Dan Solove over at Concurring Opinions and I have both been troubled by the exposure of the patient’s identity. We seem to agree that at least one of the anonymous sources who gave or confirmed the patient’s name to the media may have violated one or more laws. My thought was that the unnamed “Atlanta medical official” violated HIPAA if the patient’s identity was discussed within the official’s professional work related to the case. There’s no individual cause of action under HIPAA, but perhaps the patient’s lawyer could use HIPAA to establish standard of care that has been violated (should he want to sue; so far there has been no mention of it and this is just food for thought on my part).
In contrast to my approach, Dan raises the issue of whether there might be a cause of action based on constitutional right to information privacy (this is why I love reading Dan’s blog — he comes up with arguments or approaches I wouldn’t necessarily consider otherwise). If — just for the sake of argument — the anonymous “medical official” should turn out to be the patient’s father-in-law, who may have acquired information in both his personal and professional capacity, would that impact any attempt to argue violation of constitutional right to information privacy? I get a headache thinking about what it might do to a HIPAA-related claim.
Focusing on the disclosure of the patient’s name by someone identified as a “medical official,” one of the issues I started reading up on was whether disclosure of a patient’s name could be justified on the basis of a public health emergency or risk (e.g., such as might also be involved in SARS cases, smallpox, bioterrorism, etc.). I didn’t find any statements of exceptions, although I certainly am not an expert in the field and haven’t read everything. But even the CDC in its official capacity did not deem this to be a situation where disclosure would be necessary to protect public health. At the May 30th briefing — the day before the AP story that revealed the patient’s name — the following statement was made by Dr. Martin Cetron, Director of Division of Global Migration and Quarantine at CDC:
UNIDENTIFIED PARTICIPANT: And as was brought up earlier, how are you trying to balance the patient’s right to privacy, with the public’s right to protection?
DR. CETRON: I think the way to balance that is for us to basically through interviews with this patient identify the circle, the concentric circles of contact that Dr. Castro indicated to find those people. It’s really, you know, not as large a number of folks. It’s still a challenging number but it’s not thousands and thousands. And it’s a contact investigation that we reach out to those individuals who believe they were exposed.
The passenger – the patient has been fully compliant in giving us the names of these different flights, and helping us to assist in identifying those who may be at risk and that’s how we’re doing that. I don’t think, publicly naming the individual, which we never do, has any advantage in achieving that part of the contact information, since this is not a disease that’s spread by casual interactions with the public.
Even in press briefings that followed disclosure of the name, CDC officials did not name the patient. As of yesterday, however, they indicated that they are investigating the role the patient’s father-in-law played in this case.
Certainly by now, the patient has been portrayed in a generally unflattering light in the media — as someone who was only concerned about his own needs and desires and who gave little thought to the health of others. Less media attention has been paid to his statements that he was never ordered not to fly, that at the time he left the country, he had not been diagnosed with the dangerous treatment-resistant strain, and that after they contacted him in Europe to inform him, he felt the CDC did not move quickly enough to make arrangements for his safe travel back to the U.S. for treatment — so he made his own arrangements.
Could identifying him publicly affect his future earnings? Looking ahead, will potential clients who might not otherwise have known that he once had TB hesitate to employ him because they fear he might be a carrier, or will they think less of him for endangering public health if they don’t read his version or statements? We need only think of Mary Mallon (“Typhoid Mary”) to appreciate the potential gravity of the harm to both reputation and civil liberties that may follow from naming a patient publicly.
Whether the patient will sue those who disclosed his name, I have no idea. And it does not matter to me if others could have figured out his identity on their own or if others would have given it to the media. My concern is that professionals who are charged with protecting privacy should protect it and that nothing in this situation warranted naming the patient by any medical professional involved in this case.