Inspired by this question on The Workplace, I wonder if a company that hired a doctor to spy on patient/employees would be committing a crime in the US. And would the doctor be committing a crime by doing so?


Patient/employee means a patient of the doctor and employee of the company.

By "spy" I mean the company says, "Employee: this doctor is our health provider, go to him for all your health care needs, with a small or even zero co-pay;" and, "Doctor, we will send our employees to you, and you will in turn provide all records of their visits to us, while telling our employees (your patients) that the records would never be shared with us."

  • It is unlikely to be a crime that any law enforcement officer would prosecute, but is likely to provide a basis for a lawsuit by the employee or class of employees involved.
    – ohwilleke
    Dec 22, 2016 at 18:19

1 Answer 1


Without the patient's permission, the doctor cannot legally share the patient's health information with the patient's employer.

Your Rights Under HIPAA:

[...] without your authorization, your provider generally cannot [...] give your information to your employer

Remedies for confidentiality violations include civil actions, administrative fines, and criminal charges. (Remedies for Violation of HIPAA Privacy Rights and Medical Confidentiality, HIPAA Violations and Enforcement, What is the Penalty for a HIPAA Violation) Individual states also have confidentiality laws that are violated by the hypothetical in the question.

  • Well, the doctor can't, but what if he or she does?
    – gnasher729
    Dec 22, 2016 at 8:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .