Stewart and Lynda Resnick Neuropsychiatric Hospital at UCLA
SACRAMENTO - A state appeals panel has agreed hospitals can’t be sued if one of their employees posts confidential patient health information online so long as there are appropriate policies in place attempting to prevent such an outcome.
In 2016, an employee of the Resnick Neuropsychiatric Hospital of UCLA posted diagnoses of about 10 patients on Instagram in a partially redacted image. According to court records, another employee at the acute psychiatric hospital saw the post and reported it to a supervisor; the worker who made the post initially landed on administrative leave and ultimately lost his job.
Following the incident, the California Department of Public Health ordered the Regents of the University of California to pay a $75,000 penalty for the data exposure and alleged privacy violations.
UCLA Health’s Office of Compliance Services investigated the matter and found no patient reported adverse consequences. It also notified all employees of the duty to protect patient confidentiality. The CDPH gave Resnick and initial and amended Statement of Deficiencies and Plan of Correction and the hospital complied on schedule. The fine was a per-patient penalty of $7,500.
Resnick asked to appeal the judgment, but an administrative law judge agreed state lawmakers intended the legal standard for this type of violation was strict liability, meaning the alleged violation was enough to require the hospital to pay. CDPH didn’t have to prove the hospital failed to have proper procedures in place before assessing a penalty, the ALJ found.
The hospital took the issue to Sacramento County Superior Court, where Judge Stephen Acquisto ultimately sided with Resnick by finding that language stipulating hospitals “shall prevent” such disclosures must be read in conjunction with another law mandating health facilities have appropriate privacy safeguards and reasonably protect sensitive data.
The judge overturned the ruling of the ALJ, saying the hospital could avoid the penalty by showing the employee had posted the information against hospital policies in place to attempt to prevent such disclosures.
The California Third District Appellate Court weighed in on the matter in a ruling filed Sept. 23. Justice Peter Krause wrote the opinion; Justices Harry Hull and Staci Boulware Eurie concurred.
Krause explained the panel reviewed the actual administrative determination and not Judge Acquisto’s decision, while further noting neither party disputed any of the facts on the record, only whether the CDPH properly interpreted state law.
The relevant passage from state law, according to the panel, stipulates hospitals and other health facilities “shall prevent unlawful or unauthorized access to, and use or disclosure of, patients’ medical information, as defined in Section 56.05 of the Civil Code and consistent with Section 1280.18.”
Whereas the state argued the “consistent with” clause referred to how another part of state law defines medical information, the panel agreed with Resnick that “Nothing in section 1280.18 purports to define or elaborate on ‘medical information.’ Rather, that section sets forth requirements that health care providers implement appropriate safeguards to protect the privacy of patient medical information and reasonably safeguard confidential medical information.”
The panel said there would be no need for one state law section to specify hospitals should “prevent unauthorized disclosure of medical information that is consistent with the type of medical information that is also referenced” in another section.
“The department argues that, had the Legislature intended to establish a reasonableness standard, it could have done so clearly with explicit language in the statute,” Krause wrote. “However, as Resnick notes, the same can be said of imposing strict liability. The mere mandate that health facilities ‘shall prevent’ disclosure is not a conclusive indicator of strict liability when the Legislature could have used plain language to that effect.”
Since it concluded the state law passage lacked ambiguity, the panel said it didn’t need to address the CDPH’s legislative history arguments or other positions. Resnick is entitled to pursue recovery of the legal costs associated with its appeal.
The health department is represented by the office of California Attorney General Rob Bonta.
Representing the regents are attorneys Ella Foley Gannon and Pejman Moshfegh, of the firm of Morgan, Lewis & Bockius.
The California Hospital Association filed a support brief on behalf of the California University hospitals through the firm of Athena Law.
