A Wisconsin health system and its employees cannot be sued over inappropriate access to patient medical records under a state law, a Wisconsin appeals court ruled Tuesday.
The three-judge panel refused to revive a lawsuit accusing Gundersen Health System and two of its employees of violating a Wisconsin law prohibiting unauthorized releases of patient healthcare records because the statute does not apply to internal access of those records.
Patient Daniel Wall alleged that Gundersen employees Marion Pahl and Jacquelyn Schimke inappropriately viewed his medical records, a violation he uncovered when the La Crosse, Wisc.-based health system gave him an audit trail showing who had accessed his records.
But the court determined applying the law to internal use and access of patient records would lead to “unreasonable” results and could make employees liable for accidental viewings of healthcare records.
“Furthermore, when sued by a patient, possibly years after the fact, an employee would be faced with the difficult, possibly impossible task of proving why he or she accessed a particular patient record in order to show that the access fell within one of the permissible circumstances,” the decision said.
Although Wall voiced concerns that refusing to apply the law in this circumstance could allow healthcare employees to view patient records inappropriately without consequence, the appeals court noted those situations are covered by the Health Insurance Portability and Accountability Act.
However, HIPAA doesn't allow private individuals to sue hospitals or employees who violate the statute, the court acknowledged. “If Wall believes a private right of action is warranted for the conduct at issue in this case, he should direct that argument to the legislature,” the court said.
Wall also attempted to sue Gundersen for failing to disclose why the employees had viewed his health records, but the court determined that those actions didn't violate the law either. Wisconsin's health privacy law prohibits providers from releasing patient records except in specific circumstances, and can also be invoked if a system refuses to give a patient their information. Gundersen's withholdings didn't include Wall's records, just the results of an internal investigation into the access issues.
