and revenue cycle information, and practice patient list and either give them to an attorney or a government entity for the purpose of reporting a HIPAA violation or healthcare fraud. Providing information to an attorney and/or a government entity is protected under the whistleblower provisions of HIPAA and the Defend Trade Secrets Act of 2016 if that is the only use of the information.

In the Novo case, the departing physician allegedly engaged in the following activity, in violation of contractual, fiduciary, and legal obligations:

• Accessing patient medical records, taking patient lists, and absconding with revenue cycle/billing analytics and information;
• Not providing the practice with written notice of departure as required under the Employment Agreement;
• Soliciting patients and employees, which is different than providing notice and having a patient organically choose to continue treatment with a patient at a different practice;
• Breach of fiduciary duties of loyalty and care;
• Plaintiff never receiving a written request for records or a release from any of the patients who left the medical practice, which was also required in the Employment Agreement; and
• Continuing to access patient data from EPIC electronic health record system’s micro data, even after departing. “Initially, access reports show entry into the Epic software records belonging to plaintiff OB-GYN Physicians by Dr. Rauktys from Bridgeport Hospital and then through direct entry using some other method/permissions to access the records.”

These allegations, especially those related to the illicit viewing and accessing medical records and patient lists pre- and post-departure by the Novo physician, can implicate criminal HIPAA violations, state agency enforcement actions, repealing of a professional license, and violations of the Stored Communications Act. One way to “catch” illicit access sooner is to have access software installed that flags certain events and is also reviewed. In sum, physicians and practices alike should have safeguards in place to prevent this from happening.

Rachel V. Rose, JD, MBA, advises clients on compliance, transactions, government administrative actions, and litigation involving healthcare, cybersecurity, corporate and securities law, as well as False Claims Act and Dodd-Frank whistleblower cases.