Another Hospital Burned for Disclosing Medical Records – State Law Protections Prevail Over HIPAA

In another example of a medical provider facing potential civil liability for providing medical records in response to a subpoena, a federal court in the Northern District of Ohio denied summary judgment for theCleveland Clinic and other defendants in Turk v. Oiler, No. 09-CV-381 (N. D. Ohio Feb 1, 2010. We previously discussed the decision in Kim v. St. Elizabeth’s Hosp. in whichacourtallowed similar claims to proceed under an Illinois law protecting mental health records. In Turk, the claims were based inpart on the Ohio physician-patient privilege codified at Ohio Rev. Code Section 2317.02.

Plaintiff James Turk was a private investigator accused of possessing a weapon while under a disability in violation of Ohio law. The Cleveland Clinic received a grand jury subpoena from the Cuyahoga County Court of Common Pleas seeking Turk’s medical records. The clinic complied with the subpoena and produced the records. Turk and his wife later brought suit against the clinic claiming damages for invasion of privacy, negligent disclosure of medical records, and violation of the First Amendment.

The clinic moved for summary judgment, arguing that it was required to respond to a grand jury subpoena and that Section 2317.02waspreempted by the Health Insurance Portability and Accountability Act ("HIPAA"). The federal district court denied the motion and allowed the claims to proceed, reasoning that Ohio law was not preempted by HIPAA where it provided greater protections than the federal law. The casestands forthe proposition that compliance with HIPAA by itself is not enough andreinforces yet again the caution whichhealth care providers must exercise when responding to subpoenas or other requests for medical records without a proper release.