In a case addressing the Family Medical Leave Act (FMLA) that directly implicates the privacy rules under the Health Insurance Portability and Accountability Act (HIPAA), Pacosa v. Kaiser Foundation Health Plan of the Northwest, the Portland Division of the United States District Court of Oregon awarded summary judgment against a physician assistant who claimed he was discharged in retaliation for taking FMLA leave. While the court primarily focused on the boundaries of what constitutes FMLA retaliation, the case serves as a good example of the limits healthcare companies can place on employee access to available protected health information and enforcement mechanisms for addressing violations of such access.

Frank Pacosa was a physician assistant for Kaiser Foundation Health Plan of the Northwest in Portland, Oregon. He alleged that he took intermittent leave under the FMLA for a period of 2001 to 2008 for purposes of caring for his wife’s clinical depression. While employed, Pacosa signed a number of confidentiality agreements, which prohibited him from accessing his own health records or those health records of his family or friends on Kaiser Permanente’s proprietary medical records system unless he had specific authorization from the patient and the access was approved. An additional confidentiality policy that he signed and had training on prohibited him, as an employee, from accessing any protected health information records except where related to his job.

In 2008, Kaiser Permanente’s Compliance Department received a series of phone calls from Pacosa’s wife, who informed it that Pacosa had accessed her medical records without authorization and that he was using the information to obtain a restraining order against her. The Compliance Department’s investigation revealed that Pacosa had accessed his wife’s records without authorization, and further accessed and edited his daughter’s records as if he was the treating medical provider, all while he was on alleged FMLA leave.

Kaiser Permanente determined that Pacosa, who at one time served on the Confidentiality Committee and Health Information Management Committee, improperly and with intent of personal gain, accessed the protected health information of his wife and daughter, violating its confidentiality policies. Kaiser Permanente terminated Pacosa’s employment on October 30, 2008.

Pacosa sued Kaiser Permanente in Oregon District Court, alleging multiple state and federal statutory violations, including that his termination interfered with his leave rights under the FMLA. The Oregon District Court granted summary judgment on each of Pacosa’s claims, determining that there was no issue of material fact that Pacosa violated confidentiality policies, which was the reason for his termination rather than any FMLA violation.

As we have touched upon in previous posts, the chance of a data breach or information misuse rises with the use of electronic data and employee access to that data. Of course, the advent of the electronic medical record is both a result of developing technology and required under HIPAA, but as Mr. Pacosa’s termination illustrates, the portability of electronic records make it easy to view or misuse a patient’s private health information.

Kaiser Permanente’s repeated distributions of confidentiality policies and the obligations to secure and limit access to protected health information by employees illustrates a best practice and minimum necessary compliance obligation that covered entities have under HIPAA’s privacy rule and recent changes to it in the American Recovery and Reinvestment Act of 2009 (“ARRA”). The Pacosa case serves as another reminder to covered entities to review and place appropriate limits on employee access to protected health information.