Opinion ID: 1952364
Heading Depth: 2
Heading Rank: 1

Heading: The Confidentiality Act Claims

Text: The plaintiff contends that by failing to comply with the terms of the subpoena (that is, by not having the keeper of the subpoenaed records bring the documents to court as directed by the subpoena and as required by G.L. § 9-17-5), Rite Aid violated the Confidentiality Act when it simply mailed her confidential health-care information directly to Higgins. We agree. It is true that in Bartlett we ruled that a particular section of the Confidentiality Act (§ 5-37.3-6) was unconstitutional because it purported to preclude the production and use of confidential medical records in connection with judicial proceedings. Bartlett, 503 A.2d at 517; see also Almonte, 644 A.2d at 298-99 (finding a similar provision enacted in response to Bartlett to be unconstitutional). However, neither Bartlett nor Almonte eradicated the underlying privilege created by such statutes. This privilege generally protects a person's confidential health-care records from being disclosed to unauthorized third parties unless the disclosure falls within one of the statutory exceptions. Although these records must be subject to compulsory legal process to avoid the separation-of-powers problem discussed in Bartlett and Almonte, the privilege does not evaporate merely because confidential health-care records can be or have been duly subpoenaed in connection with a court proceeding. On the contrary, the privilege continues to exist, and the documents that are privileged still cannot be disclosed (without the privilege holder's consent) except by strictly complying with the requirements of any compulsory legal process that may be issued with respect to such documents  and then only according to the procedures applicable to that process. Here, despite receiving a lawful subpoena, Rite Aid did not disclose the records pursuant to such compulsory legal process  that is, it did not bring the records to court as the subpoena commanded. [4] Had it done so, it could only then disclose them when and in what manner the court may direct, and even then it would have been subject to whatever limitations concerning disclosure the court may decide to impose. Instead, without legal warrant or other authorization, Rite Aid unilaterally disclosed plaintiff's confidential health-care records to an unauthorized third party (the attorney for the husband who had subpoenaed them) without first obtaining the court's permission or plaintiff's consent. Certainly nothing on the face of the subpoena allowed it to respond in this fashion, and no other law or rule of court countenanced such a disclosure of privileged documents. And because the subpoena did not indicate that it had been issued with any notice to plaintiff or with any court knowledge or authorization for Rite Aid to disclose the subpoenaed records to the attorney requesting them, the privilege created by the Confidentiality Act prevented Rite Aid from disclosing the records in this manner. In sum, while confidential health-care information about a person can be subject to compulsory legal process without first obtaining that person's consent, entities like Rite Aid that are subpoenaed to bring these records to a judicial proceeding are not thereby authorized to disclose them (or the confidential information contained therein) to any party or person other than the court (except as the court may thereafter order or the person holding the privilege may thereafter allow). Indeed, only after the privilege holder has been notified of the subpoena and has had the opportunity to review the information in the subpoenaed records, to object to the requested disclosure, and, if needed, to request possible protective limitations from the court on the nature and the extent of the requested disclosure and use of these records should such privileged information be turned over to the subpoenaing party. [5] However, we agree with the motion justice that Rite Aid is not a health care provider under § 5-37.3-3(4). As a pharmacy Rite Aid is not licensed to perform health care services as defined by the Confidentiality Act, that is, acts of diagnosis, treatment, medical evaluation or counselling or other such acts as may be permissible under the health care licensing statutes of this state. Section 5-37.3-3(5). The dispensing of medicines pursuant to prescriptions ordered by licensed health-care providers does not fall within this definition. Nonetheless, Rite Aid is a third party within the meaning of the Confidentiality Act because it is a person other than the patient to whom the confidential health care information relates and other than a health care provider. Section 5-37.3-3(14). Indeed, under § 5-37.3-4(c), third parties like Rite Aid that receive and retain a person's confidential health-care information must establish security procedures to prevent unauthorized disclosure, including limiting authorized access to this information. Pursuant to § 5-37.3-9, [a]ny one who violates the provisions of [the Confidentiality Act] may be held liable for actual and exemplary damages. Because Rite Aid violated the Confidentiality Act by disclosing plaintiff's confidential health-care information to an unauthorized person in a manner not allowed by law, it is liable to her for any actual damages she sustained as a result of this disclosure and, if the requisite malice-amounting-to-criminality circumstances were present, see, e.g., Palmisano v. Toth, 624 A.2d 314, 318 (R.I.1993), for any exemplary damages that the factfinder deems appropriate. [6] In addition, it is also liable, at the discretion of the court, to pay for plaintiff's attorney's fees in connection with her Confidentiality Act claim, because she is a successful party in this action. See § 5-37.3-9(d). Finally, because Rite Aid is not a qualified health care facility, it was not entitled to take advantage of the provisions of G.L.1956 § 9-19-39, [7] which allow a qualified health-care facility to respond to a subpoena for health-care records by certified mail. [8] A health-care facility is any institutional health service provider, facility or institution, place, building, agency, or portion thereof    used, operated, or engaged in providing health care services. General Laws 1956 § 23-17-2(5). A pharmacy does not fall within this definition. Thus, having received a subpoena to bring confidential health-care records to Family Court, Rite Aid was obliged to attend accordingly, § 9-17-5, until excused by the court or until and unless the subpoena was withdrawn. In any event it should not have disclosed plaintiff's confidential health-care information without plaintiff's consent or the court's direction to do so. See G.L.1956 § 5-37.3-2 (the purpose of the Confidentiality Act is to establish safeguards for maintaining the integrity of confidential health care information that relates to an individual).