Patient Privacy, Gratuitous Nastiness, and the Ubiquitous Tort Lawyers

KevinMD has posted about a news article dealing with a privacy issue that doesn't come up too often. A chief resident of general surgery took a picture of a patient's penis while he was under general anesthesia.

There were three problems with this incident:

• The patient did not consent to or know about the photograph (he was unconscious).
  


• The photograph was not used for the purposes of medical education but rather for its "check this out!" factor.

Federal privacy regulations (the Health Insurance Portability and Accountability Act or HIPAA) have surely been violated. It is acceptable to disclose a patient's medical data (including photographs) if the patient's data is "de-identified" or the patient's consent is obtained; and the information is used for academic purposes.

De-identified means that the information is stripped of 18 parameters defined by HIPAA such as name, address, etc. The 18th is, "Any other unique identifying number, characteristic, or code..." (emphasis mine). The man had a tattoo on his penis that said "Hot Rod" and unless I'm seriously unhip, it's fair to say that his tattoo would be considered uniquely characteristic.

In addition, the photograph was not taken for medical education or research but rather to be passed around the campfire for its "entertainment" value.

This resident is in a LOT of trouble. He violated federal law and surely his hospital's formal bylaws. More importantly, he violated standards of basic human decency. Apparently however, he did try to make amends. He apologized to the patient and also appeared to form a close bond with him. The patient in fact "had been terrified about the impending surgery and said he had formed a 'bond' with Hansen (the resident), who helped him stay calm."

The resident's institution suffered a public relations nightmare and an expensive one. HIPAA violation fines can be quite expensive. I also assume there'll be a major lawsuit or a large settlement. The victim has obviously been coached by an attorney and is using the "correct" language with the press:

"But now I feel violated, betrayed and disgusted. I've never been in a hospital and (my) first experience is the worst thing ever."

There was once a time when such a act would have been handled with an apology and some form of disciplinary action, possibly getting fired. Such times now seem a quaint anachronism. Frankly, I hope his young physician has learned a serious lesson. To be honest though, I hope this example of emotionally retarded behavior doesn't end his career.

Update: The Blog That Ate Manhattan has a more insightful post than mine. Of course the "whistle blower" committed a more egregious HIPAA violation than the resident by going directly to the press (HT Kevin MD)