Despite the advances that have been made promoting diversity among people of different races, ethnicities, religions, and sexual orientation, there still exists an unfortunate stigma against those with HIV.  One big issue that comes up often for those with HIV is the inadvertent disclosure of HIV status by health professionals, hospitals, doctors, nurses, and other practitioners who have access to this information.

Criminally Illegal? Unfortunately, in most states, there is often no law that makes it  criminally punishable on a blanket basis for HIV status to be disclosed (though it is often criminally punishable for those with HIV to “willfully” transmit HIV to others).

Civil Penalties. California, which has some of the strongest pro-individual laws in the country, also has strict guidelines protecting health records from disclosure, including records of HIV status.  Health records identifying HIV status are considered “confidential health records” under the California Health and Safety Code, and must be handled with confidentiality.   The unauthorized disclosure of confidential public heath records is subject to civil penalties under Health and Safety Code 121025(e).   < Negligent disclosure of information contained in a confidential public health record, meaning a disclosure that is accidental or unintentional, is subject to a civil penalty of up to $2,500, plus court costs under HSC 121025(e)(1).  Willful or malicious disclosure of the content of a public health record, on the other hand, is punishable by a civil penalty of $5,000-$10,000 plus court costs under HSC 121025(e)(2).   “Willful” or “malicious” disclosures usually require intentional conduct and culpability, meaning, the perpetrator knew what they were doing, and knew that it was wrong, but did it anyway.  The penalties are steeper when the disclosure actually hurts the victim.   Willful, malicious, or negligent disclosure of information contained in a public health record that results in economic, bodily, or psychological harm to the person named in the record is considered to be a criminal misdemeanor, subject to imprisonment for a period of up to one year and/or a fine of up to $25,000 plus court costs under 121025(e)(3).  Under HSC 121025(e)(5), each disclosure in violation of California law is a separate, actionable offense.

Civil Claims.  When individuals with HIV have their status as HIV-positive broadcast to those who did not previously have those facts, there may also exist a claim for “public disclosure of private facts,” which is a civil claim that can be brought by the aggrieved victim in a court of law.  Bringing a “public disclosure of private facts” claim, however, has its challenges. In California, an aggrieved claimant must show that  the disclosure of facts was “public,” that the facts disclosed were private and not generally known, that publication of the facts is offensive to a reasonable person, and that the facts are not newsworthy.

What to Do.  Individuals who suspect that their health records or HIV status may have been disclosed, especially by a medical provider, should take these steps:

  • Good Notes.  Adequate notes should be taken about the incident, the names/titles of the nurses, doctors, or other practitioners who were involved with the disclosure.  The notes should specify the date/time of visits, what exactly happened, whether the practitioner became aware of the unauthorized disclosure, what the victim said and did to notify the practitioner or treatment facility, and what measures were taken to rectify the disclosure, if any.  Information on whether a treatment facility is a repeat offender is also helpful.
  • Privacy Policies.  The patient should obtain a copy of all privacy policies, written consent forms, releases, and all other information the patient was asked to sign by the perpetrating medical treatment facility.  These documents will help determine whether the medical provider has sufficient controls in place to protect against the unauthorized disclosure of sensitive information.
  • Practices/Procedures.   Even if the privacy policies exist, they may not be enforced.  The victim should pay close attention to whether other staff in the treatment facility demonstrated any concern when reporting unauthorized disclosures.  A lack of regard for privacy concerns of HIV-status information could indicate general office sloppiness, and ultimately, the lack of any enforcement of privacy policies.
  • Consult with a Privacy Lawyer. Armed with good notes and documentation, individuals who are the victim of HIV disclosure should contact a privacy attorney familiar with the rules governing confidential health records. The attorney will be able to give the patient an overview of the legal rules, their rights, and options.

Having HIV is already a big enough challenge. Expecting healthcare providers obligated to keep confidential health information private should be easy. Unfortunately, doctors, nurses, assistants, and other practitioners are not perfect, and sometimes mistakes happen.   Fortunately, California’s HIV-status protection laws offer victims of unauthorized disclosures some means of rectifying the errors.

Rabeh M. A. Soofi is a Los Angeles attorney defending the civil rights and privacy of individuals through the LA metropolitan area, including members of the LGBT community.