The Court of Appeals recently tackled the novel question of whether an employee of a health care organization can access a patient’s records without the patient’s consent.
The plaintiff appealed the case after defense motions to dismiss the complaint were granted. Accordingly, the facts are sparse and undeveloped because they were taken only from the complaint.
Daniel Wall had been a patient of Gundersen Lutheran Health System. For reasons that are unknown, Gundersen provided Wall with an “audit trail” of people who had accessed and observed his health care records. Marion Pahl and Jacquelyn Schimke, employees of Gundersen, were named in the audit.
Pahl’s and Schimke’s reasons for accessing Wall’s health care records are not part of the opinion. But Wall took umbrage and sued the two Gunderson employees for “invasion of privacy of medical records.”
His claim was brought under sec. 146.82, which pertains to the confidentiality of patient health care records. He accused them of accessing his records without his informed consent.
Motion to dismiss
Pahl and Schimke brought a motion to dismiss Wall’s complaint for failure to state a claim upon which relief can be granted. Now-retired Trempealeau County Circuit Judge John Damon granted the motion.
He reasoned that in order to state a claim for relief under Ch. 146, Wall’s complaint needed to allege that Pahl and Schimke “released, published or disclosed” Wall’s medical records “to other people.” Wall’s complaint merely alleged that Pahl and Schimke “briefly accessed” his medical records without his knowledge.
Court of Appeals
Since the issue presented was one of first impression, the Court of Appeals invited participation from the Wisconsin Hospital Association and Disability Rights Wisconsin. Both submitted amicus curiae briefs.
The unanimous decision, penned by District 3 Presiding Judge Lisa Stark, centered on the statutory construction of sec. 146.82(1).
That statute provides: All patient health care records shall remain confidential. Patient health care records may be released only to the persons designated in this section or to other persons with the informed consent of the patient or of a person authorized by the patient.
The statutory word at issue was “released.”
The employees argued that release requires “disclosure of patient health care records or the information contained therein to someone outside the organization.” Wall’s complaint merely alleged that the employees accessed the records internally.
Wall, in turn, argued that, “whenever an employee of a health care organization accesses a patient’s records, the organization has ‘released’ the records to the employee.”
Initial statutory construction
Since “release” is not defined in the statute, the court first checked dictionary definitions of the word for clarification, but those definitions were of no help. The court then proceeded to a second type of statutory analysis by looking to a related statute, sec. 146.816, for guidance.
That statute differentiates between “disclosure,” which includes “release,” of health care information outside the organization, and “use,” which refers to the handling of information within the organization. The differentiation seemed to support Pahl’s and Schimke’s argument.
But the court found “potential weaknesses” in this analysis when it more closely studied modifying phrases in the statute and its federal counterpart.
Noting that this analysis raised more questions than it answered, the court concluded that “even after considering the definitions of ‘use’ and ‘disclosure’ in sec. 146.816, the meaning of the term ‘release’ in sec. 146.82 remains unclear.”
So the court turned to a third maxim of statutory construction — that statutes must be interpreted reasonably in order to avoid absurd or unreasonable results.
It found that it would be unreasonable to include internal dissemination of health care information within the ambit of sec. 146.82.
It based this conclusion on the reality that every day, employees of health care organizations routinely, sometimes even accidentally, access patient health care records.
If a private right of action existed under sec. 146.82 allowing patients to sue employees for such access, employees would have a nearly impossible task of recalling and proving years later that their access was for a statutorily sanctioned purpose.
Therefore, “interpreting sec. 146.82 to apply to internal use of patient health care records would run the risk of entering into a field with no sensible or just stopping point.”
Additionally, the court noted that as a practical matter, health care organizations would be forced to put in place systems that — for each and every access — either verified that an employee’s access was permissible or required documentation of the reason for accessing a record.
That would place “too unreasonable a burden” on health care organizations and their employees, a burden the court could “not fathom” the legislature intending.
The court held that an employee’s internal access to patient records “is not the type of conduct governed by sec. 146.82.”
Stated otherwise, sec. 146.82 is inapplicable when “a health care organization’s employee merely accesses a patient health care record, without disclosing any information from the record to anyone outside the organization.”
Turning to Wall’s concern about employees accessing records for improper purposes, the court noted that the use of protected health information is extensively regulated by HIPAA, which provides both civil and criminal penalties for violations.
This opinion is a tedious read, but I give the Court of Appeals credit for taking the bull by the horns in this complex case of statutory construction.
After going at the issue from several angles, the court arrived at an appropriate and practical interpretation of an important statute in the context of employees accessing patients’ health care records.
In an age where corporate and privacy interests often collide, the court struck the right balance here.
The facts are bare-boned. Nothing about the employees, their occupations or their reason and motivation for accessing the records are included in the opinion.
As such, the case has broad application throughout the state.