A. B. v. The Oregon Clinic

Covered entities may disclose protected health information (PHI) without a patient’s consent to other covered entities where it is “necessary to prevent or lessen a serious and imminent threat” to a person or the public. 45 CFR § 164.512(j); see also ORS 192.558(2)(b) (allowing disclosure of PHI otherwise permitted or required by state or federal law).

A. B. appealed the below ruling of summary judgement for Providence St. Vincent's Medical Center (PSVMC); a common law breach of confidentiality claim following A. B.’s alleged sexual assault at The Oregon Clinic (TOC), and subsequently PSVMC’s disclosure of A. B.’s protected heath information (PHI) to TOC. A. B. contends PSVMC acted with improper intent, instead to warn TOC of impending police investigation, while PSVMC argues that the disclosure to TOC was permitted under relevant state and federal law in order to protect the health and safety of future patients at TOC. Covered entities, like TOC and PSVMC, may disclose PHI without a patient’s consent to other covered entities where it is “necessary to prevent or lessen a serious and imminent threat” to a person or the public. 45 CFR § 164.512(j); see also ORS 192.558(2)(b) (allowing disclosure of PHI otherwise permitted or required by state or federal law). Covered entities are presumed to act in good faith when the disclosed information comes from a person with apparent knowledge or authority. 45 CFR § 164.512(j)(4).  The Court found A. B.’s evidence of reason for disclosure was merely speculative. The Court held evidence was not legally sufficient to support the disclosure was for a purpose other than patient or public safety. Affirmed.