Skip to content
DWT logo
People Services Insights
About Offices Careers
Search
People
Services
Insights
About
Offices
Careers
Search
Advisories
Healthcare

Under HIPAA, You Have the Right to Remain Silent

By Adam H. Greene
06.18.13
Share
Print this page

Last week a regional California medical center entered a $275,000 settlement for disclosing patient information to the media, spotlighting HIPAA’s tight reign over covered health providers even when they try to defend their reputations against fraud allegations. On June 13, the U.S. Department of Health and Human Services Office for Civil Rights (“OCR”) announced a new settlement with Shasta Regional Medical Center (“SRMC”) related to the medical center’s use and disclosure of protected health information while attempting to rebut media reports of alleged Medicare fraud. The settlement includes a one-year corrective action plan covering 16 facilities and serves as a sharp reminder that under HIPAA, a covered entity often cannot use or disclose protected health information to respond to allegations without patient authorization, even if the information is publicly known or disclosed by a patient.

The settlement stems from a 2011 media report alleging Medicare fraud. In response, SRMC allegedly disclosed protected health information to substantiate that it provided and billed for appropriate medical services. Senior leadership also allegedly sent an e-mail to its entire workforce and medical staff of 785 to 900 persons detailing the patient’s medical information in response to the media attention. According to the resolution agreement, SRMC also allegedly failed to sanction any employees for HIPAA violations related to the incident.

Of note, the resulting corrective action plan is one year, rather than the standard three years in most OCR settlements, and does not require external monitoring but applies to all 16 health care providers under common ownership or control.

Health care providers are in a very tough position when responding to allegations involving patient care or patient complaints. There is no express HIPAA permission for publicly responding to media reports or patient complaints. Accordingly, no matter what a patient or others allege about a covered entity, the covered entity may not be able to use or disclose protected health information to respond. In fact, a provider merely confirming that a patient received any services may raise HIPAA compliance issues. The same is true for social media and Internet ratings websites, where dissatisfied patients can cause substantial reputational harm with the covered entity having limited opportunity to respond under HIPAA.

Accordingly, covered entities should consider training appropriate staff on the limits of responding to media requests and public patient complaints. In most instances, a covered entity may not be able to respond with anything more than “no comment” or “HIPAA limits our ability to respond to these allegations.” The health care provider also should consider whether it can respond without using or disclosing patient information. If a matter reaches the courts, HIPAA provides the covered entity more flexibility to respond to the allegations through the court proceeding.

For more information, please feel free to contact Adam H. Greene or the Davis Wright attorney with whom you normally work.

Related Articles

06.13.25
Insights
Healthcare
Oregon SB 951: New Restrictions on the Corporate Practice of Medicine in Oregon Read More
05.22.25
Insights
White Collar, Investigations & Government Controversies
DOJ Criminal Division Reveals New White-Collar Crime Enforcement Priorities and Corporate Enforcement Policies Read More
05.20.25
Presentations
Healthcare
Healthcare Industry Summit 2025 Read More
DWT logo
©1996-2025 Davis Wright Tremaine LLP. ALL RIGHTS RESERVED. Attorney Advertising. Not intended as legal advice. Prior results do not guarantee a similar outcome.
Media Kit Affiliations Legal notices
Privacy policy Employees DWT Collaborate EEO
SUBSCRIBE
©1996-2025 Davis Wright Tremaine LLP. ALL RIGHTS RESERVED. Attorney Advertising. Not intended as legal advice. Prior results do not guarantee a similar outcome.