On The Docket
David B. Brushwood, BSPharm, JD
A strong commitment to patient confidentiality is fundamental to the professional role of a pharmacist. HIPAA establishes rules for patient confidentiality, and pharmacy practice sites have adopted policies that incorporate those rules. But it is the profession that establishes standards for pharmacy practice, and not federal law. The repeated failure to comply with a pharmacy’s confidentiality policies may result in the termination of a pharmacist’s employment.
A California pharmacist was terminated from her employment after she released confidential protected health information (PHI) contrary to pharmacy policy.
The first incident occurred when the pharmacist removed PHI from the pharmacy computer and sent it to her home computer. From the home computer, the pharmacist sent an email to her supervisor and district manager complaining that a pharmacy patient had received medication intended for a different pharmacy patient. The email included the patients’ names, the drug names, and the prescription numbers. The pharmacist did not know whether her home computer had encryption software.
Several days later, the pharmacist forwarded this email from her home computer to her previous pharmacy supervisor and to her personal attorney.
The pharmacist also forwarded both emails, with unredacted PHI, to the Board of Pharmacy and to a Board of Pharmacy inspector.
The pharmacist’s supervisor informed the pharmacist that the removal of PHI from the pharmacy and the sharing of PHI with individuals outside the pharmacy was a violation of the pharmacy’s confidentiality policies. The pharmacist was told that further violations could result in the termination of her employment.
Less than 2 weeks later, the pharmacist sent an email from her home computer to the Board of Pharmacy complaining that the pharmacy was improperly billing insurance. This email included a patient’s name, medication name, and prescription number.
The pharmacy terminated the pharmacist’s employment for violation of the pharmacy’s confidentiality policies. The pharmacist sued the pharmacy for wrongful discharge, claiming that she had been terminated in retaliation for whistleblowing that exposed unlawful activity at the pharmacy. Following a trial, the judge concluded that the pharmacy had dismissed the pharmacist for continued violation of confidentiality policies and not for engagement in any protected whistleblower activity. The pharmacist appealed this ruling.
Rationale
The pharmacist’s primary argument on appeal was that her conduct fell within an exception to HIPAA that allows the disclosure of PHI “if a covered entity believes in good faith that disclosure is necessary to prevent or lessen a serious or imminent threat to the health or safety of a person or the public, and the disclosure is made to a person reasonably able to prevent or lessen the threat.”
The appellate court reasoned that the pharmacist’s reliance on HIPAA was misplaced. While acknowledging there were many parallels between the pharmacy’s confidentiality policies and the HIPAA requirements, the court noted that the pharmacist had been terminated for violating the pharmacy’s policies, and not for a violation of HIPAA. As such, whether the pharmacist’s disclosure of PHI was authorized by HIPAA had no bearing on whether the pharmacist’s employment was properly terminated.
The ruling of the trial court in favor of the pharmacy was affirmed.
Takeaways
In this case, the key question was whether the pharmacist was terminated for violating pharmacy confidentiality policies or for protected whistleblower reporting of unlawful activity by the pharmacy. The court ruled that it was the former, and not the latter.
The claim of whistleblower status is perilous. It is important to always exhaust internal management channels before “going public” by sharing pharmacy information outside the pharmacy. If internal reporting mechanisms are ineffective, then external reporting could be justified, but never through the disclosure of confidential PHI.
The pharmacy profession has a profound commitment to patient confidentiality. Pharmacy confidentiality policies reflect that commitment. Repeated violations of patient confidentiality can result in employment termination. ■