How must a lawyer safeguard the confidential health information of clients and opposing parties, given HIPAA?

Plain-English summary

Lawyers routinely obtain medical records and health information of clients and opposing parties in malpractice, personal-injury, and disability matters. HIPAA's Privacy Rule sets national standards for protecting individually identifiable health information, but it applies to health plans, clearinghouses, and certain health-care providers, and generally not to lawyers or law firms. The opinion addresses what a lawyer should do to safeguard a client's health information from disclosure, and what duty applies to third parties' health information.

On clients, the opinion concludes that the Rule 1.6 duty of confidentiality covers health information obtained during the representation, because confidentiality applies not just to client communications but to all information acquired during the representation (comment [3]). Neither Rule 1.6 nor its comment sets a specific standard of care, but a lawyer is expected to use reasonable care, since the Rules are rules of reason (Rule 0.2). The opinion illustrates with prior rulings: RPC 133 (a firm may recycle rather than shred confidential waste paper if it ensures the disposal process minimizes the risk of disclosure and custodial personnel are aware of the confidentiality concern) and RPC 215 (a lawyer may use a cellular or cordless phone despite interception risk, because the duty does not require infallibly secure methods, only reasonable care to choose a mode of communication suited to the circumstances). The standard for safeguarding confidential health information is therefore reasonable care as dictated by the circumstances, and the privacy policy expressed in the Privacy Rule should inform a lawyer's handling, particularly disposal.

On third parties, the opinion concludes that any information acquired during a representation, including third parties' information, is confidential and may be disclosed only as Rule 1.6 authorizes; even where disclosure is permitted, lawyers are encouraged to respect third parties' privacy and handle and dispose of their health information with the same care used for a client's. If a lawyer's information is in fact subject to the Privacy Rule, the lawyer must follow the rule's requirements for retention, transmission, and disposal.

In practice

Under the North Carolina rules as they stood at the time of the opinion, the analysis turns on the breadth of Rule 1.6 and the reasonable-care standard. The opinion holds that a lawyer must treat clients' and third parties' health information as confidential and use reasonable care, calibrated to the circumstances, to protect it, paying particular attention to disposal in light of HIPAA's privacy policy.

Per the opinion, where a lawyer's possession of health information actually falls under the Privacy Rule, the lawyer must comply with the rule itself.

Common questions

Q: Is a client's medical information covered by the duty of confidentiality?

A: Yes. The opinion concludes health information obtained during the representation is confidential under Rule 1.6, which covers all information acquired during the representation, not just client communications.

Q: What standard of care applies to safeguarding the information?

A: Reasonable care under the circumstances. The opinion concludes the Rules are rules of reason and require reasonable, not infallible, security, citing RPC 133 (waste-paper disposal) and RPC 215 (use of cordless phones).

Q: Does the lawyer owe any duty to protect an opposing party's health information?

A: Yes. The opinion concludes third-party health information acquired during a representation is confidential and may be disclosed only as Rule 1.6 allows, and encourages lawyers to protect and dispose of it with the same care used for a client's.

Q: Does HIPAA apply to lawyers?

A: Generally not, but its policy informs the duty. The opinion concludes lawyers are generally not covered by the Privacy Rule, yet its privacy policy should inform how lawyers handle health information; if a lawyer's information is actually subject to the rule, the lawyer must follow it.

Background and rules framework

The opinion applies North Carolina Rule 1.6 (confidentiality of information, covering all information acquired during the representation) and the reasonable-care principle of Rule 0.2 (the Rules are rules of reason), which track Model Rule 1.6 and its scope provisions. It draws on RPC 133 and RPC 215 for the reasonable-care standard and treats the HIPAA Privacy Rule as a source of public policy informing a lawyer's handling and disposal of health information.

Citations and references

Rules of Professional Conduct:

• MR 1.6 / NC Rule 1.6, cmt. [3] (confidentiality of all information acquired during the representation)
• NC Rule 0.2 (Scope; the Rules are rules of reason)

Statutes and regulations:

• Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Standards for Privacy of Individually Identifiable Health Information (Privacy Rule)

Other opinions cited:

• NC RPC 133 (disposal of confidential waste paper); NC RPC 215 (use of cellular or cordless telephones).

See also

• ABA Formal Op. 477R: Securing Communication of Client Information
• ABA Formal Op. 483: Lawyers' Obligations After a Data Breach

Source

• Landing page: https://www.ncbar.gov/for-lawyers/ethics-and-governing-rules/ethics-opinions/opinions/2006-formal-ethics-opinion-10/

Original opinion text

Reproduced from the official source for research purposes. The linked source is authoritative.

Inquiry #1:

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) required the US Department of Health and Human Services to establish a set of national standards for the protection of certain health information including identifiable medical records of individual patients. Pursuant to this mandate, the US Department of Health issued Standards for Privacy of Individually Identifiable Health Information (the Privacy Rule) which establishes national standards for the protection of protected health information. The Privacy Rule applies to health plans, health care clearinghouses, and to any health care provider who transmits health information in electronic form in connection with certain specified transactions.

Lawyers frequently obtain medical records and health information of both clients and opposing parties in conjunction with the prosecution or defense of medical malpractice and personal injury cases and other representations involving questions of injury or disability. It does not appear that lawyers or law firms are covered by the Privacy Rule. However, in light of the public policy favoring the protection of sensitive medical information that is manifested by the Privacy Rule, what actions should a lawyer take to safeguard the health information of a client from disclosure to unauthorized persons?

Opinion #1:

The duty of confidentiality set forth in Rule 1.6 of the Rules of Professional Conduct prohibits a lawyer from revealing information acquired during the professional relationship unless the client gives informed consent, the disclosure is impliedly authorized to carry out the purpose of the representation, or the disclosure is otherwise permitted by the Rules. Comment [3] to Rule 1.6 observes that the confidentiality rule applies "not only to matters communicated in confidence by the client, but also to all information acquired during the representation." Therefore, health information obtained during the representation of a client is clearly covered by the duty of confidentiality.

Neither Rule 1.6 nor the comment to the rule provide guidance on the standard of care that a lawyer must use in fulfilling the duty of confidentiality. However, in the absence of a specific mandate, a lawyer is generally expected to use reasonable care in fulfilling his or her duties under the Rules. See Rule 0.2, Scope ("The Rules of Professional Conduct are rules of reason."). For example, RPC 133 states that a law firm is not required to shred waste paper that includes confidential client information and may recycle the waste paper provided the lawyer determines that

those persons or entities responsible for the disposal of waste paper employ procedures which effectively minimize the risk that confidential information might be disclosed...[and] custodial personnel…are conscious of the fact that confidential information may be present in waste paper products and are aware that the attorney's professional obligations require that there be no breach of confidentiality in regard to such information.

Similarly, RPC 215 provides that a lawyer may communicate confidential client information over a cellular or cordless telephone, despite the risk of interception, because the duty of confidentiality "does not require that a lawyer use only infallibly secure methods of communication." Instead, the lawyer "must use reasonable care to select a mode of communication that, in light of the exigencies of the existing circumstances, will best maintain any confidential information that might be conveyed in the communication." Id.; accord RPC 133 (some client information may be so sensitive that the duty can only be satisfied by shredding waste paper). Thus, the standard of care for safeguarding client confidential information is reasonable care as dictated by the circumstances.

In determining the degree of protection and care with which a client's health information is handled, the public policy of providing substantial protection for the privacy of such information which is expressed in the Privacy Rule should inform the actions of lawyers and law firms, particularly with regard to the disposal of such records.

Inquiry #2:

Lawyers may receive the health information of an opposing party or other third party in conjunction with the representation of a client. What duty does a lawyer have to protect the privacy of the health information of a third party?

Opinion #2:

Any information acquired during the course of a representation, including information of third parties, is confidential and may only be disclosed as authorized by Rule 1.6. Nevertheless, even if disclosure is permitted under the Rules, lawyers are encouraged to respect the privacy of third parties and to handle and dispose of health information of third parties with the same care that would be used with regard to the health information of a client.

It goes without saying that if a lawyer determines that health information in his or her possession is subject to the requirements of the Privacy Rule, the lawyer must follow the mandates of the rule with regard to the retention, transmission, or disposal of the health information.