Medical right to privacy- HIPAA

Question

my Roomate has been calling my physician and disclosing my health information including when my appointments are and what medications I am taking. I have not signed or told anyone working there that this was okay. Do I have legal rights as I am now finding out they have contacted more people than my Roomate.

Answer 1

There is a problem in the question, that it does not clearly identify the relevant facts. Most of the information given ("my Roomate has been calling my physician and disclosing my health information ") says that the roommate sua sponte contacted the physician, and others, but the end which says "they have contacted more people than my Roomate" suggests that the physician contacted the roommate and others. So there are two radically different issues here.

There is no statute specifically prohibiting your roommate from calling random people to tell people facts about you, up to the point that it becomes some kind of stalking / harassing behavior. More likely, this would constitute the tort of invasion of privacy, and the specific cause of action in the US would likely be public disclosure of private facts. The exact details would depend on what state you are in, but I will assume Washington law where there is such a privacy right. Half of the four elements of that wrong seem obvious: it concerns your private life, and it is not a legitimate public concern. The other two are that it was publicly disclosed, and the disclosure would be highly offensive to a reasonable person. It is unknown whether it was publicly disclosed; it is highly likely but not self-evident that a jury would find the specific disclosure highly offensive. If there is some evidence that the roommate contacted multiple people and you wish to discover the full extent of the disclosure, a lawsuit could be filed and email could be subpoenaed, assuming that the disclosure was by email (or some similar trackable means of communication). If the disclosure was purely oral, it would be very difficult to obtain evidence of disclosure, but it could come from testimony (e.g. if Sally informs you that Ray revealed the information to her).

On the other hand, HIPAA (via the Privacy Rule) clearly prohibits revealing personal medical information to others (apart from communication to medically-relevant individuals). This is so clearly established that it is hard to imagine a physician disseminating private medical information to unauthorized people. It is, in fact, extremely likely that you did sign something, although it seems to be rare that patients know what they are signing (that is, you e-sign something with minimal visible content, perhaps just the word "privacy", and you have not actually read the document supposedly associated with the signature). Still, it is imaginable that some physician might have (wrongly) dispensed with the signing ritual.

The fact that you probably "signed something" does not mean that you specifically approved the general release of such information to the public. Non-medical individuals have to be specifically identified, which could have come about by them asking you if you wanted someone to be a "contact", and you were misled as to what they were asking for (thus unknowingly "approved" i.e. robo-signed them telling your roommate protected information). This could be actionable, though you'd have to show that you had not permitted such a disclosure. If the "others" are within the penumbra of the medical profession, though, your physician can disclose private information to relevant people: for instance, he can (and will) inform the nurse that you need an appointment, need a prescription, and so on. Whether or not the disclosure oversteps the allowed boundaries would depend on who and why the information was disclosed, but the general limit is that the disclosure has to be specifically allowed by the regulation, where section 160.103 of the rule starts to lay out who is allowed vs. not allowed to be disclosed to.